{"action":"created","issue":{"url":"https://api.github.com/repos/FreeRADIUS/freeradius-server/issues/1314","labels_url":"https://api.github.com/repos/FreeRADIUS/freeradius-server/issues/1314/labels{/name}","comments_url":"https://api.github.com/repos/FreeRADIUS/freeradius-server/issues/1314/comments","events_url":"https://api.github.com/repos/FreeRADIUS/freeradius-server/issues/1314/events","html_url":"https://github.com/FreeRADIUS/freeradius-server/issues/1314","id":110405600,"number":1314,"title":"mschap: ERROR: FAILED: No NT/LM-Password.  Cannot perform authentication","user":{"login":"Toutzn","id":3788105,"avatar_url":"https://avatars.githubusercontent.com/u/3788105?v=3","gravatar_id":"","url":"https://api.github.com/users/Toutzn","html_url":"https://github.com/Toutzn","followers_url":"https://api.github.com/users/Toutzn/followers","following_url":"https://api.github.com/users/Toutzn/following{/other_user}","gists_url":"https://api.github.com/users/Toutzn/gists{/gist_id}","starred_url":"https://api.github.com/users/Toutzn/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Toutzn/subscriptions","organizations_url":"https://api.github.com/users/Toutzn/orgs","repos_url":"https://api.github.com/users/Toutzn/repos","events_url":"https://api.github.com/users/Toutzn/events{/privacy}","received_events_url":"https://api.github.com/users/Toutzn/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-10-08T09:21:30Z","updated_at":"2015-11-09T13:34:31Z","closed_at":"2015-10-08T13:12:32Z","body":"Hi @all.\r\n\r\nNot sure if we have a bug, but i tried to get an AD authentication about ldap more then 4 days. I read a lot of documentation and testet a lot of stuff.\r\ni have the following:\r\nIf i try to login via \"radtest -x test testpwd 127.0.0.1:18120 0 testing123\" on the linux console, everything is working via ldap. If i try this over the 802.1X AccessPoint, it doesn't work. \r\nIf i try the same with a defined user in users like \"bob     Cleartext-Password := \"hello\"\" over the accessPoint, it works fine.\r\nAnything goes wrong with the password if we i use peap:\r\n\r\nvia console with domain User over inner-tunnel:\r\n(1) Received Access-Request Id 7 from 127.0.0.1:48026 to 127.0.0.1:18120 length 74\r\n(1)   User-Name = \"test\"\r\n(1)   User-Password = \"password\"\r\n(1)   NAS-IP-Address = 192.168.8.27\r\n(1)   NAS-Port = 0\r\n(1)   Message-Authenticator = 0xc7c247ef109fb66332c18aab75068b33\r\n(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(1)   authorize {\r\n(1)     [files] = noop\r\n(1)     [mschap] = noop\r\n(1) suffix: Checking for suffix after \"@\"\r\n(1) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(1) suffix: No such realm \"NULL\"\r\n(1)     [suffix] = noop\r\n(1)     update control {\r\n(1)       Proxy-To-Realm := LOCAL\r\n(1)     } # update control = noop\r\n(1) eap: No EAP-Message, not doing EAP\r\n(1)     [eap] = noop\r\n(1)     [expiration] = noop\r\n(1)     [logintime] = noop\r\nrlm_ldap (ldap_domain): Reserved connection (0)\r\n(1) ldap_domain: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\r\n(1) ldap_domain:    --> (sAMAccountName=test)\r\n(1) ldap_domain: Performing search in \"cn=Users,dc=domain,dc=local\" with filter \"(sAMAccountName=test)\", scope \"sub\"\r\n(1) ldap_domain: Waiting for search result...\r\n(1) ldap_domain: User object found at DN \"CN=Test TEST,CN=Users,DC=domain,DC=local\"\r\n(1) ldap_domain: Processing user attributes\r\n(1) ldap_domain: WARNING: No \"known good\" password added. Ensure the admin user has permission to read the password attribute\r\n(1) ldap_domain: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)\r\nrlm_ldap (ldap_domain): Released connection (0)\r\nrlm_ldap (ldap_domain): Need 5 more connections to reach 10 spares\r\nrlm_ldap (ldap_domain): Opening additional connection (5), 1 of 27 pending slots used\r\nrlm_ldap (ldap_domain): Connecting to ldap://dc.domain.local:389\r\nrlm_ldap (ldap_domain): Waiting for bind result...\r\nrlm_ldap (ldap_domain): Bind successful\r\n(1)     [ldap_domain] = ok\r\n(1)     if ((ok || updated) && User-Password) {\r\n(1)     if ((ok || updated) && User-Password)  -> TRUE\r\n(1)     if ((ok || updated) && User-Password)  {\r\n(1)       update {\r\n(1)         control:Auth-Type := LDAP\r\n(1)       } # update = noop\r\n(1)     } # if ((ok || updated) && User-Password)  = noop\r\n(1)     [pap] = noop\r\n(1)     if (User-Password) {\r\n(1)     if (User-Password)  -> TRUE\r\n(1)     if (User-Password)  {\r\n(1)       update control {\r\n(1)         Auth-Type := LDAP\r\n(1)       } # update control = noop\r\n(1)     } # if (User-Password)  = noop\r\n(1)   } # authorize = ok\r\n(1) Found Auth-Type = LDAP\r\n(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(1)   Auth-Type LDAP {\r\nrlm_ldap (ldap_domain): Reserved connection (1)\r\n(1) ldap_domain: Login attempt by \"test\"\r\n(1) ldap_domain: Using user DN from request \"CN=Test TEST,CN=Users,DC=domain,DC=local\"\r\n(1) ldap_domain: Waiting for bind result...\r\n(1) ldap_domain: Bind successful\r\n(1) ldap_domain: Bind as user \"CN=Test TEST,CN=Users,DC=domain,DC=local\" was successful\r\nrlm_ldap (ldap_domain): Released connection (1)\r\n(1)     [ldap_domain] = ok\r\n(1)   } # Auth-Type LDAP = ok\r\n(1) Sent Access-Accept Id 7 from 127.0.0.1:18120 to 127.0.0.1:48026 length 0\r\n(1) Finished request\r\nWaking up in 0.3 seconds.\r\n(0) Cleaning up request packet ID 130 with timestamp +4\r\nWaking up in 4.6 seconds.\r\n(1) Cleaning up request packet ID 7 with timestamp +9\r\nReady to process requests\r\n\r\n\r\nvia AccessPoint with domain User:\r\n(2) Received Access-Request Id 42 from 192.168.2.250:3072 to 192.168.8.27:1812 length 178\r\n(2)   User-Name = \"test\"\r\n(2)   Service-Type = Framed-User\r\n(2)   NAS-IP-Address = 192.168.2.250\r\n(2)   NAS-Port = 10\r\n(2)   NAS-Port-Id = \"10\"\r\n(2)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(2)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(2)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(2)   NAS-Identifier = \"AP-domain01\"\r\n(2)   NAS-Port-Type = Wireless-802.11\r\n(2)   Framed-MTU = 1500\r\n(2)   EAP-Message = 0x020100090174657374\r\n(2)   Message-Authenticator = 0x83d8e6487c3977ae8116026c26702525\r\n(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(2)   authorize {\r\n(2)     [files] = noop\r\n(2)     [preprocess] = ok\r\n(2) suffix: Checking for suffix after \"@\"\r\n(2) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(2) suffix: No such realm \"NULL\"\r\n(2)     [suffix] = noop\r\n(2) eap: Peer sent EAP Response (code 2) ID 1 length 9\r\n(2) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize\r\n(2)     [eap] = ok\r\n(2)   } # authorize = ok\r\n(2) Found Auth-Type = EAP\r\n(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(2)   authenticate {\r\n(2) eap: Peer sent packet with method EAP Identity (1)\r\n(2) eap: Calling submodule eap_peap to process data\r\n(2) eap_peap: Initiating new EAP-TLS session\r\n(2) eap_peap: [eaptls start] = request\r\n(2) eap: Sending EAP Request (code 1) ID 2 length 6\r\n(2) eap: EAP session adding &reply:State = 0x714e61bf714c78fd\r\n(2)     [eap] = handled\r\n(2)   } # authenticate = handled\r\n(2) Using Post-Auth-Type Challenge\r\n(2) Post-Auth-Type sub-section not found.  Ignoring.\r\n(2) Sent Access-Challenge Id 42 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(2)   EAP-Message = 0x010200061920\r\n(2)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(2)   State = 0x714e61bf714c78fd13de40933f3a43c8\r\n(2) Finished request\r\nWaking up in 4.9 seconds.\r\n(3) Received Access-Request Id 58 from 192.168.2.250:3072 to 192.168.8.27:1812 length 339\r\n(3)   User-Name = \"test\"\r\n(3)   Service-Type = Framed-User\r\n(3)   NAS-IP-Address = 192.168.2.250\r\n(3)   NAS-Port = 10\r\n(3)   NAS-Port-Id = \"10\"\r\n(3)   State = 0x714e61bf714c78fd13de40933f3a43c8\r\n(3)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(3)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(3)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(3)   NAS-Identifier = \"AP-domain01\"\r\n(3)   NAS-Port-Type = Wireless-802.11\r\n(3)   Framed-MTU = 1500\r\n(3)   EAP-Message = 0x0202009819800000008e160301008901000085030156162f87a13e4465c695b7754a35671de87e37f1c9c068c51ee0c258d39cc34f00004a00ffc024c023c00ac009c008c028c027c014c013c012c026c025c005c004c003c02ac029c00fc00ec00d006b0067003900330016003d003c0035002f000ac0\r\n(3)   Message-Authenticator = 0x1b3f4a72c416640c87d6f902d0effe2e\r\n(3) session-state: No cached attributes\r\n(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(3)   authorize {\r\n(3)     [files] = noop\r\n(3)     [preprocess] = ok\r\n(3) suffix: Checking for suffix after \"@\"\r\n(3) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(3) suffix: No such realm \"NULL\"\r\n(3)     [suffix] = noop\r\n(3) eap: Peer sent EAP Response (code 2) ID 2 length 152\r\n(3) eap: Continuing tunnel setup\r\n(3)     [eap] = ok\r\n(3)   } # authorize = ok\r\n(3) Found Auth-Type = EAP\r\n(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(3)   authenticate {\r\n(3) eap: Expiring EAP session with state 0x714e61bf714c78fd\r\n(3) eap: Finished EAP session with state 0x714e61bf714c78fd\r\n(3) eap: Previous EAP request found for state 0x714e61bf714c78fd, released from the list\r\n(3) eap: Peer sent packet with method EAP PEAP (25)\r\n(3) eap: Calling submodule eap_peap to process data\r\n(3) eap_peap: Continuing EAP-TLS\r\n(3) eap_peap: Peer indicated complete TLS record size will be 142 bytes\r\n(3) eap_peap: Got complete TLS record (142 bytes)\r\n(3) eap_peap: [eaptls verify] = length included\r\n(3) eap_peap: (other): before/accept initialization\r\n(3) eap_peap: TLS_accept: before/accept initialization\r\n(3) eap_peap: <<< TLS 1.0 Handshake [length 0089], ClientHello\r\n(3) eap_peap: TLS_accept: SSLv3 read client hello A\r\n(3) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello\r\n(3) eap_peap: TLS_accept: SSLv3 write server hello A\r\n(3) eap_peap: >>> TLS 1.0 Handshake [length 0964], Certificate\r\n(3) eap_peap: TLS_accept: SSLv3 write certificate A\r\n(3) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange\r\n(3) eap_peap: TLS_accept: SSLv3 write key exchange A\r\n(3) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone\r\n(3) eap_peap: TLS_accept: SSLv3 write server done A\r\n(3) eap_peap: TLS_accept: SSLv3 flush data\r\n(3) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A\r\n(3) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A\r\n(3) eap_peap: In SSL Handshake Phase\r\n(3) eap_peap: In SSL Accept mode\r\n(3) eap_peap: [eaptls process] = handled\r\n(3) eap: Sending EAP Request (code 1) ID 3 length 1004\r\n(3) eap: EAP session adding &reply:State = 0x714e61bf704d78fd\r\n(3)     [eap] = handled\r\n(3)   } # authenticate = handled\r\n(3) Using Post-Auth-Type Challenge\r\n(3) Post-Auth-Type sub-section not found.  Ignoring.\r\n(3) Sent Access-Challenge Id 58 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(3)   EAP-Message = 0x010303ec19c000000b00160301003902000035030194873ddf6cee275a11fcde492d5ae2b8261f83dd50ed9063133a31be2e3d24b500c01400000dff01000100000b00040300010216030109640b00096000095d0005a7308205a33082048ba0030201020213720000003379461d9f383b20c900010000\r\n(3)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(3)   State = 0x714e61bf704d78fd13de40933f3a43c8\r\n(3) Finished request\r\nWaking up in 4.9 seconds.\r\n(4) Received Access-Request Id 46 from 192.168.2.250:3072 to 192.168.8.27:1812 length 193\r\n(4)   User-Name = \"test\"\r\n(4)   Service-Type = Framed-User\r\n(4)   NAS-IP-Address = 192.168.2.250\r\n(4)   NAS-Port = 10\r\n(4)   NAS-Port-Id = \"10\"\r\n(4)   State = 0x714e61bf704d78fd13de40933f3a43c8\r\n(4)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(4)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(4)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(4)   NAS-Identifier = \"AP-domain01\"\r\n(4)   NAS-Port-Type = Wireless-802.11\r\n(4)   Framed-MTU = 1500\r\n(4)   EAP-Message = 0x020300061900\r\n(4)   Message-Authenticator = 0xe7c2576faeb3228ae2d056b77bc6cce8\r\n(4) session-state: No cached attributes\r\n(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(4)   authorize {\r\n(4)     [files] = noop\r\n(4)     [preprocess] = ok\r\n(4) suffix: Checking for suffix after \"@\"\r\n(4) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(4) suffix: No such realm \"NULL\"\r\n(4)     [suffix] = noop\r\n(4) eap: Peer sent EAP Response (code 2) ID 3 length 6\r\n(4) eap: Continuing tunnel setup\r\n(4)     [eap] = ok\r\n(4)   } # authorize = ok\r\n(4) Found Auth-Type = EAP\r\n(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(4)   authenticate {\r\n(4) eap: Expiring EAP session with state 0x714e61bf704d78fd\r\n(4) eap: Finished EAP session with state 0x714e61bf704d78fd\r\n(4) eap: Previous EAP request found for state 0x714e61bf704d78fd, released from the list\r\n(4) eap: Peer sent packet with method EAP PEAP (25)\r\n(4) eap: Calling submodule eap_peap to process data\r\n(4) eap_peap: Continuing EAP-TLS\r\n(4) eap_peap: Peer ACKed our handshake fragment\r\n(4) eap_peap: [eaptls verify] = request\r\n(4) eap_peap: [eaptls process] = handled\r\n(4) eap: Sending EAP Request (code 1) ID 4 length 1000\r\n(4) eap: EAP session adding &reply:State = 0x714e61bf734a78fd\r\n(4)     [eap] = handled\r\n(4)   } # authenticate = handled\r\n(4) Using Post-Auth-Type Challenge\r\n(4) Post-Auth-Type sub-section not found.  Ignoring.\r\n(4) Sent Access-Challenge Id 46 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(4)   EAP-Message = 0x010403e81940b53081b206082b060105050730028681a56c6461703a2f2f2f434e3d6e656465636f253230476d624825323043412c434e3d4149412c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d\r\n(4)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(4)   State = 0x714e61bf734a78fd13de40933f3a43c8\r\n(4) Finished request\r\nWaking up in 4.9 seconds.\r\n(2) Cleaning up request packet ID 42 with timestamp +151\r\n(3) Cleaning up request packet ID 58 with timestamp +151\r\n(4) Cleaning up request packet ID 46 with timestamp +151\r\nReady to process requests\r\n(5) Received Access-Request Id 216 from 192.168.2.250:3072 to 192.168.8.27:1812 length 193\r\n(5)   User-Name = \"test\"\r\n(5)   Service-Type = Framed-User\r\n(5)   NAS-IP-Address = 192.168.2.250\r\n(5)   NAS-Port = 10\r\n(5)   NAS-Port-Id = \"10\"\r\n(5)   State = 0x714e61bf734a78fd13de40933f3a43c8\r\n(5)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(5)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(5)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(5)   NAS-Identifier = \"AP-domain01\"\r\n(5)   NAS-Port-Type = Wireless-802.11\r\n(5)   Framed-MTU = 1500\r\n(5)   EAP-Message = 0x020400061900\r\n(5)   Message-Authenticator = 0xdf4b4a18dbd046ae4568ed5b900675ca\r\n(5) session-state: No cached attributes\r\n(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(5)   authorize {\r\n(5)     [files] = noop\r\n(5)     [preprocess] = ok\r\n(5) suffix: Checking for suffix after \"@\"\r\n(5) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(5) suffix: No such realm \"NULL\"\r\n(5)     [suffix] = noop\r\n(5) eap: Peer sent EAP Response (code 2) ID 4 length 6\r\n(5) eap: Continuing tunnel setup\r\n(5)     [eap] = ok\r\n(5)   } # authorize = ok\r\n(5) Found Auth-Type = EAP\r\n(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(5)   authenticate {\r\n(5) eap: Expiring EAP session with state 0x714e61bf734a78fd\r\n(5) eap: Finished EAP session with state 0x714e61bf734a78fd\r\n(5) eap: Previous EAP request found for state 0x714e61bf734a78fd, released from the list\r\n(5) eap: Peer sent packet with method EAP PEAP (25)\r\n(5) eap: Calling submodule eap_peap to process data\r\n(5) eap_peap: Continuing EAP-TLS\r\n(5) eap_peap: Peer ACKed our handshake fragment\r\n(5) eap_peap: [eaptls verify] = request\r\n(5) eap_peap: [eaptls process] = handled\r\n(5) eap: Sending EAP Request (code 1) ID 5 length 834\r\n(5) eap: EAP session adding &reply:State = 0x714e61bf724b78fd\r\n(5)     [eap] = handled\r\n(5)   } # authenticate = handled\r\n(5) Using Post-Auth-Type Challenge\r\n(5) Post-Auth-Type sub-section not found.  Ignoring.\r\n(5) Sent Access-Challenge Id 216 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(5)   EAP-Message = 0x01050342190068d99b627f3ca6561e6c1dcd0e8bb529b85d2515a36c2ba6f906ee9a223e619decfff2f24ef8674307735d591964d50ac988776a55970203010001a3819130818e301306092b060104018237140204061e0400430041300e0603551d0f0101ff040403020186300f0603551d130101ff04\r\n(5)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(5)   State = 0x714e61bf724b78fd13de40933f3a43c8\r\n(5) Finished request\r\nWaking up in 4.9 seconds.\r\n(6) Received Access-Request Id 228 from 192.168.2.250:3072 to 192.168.8.27:1812 length 331\r\n(6)   User-Name = \"test\"\r\n(6)   Service-Type = Framed-User\r\n(6)   NAS-IP-Address = 192.168.2.250\r\n(6)   NAS-Port = 10\r\n(6)   NAS-Port-Id = \"10\"\r\n(6)   State = 0x714e61bf724b78fd13de40933f3a43c8\r\n(6)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(6)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(6)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(6)   NAS-Identifier = \"AP-domain01\"\r\n(6)   NAS-Port-Type = Wireless-802.11\r\n(6)   Framed-MTU = 1500\r\n(6)   EAP-Message = 0x0205009019800000008616030100461000004241041ddb75e112e6a51620e1d90e79faf858ba440ee51859f6f36dbb3d61474b8fc891e7a246f576a1aef8372b95f81c96af01b2ba44e938f2dde2e5fa57032812201403010001011603010030680540b7b149e993c9f964d5e0a79cda35934c4c8e292f\r\n(6)   Message-Authenticator = 0x96295d1faa87d10973b6fe400102f545\r\n(6) session-state: No cached attributes\r\n(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(6)   authorize {\r\n(6)     [files] = noop\r\n(6)     [preprocess] = ok\r\n(6) suffix: Checking for suffix after \"@\"\r\n(6) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(6) suffix: No such realm \"NULL\"\r\n(6)     [suffix] = noop\r\n(6) eap: Peer sent EAP Response (code 2) ID 5 length 144\r\n(6) eap: Continuing tunnel setup\r\n(6)     [eap] = ok\r\n(6)   } # authorize = ok\r\n(6) Found Auth-Type = EAP\r\n(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(6)   authenticate {\r\n(6) eap: Expiring EAP session with state 0x714e61bf724b78fd\r\n(6) eap: Finished EAP session with state 0x714e61bf724b78fd\r\n(6) eap: Previous EAP request found for state 0x714e61bf724b78fd, released from the list\r\n(6) eap: Peer sent packet with method EAP PEAP (25)\r\n(6) eap: Calling submodule eap_peap to process data\r\n(6) eap_peap: Continuing EAP-TLS\r\n(6) eap_peap: Peer indicated complete TLS record size will be 134 bytes\r\n(6) eap_peap: Got complete TLS record (134 bytes)\r\n(6) eap_peap: [eaptls verify] = length included\r\n(6) eap_peap: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange\r\n(6) eap_peap: TLS_accept: SSLv3 read client key exchange A\r\n(6) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001]\r\n(6) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished\r\n(6) eap_peap: TLS_accept: SSLv3 read finished A\r\n(6) eap_peap: >>> TLS 1.0 ChangeCipherSpec [length 0001]\r\n(6) eap_peap: TLS_accept: SSLv3 write change cipher spec A\r\n(6) eap_peap: >>> TLS 1.0 Handshake [length 0010], Finished\r\n(6) eap_peap: TLS_accept: SSLv3 write finished A\r\n(6) eap_peap: TLS_accept: SSLv3 flush data\r\n(6) eap_peap: (other): SSL negotiation finished successfully\r\n(6) eap_peap: SSL Connection Established\r\n(6) eap_peap: [eaptls process] = handled\r\n(6) eap: Sending EAP Request (code 1) ID 6 length 65\r\n(6) eap: EAP session adding &reply:State = 0x714e61bf754878fd\r\n(6)     [eap] = handled\r\n(6)   } # authenticate = handled\r\n(6) Using Post-Auth-Type Challenge\r\n(6) Post-Auth-Type sub-section not found.  Ignoring.\r\n(6) Sent Access-Challenge Id 228 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(6)   EAP-Message = 0x01060041190014030100010116030100301b8a91b9523361e58c472a6f4bedc223a3780b77e80492846d5f574cd2db238cdd236645e7e78ed7e706e2dd3aecd6a2\r\n(6)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(6)   State = 0x714e61bf754878fd13de40933f3a43c8\r\n(6) Finished request\r\nWaking up in 4.8 seconds.\r\n(7) Received Access-Request Id 77 from 192.168.2.250:3072 to 192.168.8.27:1812 length 193\r\n(7)   User-Name = \"test\"\r\n(7)   Service-Type = Framed-User\r\n(7)   NAS-IP-Address = 192.168.2.250\r\n(7)   NAS-Port = 10\r\n(7)   NAS-Port-Id = \"10\"\r\n(7)   State = 0x714e61bf754878fd13de40933f3a43c8\r\n(7)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(7)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(7)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(7)   NAS-Identifier = \"AP-domain01\"\r\n(7)   NAS-Port-Type = Wireless-802.11\r\n(7)   Framed-MTU = 1500\r\n(7)   EAP-Message = 0x020600061900\r\n(7)   Message-Authenticator = 0xaabe36b47f3a6a409dd2ec806970d983\r\n(7) session-state: No cached attributes\r\n(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(7)   authorize {\r\n(7)     [files] = noop\r\n(7)     [preprocess] = ok\r\n(7) suffix: Checking for suffix after \"@\"\r\n(7) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(7) suffix: No such realm \"NULL\"\r\n(7)     [suffix] = noop\r\n(7) eap: Peer sent EAP Response (code 2) ID 6 length 6\r\n(7) eap: Continuing tunnel setup\r\n(7)     [eap] = ok\r\n(7)   } # authorize = ok\r\n(7) Found Auth-Type = EAP\r\n(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(7)   authenticate {\r\n(7) eap: Expiring EAP session with state 0x714e61bf754878fd\r\n(7) eap: Finished EAP session with state 0x714e61bf754878fd\r\n(7) eap: Previous EAP request found for state 0x714e61bf754878fd, released from the list\r\n(7) eap: Peer sent packet with method EAP PEAP (25)\r\n(7) eap: Calling submodule eap_peap to process data\r\n(7) eap_peap: Continuing EAP-TLS\r\n(7) eap_peap: Peer ACKed our handshake fragment.  handshake is finished\r\n(7) eap_peap: [eaptls verify] = success\r\n(7) eap_peap: [eaptls process] = success\r\n(7) eap_peap: Session established.  Decoding tunneled attributes\r\n(7) eap_peap: PEAP state TUNNEL ESTABLISHED\r\n(7) eap: Sending EAP Request (code 1) ID 7 length 43\r\n(7) eap: EAP session adding &reply:State = 0x714e61bf744978fd\r\n(7)     [eap] = handled\r\n(7)   } # authenticate = handled\r\n(7) Using Post-Auth-Type Challenge\r\n(7) Post-Auth-Type sub-section not found.  Ignoring.\r\n(7) Sent Access-Challenge Id 77 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(7)   EAP-Message = 0x0107002b19001703010020a6135f04ae6dffd42c8ef419d75113ac720759219e31f74d4247b6b610e9a071\r\n(7)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(7)   State = 0x714e61bf744978fd13de40933f3a43c8\r\n(7) Finished request\r\nWaking up in 4.8 seconds.\r\n(8) Received Access-Request Id 86 from 192.168.2.250:3072 to 192.168.8.27:1812 length 230\r\n(8)   User-Name = \"test\"\r\n(8)   Service-Type = Framed-User\r\n(8)   NAS-IP-Address = 192.168.2.250\r\n(8)   NAS-Port = 10\r\n(8)   NAS-Port-Id = \"10\"\r\n(8)   State = 0x714e61bf744978fd13de40933f3a43c8\r\n(8)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(8)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(8)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(8)   NAS-Identifier = \"AP-domain01\"\r\n(8)   NAS-Port-Type = Wireless-802.11\r\n(8)   Framed-MTU = 1500\r\n(8)   EAP-Message = 0x0207002b19001703010020aa7e796b21bdc47f3c2b751c50ffbf8aaaafc3ad47a3a4a6dab850e706bf7227\r\n(8)   Message-Authenticator = 0xb0ef481a7beafe09a46383286750ead8\r\n(8) session-state: No cached attributes\r\n(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(8)   authorize {\r\n(8)     [files] = noop\r\n(8)     [preprocess] = ok\r\n(8) suffix: Checking for suffix after \"@\"\r\n(8) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(8) suffix: No such realm \"NULL\"\r\n(8)     [suffix] = noop\r\n(8) eap: Peer sent EAP Response (code 2) ID 7 length 43\r\n(8) eap: Continuing tunnel setup\r\n(8)     [eap] = ok\r\n(8)   } # authorize = ok\r\n(8) Found Auth-Type = EAP\r\n(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(8)   authenticate {\r\n(8) eap: Expiring EAP session with state 0x714e61bf744978fd\r\n(8) eap: Finished EAP session with state 0x714e61bf744978fd\r\n(8) eap: Previous EAP request found for state 0x714e61bf744978fd, released from the list\r\n(8) eap: Peer sent packet with method EAP PEAP (25)\r\n(8) eap: Calling submodule eap_peap to process data\r\n(8) eap_peap: Continuing EAP-TLS\r\n(8) eap_peap: [eaptls verify] = ok\r\n(8) eap_peap: Done initial handshake\r\n(8) eap_peap: [eaptls process] = ok\r\n(8) eap_peap: Session established.  Decoding tunneled attributes\r\n(8) eap_peap: PEAP state WAITING FOR INNER IDENTITY\r\n(8) eap_peap: Identity - test\r\n(8) eap_peap: Got inner identity 'test'\r\n(8) eap_peap: Setting default EAP type for tunneled EAP session\r\n(8) eap_peap: Got tunneled request\r\n(8) eap_peap:   EAP-Message = 0x020700090174657374\r\n(8) eap_peap: Setting User-Name to test\r\n(8) eap_peap: Sending tunneled request to inner-tunnel\r\n(8) eap_peap:   EAP-Message = 0x020700090174657374\r\n(8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(8) eap_peap:   User-Name = \"test\"\r\n(8) Virtual server inner-tunnel received request\r\n(8)   EAP-Message = 0x020700090174657374\r\n(8)   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(8)   User-Name = \"test\"\r\n(8) server inner-tunnel {\r\n(8)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(8)     authorize {\r\n(8)       [files] = noop\r\n(8)       [mschap] = noop\r\n(8) suffix: Checking for suffix after \"@\"\r\n(8) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(8) suffix: No such realm \"NULL\"\r\n(8)       [suffix] = noop\r\n(8)       update control {\r\n(8)         Proxy-To-Realm := LOCAL\r\n(8)       } # update control = noop\r\n(8) eap: Peer sent EAP Response (code 2) ID 7 length 9\r\n(8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize\r\n(8)       [eap] = ok\r\n(8)     } # authorize = ok\r\n(8)   Found Auth-Type = EAP\r\n(8)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(8)     authenticate {\r\n(8) eap: Peer sent packet with method EAP Identity (1)\r\n(8) eap: Calling submodule eap_mschapv2 to process data\r\n(8) eap_mschapv2: Issuing Challenge\r\n(8) eap: Sending EAP Request (code 1) ID 8 length 43\r\n(8) eap: EAP session adding &reply:State = 0xbd1845cebd105fc4\r\n(8)       [eap] = handled\r\n(8)     } # authenticate = handled\r\n(8) } # server inner-tunnel\r\n(8) Virtual server sending reply\r\n(8)   EAP-Message = 0x0108002b1a0108002610ba684a0833e561a9e780eedf9829518f667265657261646975732d332e302e3131\r\n(8)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8)   State = 0xbd1845cebd105fc4a22a1c51082d7ecf\r\n(8) eap_peap: Got tunneled reply code 11\r\n(8) eap_peap:   EAP-Message = 0x0108002b1a0108002610ba684a0833e561a9e780eedf9829518f667265657261646975732d332e302e3131\r\n(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8) eap_peap:   State = 0xbd1845cebd105fc4a22a1c51082d7ecf\r\n(8) eap_peap: Got tunneled reply RADIUS code 11\r\n(8) eap_peap:   EAP-Message = 0x0108002b1a0108002610ba684a0833e561a9e780eedf9829518f667265657261646975732d332e302e3131\r\n(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8) eap_peap:   State = 0xbd1845cebd105fc4a22a1c51082d7ecf\r\n(8) eap_peap: Got tunneled Access-Challenge\r\n(8) eap: Sending EAP Request (code 1) ID 8 length 75\r\n(8) eap: EAP session adding &reply:State = 0x714e61bf774678fd\r\n(8)     [eap] = handled\r\n(8)   } # authenticate = handled\r\n(8) Using Post-Auth-Type Challenge\r\n(8) Post-Auth-Type sub-section not found.  Ignoring.\r\n(8) Sent Access-Challenge Id 86 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(8)   EAP-Message = 0x0108004b19001703010040c6831d9a1c5c30c64d40563c5fa21ee3cc103adbb4e99517563c9e67d781aefdd941ba0f19bc124976046e7471792eec1d4771c20abf67b78282a152634eed5e\r\n(8)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8)   State = 0x714e61bf774678fd13de40933f3a43c8\r\n(8) Finished request\r\nWaking up in 4.8 seconds.\r\n(5) Cleaning up request packet ID 216 with timestamp +181\r\n(6) Cleaning up request packet ID 228 with timestamp +181\r\n(7) Cleaning up request packet ID 77 with timestamp +181\r\n(8) Cleaning up request packet ID 86 with timestamp +181\r\nReady to process requests\r\n(9) Received Access-Request Id 14 from 192.168.2.250:3072 to 192.168.8.27:1812 length 278\r\n(9)   User-Name = \"test\"\r\n(9)   Service-Type = Framed-User\r\n(9)   NAS-IP-Address = 192.168.2.250\r\n(9)   NAS-Port = 10\r\n(9)   NAS-Port-Id = \"10\"\r\n(9)   State = 0x714e61bf774678fd13de40933f3a43c8\r\n(9)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(9)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(9)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(9)   NAS-Identifier = \"AP-domain01\"\r\n(9)   NAS-Port-Type = Wireless-802.11\r\n(9)   Framed-MTU = 1500\r\n(9)   EAP-Message = 0x0208005b1900170301005041a588e579c1a63e94555d08bea2166f123e059dea3d7f8a17bcbfd8e4f4a54c876ceee7b33a4a101a4afd0dc078e77a3c8163b76b6c9e9567e6954214f5e1ec01cdafcd013db92c58ae136658519d20\r\n(9)   Message-Authenticator = 0xac0b3e273dede594c80988c13eaafd54\r\n(9) session-state: No cached attributes\r\n(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(9)   authorize {\r\n(9)     [files] = noop\r\n(9)     [preprocess] = ok\r\n(9) suffix: Checking for suffix after \"@\"\r\n(9) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(9) suffix: No such realm \"NULL\"\r\n(9)     [suffix] = noop\r\n(9) eap: Peer sent EAP Response (code 2) ID 8 length 91\r\n(9) eap: Continuing tunnel setup\r\n(9)     [eap] = ok\r\n(9)   } # authorize = ok\r\n(9) Found Auth-Type = EAP\r\n(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(9)   authenticate {\r\n(9) eap: Expiring EAP session with state 0xbd1845cebd105fc4\r\n(9) eap: Finished EAP session with state 0x714e61bf774678fd\r\n(9) eap: Previous EAP request found for state 0x714e61bf774678fd, released from the list\r\n(9) eap: Peer sent packet with method EAP PEAP (25)\r\n(9) eap: Calling submodule eap_peap to process data\r\n(9) eap_peap: Continuing EAP-TLS\r\n(9) eap_peap: [eaptls verify] = ok\r\n(9) eap_peap: Done initial handshake\r\n(9) eap_peap: [eaptls process] = ok\r\n(9) eap_peap: Session established.  Decoding tunneled attributes\r\n(9) eap_peap: PEAP state phase2\r\n(9) eap_peap: EAP method MSCHAPv2 (26)\r\n(9) eap_peap: Got tunneled request\r\n(9) eap_peap:   EAP-Message = 0x0208003f1a0208003a316670e0343c5cde7c22158c2f3b1e05bd0000000000000000e36cbc3c625721798db23c5fc199979df656a52246010d310074657374\r\n(9) eap_peap: Setting User-Name to test\r\n(9) eap_peap: Sending tunneled request to inner-tunnel\r\n(9) eap_peap:   EAP-Message = 0x0208003f1a0208003a316670e0343c5cde7c22158c2f3b1e05bd0000000000000000e36cbc3c625721798db23c5fc199979df656a52246010d310074657374\r\n(9) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(9) eap_peap:   User-Name = \"test\"\r\n(9) eap_peap:   State = 0xbd1845cebd105fc4a22a1c51082d7ecf\r\n(9) Virtual server inner-tunnel received request\r\n(9)   EAP-Message = 0x0208003f1a0208003a316670e0343c5cde7c22158c2f3b1e05bd0000000000000000e36cbc3c625721798db23c5fc199979df656a52246010d310074657374\r\n(9)   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(9)   User-Name = \"test\"\r\n(9)   State = 0xbd1845cebd105fc4a22a1c51082d7ecf\r\n(9) server inner-tunnel {\r\n(9)   session-state: No cached attributes\r\n(9)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(9)     authorize {\r\n(9)       [files] = noop\r\n(9)       [mschap] = noop\r\n(9) suffix: Checking for suffix after \"@\"\r\n(9) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(9) suffix: No such realm \"NULL\"\r\n(9)       [suffix] = noop\r\n(9)       update control {\r\n(9)         Proxy-To-Realm := LOCAL\r\n(9)       } # update control = noop\r\n(9) eap: Peer sent EAP Response (code 2) ID 8 length 63\r\n(9) eap: No EAP Start, assuming it's an on-going EAP conversation\r\n(9)       [eap] = updated\r\n(9)       [expiration] = noop\r\n(9)       [logintime] = noop\r\nrlm_ldap (ldap_domain): Closing connection (2): Hit idle_timeout, was idle for 211 seconds\r\nrlm_ldap (ldap_domain): Closing connection (3): Hit idle_timeout, was idle for 211 seconds\r\nrlm_ldap (ldap_domain): Closing connection (4): Hit idle_timeout, was idle for 211 seconds\r\nrlm_ldap (ldap_domain): Closing connection (0): Hit idle_timeout, was idle for 202 seconds\r\nrlm_ldap (ldap_domain): You probably need to lower \"min\"\r\nrlm_ldap (ldap_domain): Closing connection (5): Hit idle_timeout, was idle for 202 seconds\r\nrlm_ldap (ldap_domain): You probably need to lower \"min\"\r\nrlm_ldap (ldap_domain): Closing connection (1): Hit idle_timeout, was idle for 202 seconds\r\nrlm_ldap (ldap_domain): You probably need to lower \"min\"\r\nrlm_ldap (ldap_domain): 0 of 0 connections in use.  You  may need to increase \"spare\"\r\nrlm_ldap (ldap_domain): Opening additional connection (6), 1 of 32 pending slots used\r\nrlm_ldap (ldap_domain): Connecting to ldap://dc.domain.local:389\r\nrlm_ldap (ldap_domain): Waiting for bind result...\r\nrlm_ldap (ldap_domain): Bind successful\r\nrlm_ldap (ldap_domain): Reserved connection (6)\r\n(9) ldap_domain: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\r\n(9) ldap_domain:    --> (sAMAccountName=test)\r\n(9) ldap_domain: Performing search in \"cn=Users,dc=domain,dc=local\" with filter \"(sAMAccountName=test)\", scope \"sub\"\r\n(9) ldap_domain: Waiting for search result...\r\n(9) ldap_domain: User object found at DN \"CN=Test TEST,CN=Users,DC=domain,DC=local\"\r\n(9) ldap_domain: Processing user attributes\r\n(9) ldap_domain: WARNING: No \"known good\" password added. Ensure the admin user has permission to read the password attribute\r\n(9) ldap_domain: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)\r\nrlm_ldap (ldap_domain): Released connection (6)\r\nrlm_ldap (ldap_domain): Need 2 more connections to reach 10 spares\r\nrlm_ldap (ldap_domain): Opening additional connection (7), 1 of 31 pending slots used\r\nrlm_ldap (ldap_domain): Connecting to ldap://dc.domain.local:389\r\nrlm_ldap (ldap_domain): Waiting for bind result...\r\nrlm_ldap (ldap_domain): Bind successful\r\n(9)       [ldap_domain] = ok\r\n(9)       if ((ok || updated) && User-Password) {\r\n(9)       if ((ok || updated) && User-Password)  -> FALSE\r\n(9)       [pap] = noop\r\n(9)       if (User-Password) {\r\n(9)       if (User-Password)  -> FALSE\r\n(9)     } # authorize = updated\r\n(9)   Found Auth-Type = EAP\r\n(9)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(9)     authenticate {\r\n(9) eap: Expiring EAP session with state 0xbd1845cebd105fc4\r\n(9) eap: Finished EAP session with state 0xbd1845cebd105fc4\r\n(9) eap: Previous EAP request found for state 0xbd1845cebd105fc4, released from the list\r\n(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)\r\n(9) eap: Calling submodule eap_mschapv2 to process data\r\n(9) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(9) eap_mschapv2:   Auth-Type MS-CHAP {\r\n(9) mschap: WARNING: No Cleartext-Password configured.  Cannot create NT-Password\r\n(9) mschap: WARNING: No Cleartext-Password configured.  Cannot create LM-Password\r\n(9) mschap: Creating challenge hash with username: test\r\n(9) mschap: Client is using MS-CHAPv2\r\n(9) mschap: ERROR: FAILED: No NT/LM-Password.  Cannot perform authentication\r\n(9) mschap: ERROR: MS-CHAP2-Response is incorrect\r\n(9)     [mschap] = reject\r\n(9)   } # Auth-Type MS-CHAP = reject\r\n(9) eap: Sending EAP Failure (code 4) ID 8 length 4\r\n(9) eap: Freeing handler\r\n(9)       [eap] = reject\r\n(9)     } # authenticate = reject\r\n(9)   Failed to authenticate the user\r\n(9)   Using Post-Auth-Type Reject\r\n(9)   Post-Auth-Type sub-section not found.  Ignoring.\r\n(9) } # server inner-tunnel\r\n(9) Virtual server sending reply\r\n(9)   MS-CHAP-Error = \"\\010E=691 R=1 C=12a7b91273b8d4ea014f8d6353762c6f V=3 M=Authentication failed\"\r\n(9)   EAP-Message = 0x04080004\r\n(9)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9) eap_peap: Got tunneled reply code 3\r\n(9) eap_peap:   MS-CHAP-Error = \"\\010E=691 R=1 C=12a7b91273b8d4ea014f8d6353762c6f V=3 M=Authentication failed\"\r\n(9) eap_peap:   EAP-Message = 0x04080004\r\n(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9) eap_peap: Got tunneled reply RADIUS code 3\r\n(9) eap_peap:   MS-CHAP-Error = \"\\010E=691 R=1 C=12a7b91273b8d4ea014f8d6353762c6f V=3 M=Authentication failed\"\r\n(9) eap_peap:   EAP-Message = 0x04080004\r\n(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9) eap_peap: Tunneled authentication was rejected\r\n(9) eap_peap: FAILURE\r\n(9) eap: Sending EAP Request (code 1) ID 9 length 43\r\n(9) eap: EAP session adding &reply:State = 0x714e61bf764778fd\r\n(9)     [eap] = handled\r\n(9)   } # authenticate = handled\r\n(9) Using Post-Auth-Type Challenge\r\n(9) Post-Auth-Type sub-section not found.  Ignoring.\r\n(9) Sent Access-Challenge Id 14 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(9)   EAP-Message = 0x0109002b19001703010020b8c28870cb31e457ad24447c2dad4915f836138d395b9e74200fe48a71906242\r\n(9)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9)   State = 0x714e61bf764778fd13de40933f3a43c8\r\n(9) Finished request\r\nWaking up in 4.9 seconds.\r\n(10) Received Access-Request Id 10 from 192.168.2.250:3072 to 192.168.8.27:1812 length 230\r\n(10)   User-Name = \"test\"\r\n(10)   Service-Type = Framed-User\r\n(10)   NAS-IP-Address = 192.168.2.250\r\n(10)   NAS-Port = 10\r\n(10)   NAS-Port-Id = \"10\"\r\n(10)   State = 0x714e61bf764778fd13de40933f3a43c8\r\n(10)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(10)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(10)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(10)   NAS-Identifier = \"AP-domain01\"\r\n(10)   NAS-Port-Type = Wireless-802.11\r\n(10)   Framed-MTU = 1500\r\n(10)   EAP-Message = 0x0209002b190017030100209f64c67a9a32761683b0d21eb6f28bfb8a42fa0a50d6ef3dfbf3815d7511e4a1\r\n(10)   Message-Authenticator = 0x26f3267a7372bfa1b0f71a27ccba5c9f\r\n(10) session-state: No cached attributes\r\n(10) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(10)   authorize {\r\n(10)     [files] = noop\r\n(10)     [preprocess] = ok\r\n(10) suffix: Checking for suffix after \"@\"\r\n(10) suffix: No '@' in User-Name = \"test\", looking up realm NULL\r\n(10) suffix: No such realm \"NULL\"\r\n(10)     [suffix] = noop\r\n(10) eap: Peer sent EAP Response (code 2) ID 9 length 43\r\n(10) eap: Continuing tunnel setup\r\n(10)     [eap] = ok\r\n(10)   } # authorize = ok\r\n(10) Found Auth-Type = EAP\r\n(10) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(10)   authenticate {\r\n(10) eap: Expiring EAP session with state 0x714e61bf764778fd\r\n(10) eap: Finished EAP session with state 0x714e61bf764778fd\r\n(10) eap: Previous EAP request found for state 0x714e61bf764778fd, released from the list\r\n(10) eap: Peer sent packet with method EAP PEAP (25)\r\n(10) eap: Calling submodule eap_peap to process data\r\n(10) eap_peap: Continuing EAP-TLS\r\n(10) eap_peap: [eaptls verify] = ok\r\n(10) eap_peap: Done initial handshake\r\n(10) eap_peap: [eaptls process] = ok\r\n(10) eap_peap: Session established.  Decoding tunneled attributes\r\n(10) eap_peap: PEAP state send tlv failure\r\n(10) eap_peap: Received EAP-TLV response\r\n(10) eap_peap:   The users session was previously rejected: returning reject (again.)\r\n(10) eap_peap:   This means you need to read the PREVIOUS messages in the debug output\r\n(10) eap_peap:   to find out the reason why the user was rejected\r\n(10) eap_peap:   Look for \"reject\" or \"fail\".  Those earlier messages will tell you\r\n(10) eap_peap:   what went wrong, and how to fix the problem\r\n(10) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module failed\r\n(10) eap: Sending EAP Failure (code 4) ID 9 length 4\r\n(10) eap: Failed in EAP select\r\n(10)     [eap] = invalid\r\n(10)   } # authenticate = invalid\r\n(10) Failed to authenticate the user\r\n(10) Using Post-Auth-Type Reject\r\n(10) Post-Auth-Type sub-section not found.  Ignoring.\r\n(10) Delaying response for 1.000000 seconds\r\nWaking up in 0.3 seconds.\r\nWaking up in 0.6 seconds.\r\n(10) Sending delayed response\r\n(10) Sent Access-Reject Id 10 from 192.168.8.27:1812 to 192.168.2.250:3072 length 44\r\n(10)   EAP-Message = 0x04090004\r\n(10)   Message-Authenticator = 0x00000000000000000000000000000000\r\nWaking up in 3.9 seconds.\r\n(9) Cleaning up request packet ID 14 with timestamp +211\r\n(10) Cleaning up request packet ID 10 with timestamp +211\r\nReady to process requests\r\n\r\n\r\ndefault site:\r\n\r\nserver default {\r\n\r\n\r\n\tlisten {\r\n\t\ttype = auth\r\n\t\tipaddr = *\r\n\t\tport = 0\r\n\t#\tclients = per_socket_clients\r\n\r\n\t\tlimit {\r\n\t\t\tmax_connections = 0\r\n\t\t\tlifetime = 0\r\n\t\t\tidle_timeout = 30\r\n\t\t}\r\n\t}\r\n\r\n\tlisten {\r\n\t\tipaddr = *\r\n\t\tport = 0\r\n\t\ttype = acct\r\n\t#\tinterface = eth0\r\n\t#\tclients = per_socket_clients\r\n\r\n\t\tlimit {\r\n\t\t\tidle_timeout = 0\r\n\t\t\tlifetime = 0\r\n\t\t\tmax_connections = 0\r\n\t\t}\r\n\t}\r\n\r\n\r\n\r\n\r\n\tauthorize {\r\n\t\tfiles\r\n\t\tpreprocess\r\n\t\tsuffix\r\n\t\teap {\r\n\t\t\tok = return\r\n\t\t}\r\n\t\texpiration\r\n\t\tlogintime\r\n\r\n\t}\r\n\r\n\tauthenticate {\r\n\t\teap\r\n\t}\r\n\r\n\tpreacct {\r\n\t}\r\n\r\n\taccounting {\r\n\t\tdetail\r\n\t\tsql_domain\r\n\t}\r\n\r\n\tsession {\r\n\t\tradutmp\r\n\t\tsql_domain\r\n\t}\r\n\r\n\tpost-auth {\r\n\t}\r\n\r\n\tpre-proxy {\r\n\t}\r\n\r\n\tpost-proxy {\r\n\t}\r\n}\r\n\r\n\r\ninner-tunnel site:\r\nserver inner-tunnel {\r\n\r\n\tlisten {\r\n\t\tipaddr = 127.0.0.1\r\n      \t\tport = 18120\r\n       \t\ttype = auth\r\n\t}\r\n\r\n\tauthorize {\r\n\t\tfiles\r\n                mschap\r\n\t\tsuffix\r\n\t\tupdate control {\r\n\t\t\tProxy-To-Realm := LOCAL\r\n    \t\t}\r\n                eap {\r\n                        ok = return\r\n                }\r\n\t\texpiration\r\n\t\tlogintime\r\n\t\tldap_domain\r\n\t\tif ((ok || updated) && User-Password) {\r\n                        update {\r\n                                control:Auth-Type := ldap\r\n                        }\r\n                }\r\n\t\tpap\r\n\t\tif (User-Password) {\r\n    \t\t\tupdate control {\r\n\t\t\t\tAuth-Type := ldap\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n\r\n\tauthenticate {\r\n\t\tAuth-Type PAP {\r\n\t\t\t#ldap_domain\r\n\t\t\tpap\r\n\t\t}\r\n                Auth-Type CHAP {\r\n                        chap\r\n                }\r\n                Auth-Type MS-CHAP {\r\n\t\t\tmschap\r\n                }\r\n\t\tAuth-Type LDAP {\r\n                        ldap_domain\r\n                }\r\n\t\tldap_domain\r\n\t\teap\r\n\t}\r\n\r\n\tsession {\r\n\t\tradutmp\r\n\t}\r\n\r\n\tpost-auth {\r\n\t}\r\n\r\n\tpre-proxy {\r\n\t}\r\n\r\n\tpost-proxy {\r\n\t}\r\n}\r\n\r\neap configuration:\r\n\r\neap {\r\n\tdefault_eap_type = peap\r\n\ttimer_expire     = 60\r\n\tignore_unknown_eap_types = no\r\n\tcisco_accounting_username_bug = no\r\n\tmax_sessions = ${max_requests}\r\n\tmd5 {\r\n\t}\r\n\r\n\tleap {\r\n\t}\r\n\r\n\tgtc {\r\n\t\tauth_type = PAP\r\n\t}\r\n\r\n\ttls-config tls-common {\r\n\t\tprivate_key_password = whatever\r\n\t\tprivate_key_file = ${certdir}/nedeco/aaa.nedeco.local.key\r\n\t\tcertificate_file = ${certdir}/nedeco/aaa.nedeco.local.pem\r\n\t\tca_file = ${cadir}/nedeco/nedeco_CA.pem\r\n\t\tdh_file = ${certdir}/dh\r\n\t\trandom_file = /dev/urandom\r\n\t\tca_path = ${cadir}\r\n\t\tcipher_list = \"DEFAULT\"\r\n\t\tecdh_curve = \"prime256v1\"\r\n\t\tcache {\r\n\t\t\tenable = no\r\n\t\t\tlifetime = 24 # hours\r\n\t\t\tmax_entries = 255\r\n\t\t}\r\n\r\n\t\tverify {\r\n\t\t}\r\n\r\n\t\tocsp {\r\n\t\t\tenable = no\r\n\t\t\toverride_cert_url = yes\r\n\t\t\turl = \"http://127.0.0.1/ocsp/\"\r\n\t\t}\r\n\t}\r\n\r\n\ttls {\r\n\t\ttls = tls-common\r\n\t}\r\n\r\n\tttls {\r\n\t}\r\n\r\n\r\n\tpeap {\r\n\t\ttls = tls-common\r\n\t\tdefault_eap_type = mschapv2\r\n\t\tcopy_request_to_tunnel = no\r\n\t\tuse_tunneled_reply = no\r\n\t\tproxy_tunneled_request_as_eap = no\r\n\t\tvirtual_server = \"inner-tunnel\"\r\n\t}\r\n\r\n\tmschapv2 {\r\n\t}\r\n}\r\n\r\n\r\nthe chap configuration:\r\n\r\nchap {\r\n        # no configuration\r\n}\r\n\r\n\r\nthe mschap configuration\r\n\r\nmschap {\r\n\tuse_mppe = yes\r\n\trequire_encryption = yes\r\n\trequire_strong = yes\r\n\twith_ntdomain_hack = yes\r\n\tpool {\r\n\t\tstart = ${thread[pool].start_servers}\r\n\t\tmin = ${thread[pool].min_spare_servers}\r\n\t\tmax = ${thread[pool].max_servers}\r\n\t\tspare = ${thread[pool].max_spare_servers}\r\n\t\tuses = 0\r\n\t\tretry_delay = 30\r\n\t\tlifetime = 86400\r\n\t\tcleanup_interval = 300\r\n\t\tidle_timeout = 600\r\n\t}\r\n\r\n\tpasschange {\r\n\t}\r\n\tretry_msg = \"Re-enter (or reset) the password\"\r\n}\r\n\r\n\r\nldap configuration:\r\n\r\nldap ldap_domain {\r\n\tserver = 'dc.domain.local'\r\n\tport = 389\r\n\tidentity = 'cn=Administrator,cn=Users,dc=domain,dc=local'\r\n\tpassword = password\r\n\tbase_dn = 'cn=Users,dc=domain,dc=local'\r\n\r\n\tsasl {\r\n\t\trealm = 'domain.local'\r\n\t}\r\n\r\n\r\n\tupdate {\r\n\t\tcontrol:Password-With-Header\t+= 'userPassword'\r\n\t\tcontrol:NT-Password\t\t:= 'ntPassword'\r\n\t\tcontrol:\t\t\t+= 'radiusControlAttribute'\r\n\t\trequest:\t\t\t+= 'radiusRequestAttribute'\r\n\t\treply:\t\t\t\t+= 'radiusReplyAttribute'\r\n\t}\r\n\r\n\tedir_autz = yes\r\n\r\n\tuser {\r\n\t\tbase_dn = \"${..base_dn}\"\r\n\t\tfilter = \"(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\"\r\n\r\n\t\tsasl {\r\n\t\t}\r\n\r\n\t\tscope = 'sub'\r\n\r\n\t}\r\n\r\n\r\n\tgroup {\r\n\t\tbase_dn = \"${..base_dn}\"\r\n\t\tfilter = '(objectClass=posixGroup)'\r\n\t\tmembership_attribute = 'memberOf'\r\n\t}\r\n\r\n\r\n\tprofile {\r\n\t}\r\n\r\n\r\n\tclient {\r\n\t\tbase_dn = \"${..base_dn}\"\r\n\t\tfilter = '(objectClass=radiusClient)'\r\n\t\t}\r\n\r\n\t\tattribute {\r\n\t\t\tipaddr\t\t\t\t= 'radiusClientIdentifier'\r\n\t\t\tsecret\t\t\t\t= 'radiusClientSecret'\r\n\t\t}\r\n\t}\r\n\r\n\r\n\taccounting {\r\n\t\treference = \"%{tolower:type.%{Acct-Status-Type}}\"\r\n\r\n\t\ttype {\r\n\t\t\tstart {\r\n\t\t\t\tupdate {\r\n\t\t\t\t\tdescription := \"Online at %S\"\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tinterim-update {\r\n\t\t\t\tupdate {\r\n\t\t\t\t\tdescription := \"Last seen at %S\"\r\n\t\t\t\t}\r\n\t\t\t}\r\n\r\n\t\t\tstop {\r\n\t\t\t\tupdate {\r\n\t\t\t\t\tdescription := \"Offline at %S\"\r\n\t\t\t\t}\r\n\t\t\t}\r\n\t\t}\r\n\t}\r\n\r\n\r\n\tpost-auth {\r\n\t\tupdate {\r\n\t\t\tdescription := \"Authenticated at %S\"\r\n\t\t}\r\n\t}\r\n\r\n\toptions {\r\n\t\tchase_referrals = yes\r\n\t\trebind = yes\r\n\t\tres_timeout = 10\r\n\t\tsrv_timelimit = 3\r\n\t\tnet_timeout = 1\r\n\t\tidle = 60\r\n\t\tprobes = 3\r\n\t\tinterval = 3\r\n\t\tldap_debug = 0x0028\r\n\t}\r\n\r\n\ttls {\r\n\t\tstart_tls = yes\r\n\t\trequire_cert\t= 'never'\r\n\t}\r\n\r\n\tpool {\r\n\t\tstart = ${thread[pool].start_servers}\r\n\t\tmin = ${thread[pool].min_spare_servers}\r\n\t\tmax = ${thread[pool].max_servers}\r\n\t\tspare = ${thread[pool].max_spare_servers}\r\n\t\tuses = 0\r\n\t\tretry_delay = 30\r\n\t\tlifetime = 0\r\n\t\tidle_timeout = 60\r\n\t}\r\n}\r\n\r\n\r\n\r\nradius Version: radiusd: FreeRADIUS Version 3.0.11 (git #7a659a2), for host x86_64-unknown-linux-gnu, built on Oct  7 2015 at 15:23:07\r\n\r\n\r\nwith user bob over console:\r\n\r\n(0) Received Access-Request Id 213 from 127.0.0.1:45282 to 127.0.0.1:18120 length 73\r\n(0)   User-Name = \"bob\"\r\n(0)   User-Password = \"hello\"\r\n(0)   NAS-IP-Address = 192.168.8.27\r\n(0)   NAS-Port = 0\r\n(0)   Message-Authenticator = 0xbed4902174d4f8ff5f36492af1ae51de\r\n(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(0)   authorize {\r\n(0) files: users: Matched entry bob at line 69\r\n(0)     [files] = ok\r\n(0)     [mschap] = noop\r\n(0) suffix: Checking for suffix after \"@\"\r\n(0) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(0) suffix: No such realm \"NULL\"\r\n(0)     [suffix] = noop\r\n(0)     update control {\r\n(0)       Proxy-To-Realm := LOCAL\r\n(0)     } # update control = noop\r\n(0) eap: No EAP-Message, not doing EAP\r\n(0)     [eap] = noop\r\n(0)     [expiration] = noop\r\n(0)     [logintime] = noop\r\nrlm_ldap (ldap_domain): Reserved connection (0)\r\n(0) ldap_domain: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\r\n(0) ldap_domain:    --> (sAMAccountName=bob)\r\n(0) ldap_domain: Performing search in \"cn=Users,dc=domain,dc=local\" with filter \"(sAMAccountName=bob)\", scope \"sub\"\r\n(0) ldap_domain: Waiting for search result...\r\n(0) ldap_domain: Search returned no results\r\nrlm_ldap (ldap_domain): Released connection (0)\r\nrlm_ldap (ldap_domain): Need 5 more connections to reach 10 spares\r\nrlm_ldap (ldap_domain): Opening additional connection (5), 1 of 27 pending slots used\r\nrlm_ldap (ldap_domain): Connecting to ldap://dc.domain.local:389\r\nrlm_ldap (ldap_domain): Waiting for bind result...\r\nrlm_ldap (ldap_domain): Bind successful\r\n(0)     [ldap_domain] = notfound\r\n(0)     if ((ok || updated) && User-Password) {\r\n(0)     if ((ok || updated) && User-Password)  -> FALSE\r\n(0)     [pap] = updated\r\n(0)     if (User-Password) {\r\n(0)     if (User-Password)  -> TRUE\r\n(0)     if (User-Password)  {\r\n(0)       update control {\r\n(0)         Auth-Type := LDAP\r\n(0)       } # update control = noop\r\n(0)     } # if (User-Password)  = noop\r\n(0)   } # authorize = updated\r\n(0) Found Auth-Type = LDAP\r\n(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(0)   Auth-Type LDAP {\r\nrlm_ldap (ldap_domain): Reserved connection (1)\r\n(0) ldap_domain: Login attempt by \"bob\"\r\n(0) ldap_domain: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\r\n(0) ldap_domain:    --> (sAMAccountName=bob)\r\n(0) ldap_domain: Performing search in \"cn=Users,dc=domain,dc=local\" with filter \"(sAMAccountName=bob)\", scope \"sub\"\r\n(0) ldap_domain: Waiting for search result...\r\n(0) ldap_domain: Search returned no results\r\nrlm_ldap (ldap_domain): Released connection (1)\r\n(0)     [ldap_domain] = notfound\r\n(0)   } # Auth-Type LDAP = notfound\r\n(0) Failed to authenticate the user\r\n(0) Using Post-Auth-Type Reject\r\n(0) Post-Auth-Type sub-section not found.  Ignoring.\r\n(0) Delaying response for 1.000000 seconds\r\nWaking up in 0.3 seconds.\r\nWaking up in 0.6 seconds.\r\n(0) Sending delayed response\r\n(0) Sent Access-Reject Id 213 from 127.0.0.1:18120 to 127.0.0.1:45282 length 20\r\nWaking up in 3.9 seconds.\r\n(0) Cleaning up request packet ID 213 with timestamp +5\r\nReady to process requests\r\n\r\n\r\n\r\nwith user bob over AccessPoint:\r\n\r\n(1) Received Access-Request Id 155 from 192.168.2.250:3072 to 192.168.8.27:1812 length 176\r\n(1)   User-Name = \"bob\"\r\n(1)   Service-Type = Framed-User\r\n(1)   NAS-IP-Address = 192.168.2.250\r\n(1)   NAS-Port = 10\r\n(1)   NAS-Port-Id = \"10\"\r\n(1)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(1)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(1)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(1)   NAS-Identifier = \"AP-domain01\"\r\n(1)   NAS-Port-Type = Wireless-802.11\r\n(1)   Framed-MTU = 1500\r\n(1)   EAP-Message = 0x0201000801626f62\r\n(1)   Message-Authenticator = 0x4680895a204b3df7d15d82558ff9e6ea\r\n(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(1)   authorize {\r\n(1) files: users: Matched entry bob at line 69\r\n(1)     [files] = ok\r\n(1)     [preprocess] = ok\r\n(1) suffix: Checking for suffix after \"@\"\r\n(1) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(1) suffix: No such realm \"NULL\"\r\n(1)     [suffix] = noop\r\n(1) eap: Peer sent EAP Response (code 2) ID 1 length 8\r\n(1) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize\r\n(1)     [eap] = ok\r\n(1)   } # authorize = ok\r\n(1) Found Auth-Type = EAP\r\n(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(1)   authenticate {\r\n(1) eap: Peer sent packet with method EAP Identity (1)\r\n(1) eap: Calling submodule eap_peap to process data\r\n(1) eap_peap: Initiating new EAP-TLS session\r\n(1) eap_peap: [eaptls start] = request\r\n(1) eap: Sending EAP Request (code 1) ID 2 length 6\r\n(1) eap: EAP session adding &reply:State = 0x7322fa167320e364\r\n(1)     [eap] = handled\r\n(1)   } # authenticate = handled\r\n(1) Using Post-Auth-Type Challenge\r\n(1) Post-Auth-Type sub-section not found.  Ignoring.\r\n(1) Sent Access-Challenge Id 155 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(1)   EAP-Message = 0x010200061920\r\n(1)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(1)   State = 0x7322fa167320e3641bb25e163c98a49d\r\n(1) Finished request\r\nWaking up in 4.9 seconds.\r\n(2) Received Access-Request Id 219 from 192.168.2.250:3072 to 192.168.8.27:1812 length 338\r\n(2)   User-Name = \"bob\"\r\n(2)   Service-Type = Framed-User\r\n(2)   NAS-IP-Address = 192.168.2.250\r\n(2)   NAS-Port = 10\r\n(2)   NAS-Port-Id = \"10\"\r\n(2)   State = 0x7322fa167320e3641bb25e163c98a49d\r\n(2)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(2)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(2)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(2)   NAS-Identifier = \"AP-domain01\"\r\n(2)   NAS-Port-Type = Wireless-802.11\r\n(2)   Framed-MTU = 1500\r\n(2)   EAP-Message = 0x0202009819800000008e1603010089010000850301561634f097408b8f9058fa38f1f34ce4854696e71aebecb3ae3cd9850b14d4cc00004a00ffc024c023c00ac009c008c028c027c014c013c012c026c025c005c004c003c02ac029c00fc00ec00d006b0067003900330016003d003c0035002f000ac0\r\n(2)   Message-Authenticator = 0x5309b752e9ed063e669ba97b7c937db8\r\n(2) session-state: No cached attributes\r\n(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(2)   authorize {\r\n(2) files: users: Matched entry bob at line 69\r\n(2)     [files] = ok\r\n(2)     [preprocess] = ok\r\n(2) suffix: Checking for suffix after \"@\"\r\n(2) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(2) suffix: No such realm \"NULL\"\r\n(2)     [suffix] = noop\r\n(2) eap: Peer sent EAP Response (code 2) ID 2 length 152\r\n(2) eap: Continuing tunnel setup\r\n(2)     [eap] = ok\r\n(2)   } # authorize = ok\r\n(2) Found Auth-Type = EAP\r\n(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(2)   authenticate {\r\n(2) eap: Expiring EAP session with state 0x7322fa167320e364\r\n(2) eap: Finished EAP session with state 0x7322fa167320e364\r\n(2) eap: Previous EAP request found for state 0x7322fa167320e364, released from the list\r\n(2) eap: Peer sent packet with method EAP PEAP (25)\r\n(2) eap: Calling submodule eap_peap to process data\r\n(2) eap_peap: Continuing EAP-TLS\r\n(2) eap_peap: Peer indicated complete TLS record size will be 142 bytes\r\n(2) eap_peap: Got complete TLS record (142 bytes)\r\n(2) eap_peap: [eaptls verify] = length included\r\n(2) eap_peap: (other): before/accept initialization\r\n(2) eap_peap: TLS_accept: before/accept initialization\r\n(2) eap_peap: <<< TLS 1.0 Handshake [length 0089], ClientHello\r\n(2) eap_peap: TLS_accept: SSLv3 read client hello A\r\n(2) eap_peap: >>> TLS 1.0 Handshake [length 0039], ServerHello\r\n(2) eap_peap: TLS_accept: SSLv3 write server hello A\r\n(2) eap_peap: >>> TLS 1.0 Handshake [length 0964], Certificate\r\n(2) eap_peap: TLS_accept: SSLv3 write certificate A\r\n(2) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange\r\n(2) eap_peap: TLS_accept: SSLv3 write key exchange A\r\n(2) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone\r\n(2) eap_peap: TLS_accept: SSLv3 write server done A\r\n(2) eap_peap: TLS_accept: SSLv3 flush data\r\n(2) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A\r\n(2) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A\r\n(2) eap_peap: In SSL Handshake Phase\r\n(2) eap_peap: In SSL Accept mode\r\n(2) eap_peap: [eaptls process] = handled\r\n(2) eap: Sending EAP Request (code 1) ID 3 length 1004\r\n(2) eap: EAP session adding &reply:State = 0x7322fa167221e364\r\n(2)     [eap] = handled\r\n(2)   } # authenticate = handled\r\n(2) Using Post-Auth-Type Challenge\r\n(2) Post-Auth-Type sub-section not found.  Ignoring.\r\n(2) Sent Access-Challenge Id 219 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(2)   EAP-Message = 0x010303ec19c000000b001603010039020000350301da2dfe903d7c37a7634c8742deb0c9de5ef2b5d7f4c0d4d8d1697deec243cc5600c01400000dff01000100000b00040300010216030109640b00096000095d0005a7308205a33082048ba0030201020213720000003379461d9f383b20c900010000\r\n(2)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(2)   State = 0x7322fa167221e3641bb25e163c98a49d\r\n(2) Finished request\r\nWaking up in 4.9 seconds.\r\n(1) Cleaning up request packet ID 155 with timestamp +61\r\n(2) Cleaning up request packet ID 219 with timestamp +61\r\nReady to process requests\r\n(3) Received Access-Request Id 54 from 192.168.2.250:3072 to 192.168.8.27:1812 length 192\r\n(3)   User-Name = \"bob\"\r\n(3)   Service-Type = Framed-User\r\n(3)   NAS-IP-Address = 192.168.2.250\r\n(3)   NAS-Port = 10\r\n(3)   NAS-Port-Id = \"10\"\r\n(3)   State = 0x7322fa167221e3641bb25e163c98a49d\r\n(3)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(3)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(3)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(3)   NAS-Identifier = \"AP-domain01\"\r\n(3)   NAS-Port-Type = Wireless-802.11\r\n(3)   Framed-MTU = 1500\r\n(3)   EAP-Message = 0x020300061900\r\n(3)   Message-Authenticator = 0xa70b8b8371dc21e4a3352e99bad8a487\r\n(3) session-state: No cached attributes\r\n(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(3)   authorize {\r\n(3) files: users: Matched entry bob at line 69\r\n(3)     [files] = ok\r\n(3)     [preprocess] = ok\r\n(3) suffix: Checking for suffix after \"@\"\r\n(3) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(3) suffix: No such realm \"NULL\"\r\n(3)     [suffix] = noop\r\n(3) eap: Peer sent EAP Response (code 2) ID 3 length 6\r\n(3) eap: Continuing tunnel setup\r\n(3)     [eap] = ok\r\n(3)   } # authorize = ok\r\n(3) Found Auth-Type = EAP\r\n(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(3)   authenticate {\r\n(3) eap: Expiring EAP session with state 0x7322fa167221e364\r\n(3) eap: Finished EAP session with state 0x7322fa167221e364\r\n(3) eap: Previous EAP request found for state 0x7322fa167221e364, released from the list\r\n(3) eap: Peer sent packet with method EAP PEAP (25)\r\n(3) eap: Calling submodule eap_peap to process data\r\n(3) eap_peap: Continuing EAP-TLS\r\n(3) eap_peap: Peer ACKed our handshake fragment\r\n(3) eap_peap: [eaptls verify] = request\r\n(3) eap_peap: [eaptls process] = handled\r\n(3) eap: Sending EAP Request (code 1) ID 4 length 1000\r\n(3) eap: EAP session adding &reply:State = 0x7322fa167126e364\r\n(3)     [eap] = handled\r\n(3)   } # authenticate = handled\r\n(3) Using Post-Auth-Type Challenge\r\n(3) Post-Auth-Type sub-section not found.  Ignoring.\r\n(3) Sent Access-Challenge Id 54 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(3)   EAP-Message = 0x010403e81940b53081b206082b060105050730028681a56c6461703a2f2f2f434e3d6e656465636f253230476d624825323043412c434e3d4149412c434e3d5075626c69632532304b657925323053657276696365732c434e3d53657276696365732c434e3d436f6e66696775726174696f6e2c44433d\r\n(3)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(3)   State = 0x7322fa167126e3641bb25e163c98a49d\r\n(3) Finished request\r\nWaking up in 4.9 seconds.\r\n(4) Received Access-Request Id 29 from 192.168.2.250:3072 to 192.168.8.27:1812 length 192\r\n(4)   User-Name = \"bob\"\r\n(4)   Service-Type = Framed-User\r\n(4)   NAS-IP-Address = 192.168.2.250\r\n(4)   NAS-Port = 10\r\n(4)   NAS-Port-Id = \"10\"\r\n(4)   State = 0x7322fa167126e3641bb25e163c98a49d\r\n(4)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(4)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(4)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(4)   NAS-Identifier = \"AP-domain01\"\r\n(4)   NAS-Port-Type = Wireless-802.11\r\n(4)   Framed-MTU = 1500\r\n(4)   EAP-Message = 0x020400061900\r\n(4)   Message-Authenticator = 0x841ce2c1c9b797b25c3aff5bba5e059d\r\n(4) session-state: No cached attributes\r\n(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(4)   authorize {\r\n(4) files: users: Matched entry bob at line 69\r\n(4)     [files] = ok\r\n(4)     [preprocess] = ok\r\n(4) suffix: Checking for suffix after \"@\"\r\n(4) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(4) suffix: No such realm \"NULL\"\r\n(4)     [suffix] = noop\r\n(4) eap: Peer sent EAP Response (code 2) ID 4 length 6\r\n(4) eap: Continuing tunnel setup\r\n(4)     [eap] = ok\r\n(4)   } # authorize = ok\r\n(4) Found Auth-Type = EAP\r\n(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(4)   authenticate {\r\n(4) eap: Expiring EAP session with state 0x7322fa167126e364\r\n(4) eap: Finished EAP session with state 0x7322fa167126e364\r\n(4) eap: Previous EAP request found for state 0x7322fa167126e364, released from the list\r\n(4) eap: Peer sent packet with method EAP PEAP (25)\r\n(4) eap: Calling submodule eap_peap to process data\r\n(4) eap_peap: Continuing EAP-TLS\r\n(4) eap_peap: Peer ACKed our handshake fragment\r\n(4) eap_peap: [eaptls verify] = request\r\n(4) eap_peap: [eaptls process] = handled\r\n(4) eap: Sending EAP Request (code 1) ID 5 length 834\r\n(4) eap: EAP session adding &reply:State = 0x7322fa167027e364\r\n(4)     [eap] = handled\r\n(4)   } # authenticate = handled\r\n(4) Using Post-Auth-Type Challenge\r\n(4) Post-Auth-Type sub-section not found.  Ignoring.\r\n(4) Sent Access-Challenge Id 29 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(4)   EAP-Message = 0x01050342190068d99b627f3ca6561e6c1dcd0e8bb529b85d2515a36c2ba6f906ee9a223e619decfff2f24ef8674307735d591964d50ac988776a55970203010001a3819130818e301306092b060104018237140204061e0400430041300e0603551d0f0101ff040403020186300f0603551d130101ff04\r\n(4)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(4)   State = 0x7322fa167027e3641bb25e163c98a49d\r\n(4) Finished request\r\nWaking up in 4.9 seconds.\r\n(5) Received Access-Request Id 215 from 192.168.2.250:3072 to 192.168.8.27:1812 length 330\r\n(5)   User-Name = \"bob\"\r\n(5)   Service-Type = Framed-User\r\n(5)   NAS-IP-Address = 192.168.2.250\r\n(5)   NAS-Port = 10\r\n(5)   NAS-Port-Id = \"10\"\r\n(5)   State = 0x7322fa167027e3641bb25e163c98a49d\r\n(5)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(5)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(5)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(5)   NAS-Identifier = \"AP-domain01\"\r\n(5)   NAS-Port-Type = Wireless-802.11\r\n(5)   Framed-MTU = 1500\r\n(5)   EAP-Message = 0x0205009019800000008616030100461000004241048075a5ca05d012d0fd77b0f9e1664c5ce577eda72a1368e0a8e78fd9072b0a6e04ce9f7f3cb1339ca9fd58bdc40e0afce833807f1c4035e532e91d07e8d45fdb1403010001011603010030bff39ef9cf9a0400269ae5fd8888ba5c4940b72599bca5\r\n(5)   Message-Authenticator = 0xfaa49416d762fdf0846428951f176829\r\n(5) session-state: No cached attributes\r\n(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(5)   authorize {\r\n(5) files: users: Matched entry bob at line 69\r\n(5)     [files] = ok\r\n(5)     [preprocess] = ok\r\n(5) suffix: Checking for suffix after \"@\"\r\n(5) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(5) suffix: No such realm \"NULL\"\r\n(5)     [suffix] = noop\r\n(5) eap: Peer sent EAP Response (code 2) ID 5 length 144\r\n(5) eap: Continuing tunnel setup\r\n(5)     [eap] = ok\r\n(5)   } # authorize = ok\r\n(5) Found Auth-Type = EAP\r\n(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(5)   authenticate {\r\n(5) eap: Expiring EAP session with state 0x7322fa167027e364\r\n(5) eap: Finished EAP session with state 0x7322fa167027e364\r\n(5) eap: Previous EAP request found for state 0x7322fa167027e364, released from the list\r\n(5) eap: Peer sent packet with method EAP PEAP (25)\r\n(5) eap: Calling submodule eap_peap to process data\r\n(5) eap_peap: Continuing EAP-TLS\r\n(5) eap_peap: Peer indicated complete TLS record size will be 134 bytes\r\n(5) eap_peap: Got complete TLS record (134 bytes)\r\n(5) eap_peap: [eaptls verify] = length included\r\n(5) eap_peap: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange\r\n(5) eap_peap: TLS_accept: SSLv3 read client key exchange A\r\n(5) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001]\r\n(5) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished\r\n(5) eap_peap: TLS_accept: SSLv3 read finished A\r\n(5) eap_peap: >>> TLS 1.0 ChangeCipherSpec [length 0001]\r\n(5) eap_peap: TLS_accept: SSLv3 write change cipher spec A\r\n(5) eap_peap: >>> TLS 1.0 Handshake [length 0010], Finished\r\n(5) eap_peap: TLS_accept: SSLv3 write finished A\r\n(5) eap_peap: TLS_accept: SSLv3 flush data\r\n(5) eap_peap: (other): SSL negotiation finished successfully\r\n(5) eap_peap: SSL Connection Established\r\n(5) eap_peap: [eaptls process] = handled\r\n(5) eap: Sending EAP Request (code 1) ID 6 length 65\r\n(5) eap: EAP session adding &reply:State = 0x7322fa167724e364\r\n(5)     [eap] = handled\r\n(5)   } # authenticate = handled\r\n(5) Using Post-Auth-Type Challenge\r\n(5) Post-Auth-Type sub-section not found.  Ignoring.\r\n(5) Sent Access-Challenge Id 215 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(5)   EAP-Message = 0x010600411900140301000101160301003055bf61e75ec8b42df54cc0a1eab6dd5e274dd8db872c3a18e2616a373eda384dcffbfa8de45423ccb8890ee689f1f4cb\r\n(5)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(5)   State = 0x7322fa167724e3641bb25e163c98a49d\r\n(5) Finished request\r\nWaking up in 4.8 seconds.\r\n(6) Received Access-Request Id 116 from 192.168.2.250:3072 to 192.168.8.27:1812 length 192\r\n(6)   User-Name = \"bob\"\r\n(6)   Service-Type = Framed-User\r\n(6)   NAS-IP-Address = 192.168.2.250\r\n(6)   NAS-Port = 10\r\n(6)   NAS-Port-Id = \"10\"\r\n(6)   State = 0x7322fa167724e3641bb25e163c98a49d\r\n(6)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(6)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(6)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(6)   NAS-Identifier = \"AP-domain01\"\r\n(6)   NAS-Port-Type = Wireless-802.11\r\n(6)   Framed-MTU = 1500\r\n(6)   EAP-Message = 0x020600061900\r\n(6)   Message-Authenticator = 0xb468a031e9e011addea02301e58313cb\r\n(6) session-state: No cached attributes\r\n(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(6)   authorize {\r\n(6) files: users: Matched entry bob at line 69\r\n(6)     [files] = ok\r\n(6)     [preprocess] = ok\r\n(6) suffix: Checking for suffix after \"@\"\r\n(6) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(6) suffix: No such realm \"NULL\"\r\n(6)     [suffix] = noop\r\n(6) eap: Peer sent EAP Response (code 2) ID 6 length 6\r\n(6) eap: Continuing tunnel setup\r\n(6)     [eap] = ok\r\n(6)   } # authorize = ok\r\n(6) Found Auth-Type = EAP\r\n(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(6)   authenticate {\r\n(6) eap: Expiring EAP session with state 0x7322fa167724e364\r\n(6) eap: Finished EAP session with state 0x7322fa167724e364\r\n(6) eap: Previous EAP request found for state 0x7322fa167724e364, released from the list\r\n(6) eap: Peer sent packet with method EAP PEAP (25)\r\n(6) eap: Calling submodule eap_peap to process data\r\n(6) eap_peap: Continuing EAP-TLS\r\n(6) eap_peap: Peer ACKed our handshake fragment.  handshake is finished\r\n(6) eap_peap: [eaptls verify] = success\r\n(6) eap_peap: [eaptls process] = success\r\n(6) eap_peap: Session established.  Decoding tunneled attributes\r\n(6) eap_peap: PEAP state TUNNEL ESTABLISHED\r\n(6) eap: Sending EAP Request (code 1) ID 7 length 43\r\n(6) eap: EAP session adding &reply:State = 0x7322fa167625e364\r\n(6)     [eap] = handled\r\n(6)   } # authenticate = handled\r\n(6) Using Post-Auth-Type Challenge\r\n(6) Post-Auth-Type sub-section not found.  Ignoring.\r\n(6) Sent Access-Challenge Id 116 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(6)   EAP-Message = 0x0107002b19001703010020ba0b3d2b7d949cf1727c708a6c6ac8606201ef325b4408284fbf4115ccf1e60c\r\n(6)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(6)   State = 0x7322fa167625e3641bb25e163c98a49d\r\n(6) Finished request\r\nWaking up in 4.8 seconds.\r\n(7) Received Access-Request Id 108 from 192.168.2.250:3072 to 192.168.8.27:1812 length 229\r\n(7)   User-Name = \"bob\"\r\n(7)   Service-Type = Framed-User\r\n(7)   NAS-IP-Address = 192.168.2.250\r\n(7)   NAS-Port = 10\r\n(7)   NAS-Port-Id = \"10\"\r\n(7)   State = 0x7322fa167625e3641bb25e163c98a49d\r\n(7)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(7)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(7)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(7)   NAS-Identifier = \"AP-domain01\"\r\n(7)   NAS-Port-Type = Wireless-802.11\r\n(7)   Framed-MTU = 1500\r\n(7)   EAP-Message = 0x0207002b190017030100205db45e564856f45f7af7cc0f3ec2e54ef3aab9a99f6cb2d9944b2c53980f0bde\r\n(7)   Message-Authenticator = 0xd2092e590023b1e9af89a2d5f9927801\r\n(7) session-state: No cached attributes\r\n(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(7)   authorize {\r\n(7) files: users: Matched entry bob at line 69\r\n(7)     [files] = ok\r\n(7)     [preprocess] = ok\r\n(7) suffix: Checking for suffix after \"@\"\r\n(7) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(7) suffix: No such realm \"NULL\"\r\n(7)     [suffix] = noop\r\n(7) eap: Peer sent EAP Response (code 2) ID 7 length 43\r\n(7) eap: Continuing tunnel setup\r\n(7)     [eap] = ok\r\n(7)   } # authorize = ok\r\n(7) Found Auth-Type = EAP\r\n(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(7)   authenticate {\r\n(7) eap: Expiring EAP session with state 0x7322fa167625e364\r\n(7) eap: Finished EAP session with state 0x7322fa167625e364\r\n(7) eap: Previous EAP request found for state 0x7322fa167625e364, released from the list\r\n(7) eap: Peer sent packet with method EAP PEAP (25)\r\n(7) eap: Calling submodule eap_peap to process data\r\n(7) eap_peap: Continuing EAP-TLS\r\n(7) eap_peap: [eaptls verify] = ok\r\n(7) eap_peap: Done initial handshake\r\n(7) eap_peap: [eaptls process] = ok\r\n(7) eap_peap: Session established.  Decoding tunneled attributes\r\n(7) eap_peap: PEAP state WAITING FOR INNER IDENTITY\r\n(7) eap_peap: Identity - bob\r\n(7) eap_peap: Got inner identity 'bob'\r\n(7) eap_peap: Setting default EAP type for tunneled EAP session\r\n(7) eap_peap: Got tunneled request\r\n(7) eap_peap:   EAP-Message = 0x0207000801626f62\r\n(7) eap_peap: Setting User-Name to bob\r\n(7) eap_peap: Sending tunneled request to inner-tunnel\r\n(7) eap_peap:   EAP-Message = 0x0207000801626f62\r\n(7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(7) eap_peap:   User-Name = \"bob\"\r\n(7) Virtual server inner-tunnel received request\r\n(7)   EAP-Message = 0x0207000801626f62\r\n(7)   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(7)   User-Name = \"bob\"\r\n(7) server inner-tunnel {\r\n(7)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(7)     authorize {\r\n(7) files: users: Matched entry bob at line 69\r\n(7)       [files] = ok\r\n(7)       [mschap] = noop\r\n(7) suffix: Checking for suffix after \"@\"\r\n(7) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(7) suffix: No such realm \"NULL\"\r\n(7)       [suffix] = noop\r\n(7)       update control {\r\n(7)         Proxy-To-Realm := LOCAL\r\n(7)       } # update control = noop\r\n(7) eap: Peer sent EAP Response (code 2) ID 7 length 8\r\n(7) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize\r\n(7)       [eap] = ok\r\n(7)     } # authorize = ok\r\n(7)   Found Auth-Type = EAP\r\n(7)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(7)     authenticate {\r\n(7) eap: Peer sent packet with method EAP Identity (1)\r\n(7) eap: Calling submodule eap_mschapv2 to process data\r\n(7) eap_mschapv2: Issuing Challenge\r\n(7) eap: Sending EAP Request (code 1) ID 8 length 43\r\n(7) eap: EAP session adding &reply:State = 0xa0773c37a07f2697\r\n(7)       [eap] = handled\r\n(7)     } # authenticate = handled\r\n(7) } # server inner-tunnel\r\n(7) Virtual server sending reply\r\n(7)   EAP-Message = 0x0108002b1a0108002610499c5c634fd1c53afcf63e2a20dc0dbd667265657261646975732d332e302e3131\r\n(7)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(7)   State = 0xa0773c37a07f269794c91e639bc0d99c\r\n(7) eap_peap: Got tunneled reply code 11\r\n(7) eap_peap:   EAP-Message = 0x0108002b1a0108002610499c5c634fd1c53afcf63e2a20dc0dbd667265657261646975732d332e302e3131\r\n(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(7) eap_peap:   State = 0xa0773c37a07f269794c91e639bc0d99c\r\n(7) eap_peap: Got tunneled reply RADIUS code 11\r\n(7) eap_peap:   EAP-Message = 0x0108002b1a0108002610499c5c634fd1c53afcf63e2a20dc0dbd667265657261646975732d332e302e3131\r\n(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(7) eap_peap:   State = 0xa0773c37a07f269794c91e639bc0d99c\r\n(7) eap_peap: Got tunneled Access-Challenge\r\n(7) eap: Sending EAP Request (code 1) ID 8 length 75\r\n(7) eap: EAP session adding &reply:State = 0x7322fa16752ae364\r\n(7)     [eap] = handled\r\n(7)   } # authenticate = handled\r\n(7) Using Post-Auth-Type Challenge\r\n(7) Post-Auth-Type sub-section not found.  Ignoring.\r\n(7) Sent Access-Challenge Id 108 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(7)   EAP-Message = 0x0108004b19001703010040d8e4f8be725dc18720efdaf547282b5b876c26c5fdbea8c05f380bf87ea452cdf6938d2793528a14f784d70ad64f66ebcb6998cae0cdb2ec340b208caf7adddc\r\n(7)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(7)   State = 0x7322fa16752ae3641bb25e163c98a49d\r\n(7) Finished request\r\nWaking up in 4.8 seconds.\r\n(8) Received Access-Request Id 50 from 192.168.2.250:3072 to 192.168.8.27:1812 length 277\r\n(8)   User-Name = \"bob\"\r\n(8)   Service-Type = Framed-User\r\n(8)   NAS-IP-Address = 192.168.2.250\r\n(8)   NAS-Port = 10\r\n(8)   NAS-Port-Id = \"10\"\r\n(8)   State = 0x7322fa16752ae3641bb25e163c98a49d\r\n(8)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(8)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(8)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(8)   NAS-Identifier = \"AP-domain01\"\r\n(8)   NAS-Port-Type = Wireless-802.11\r\n(8)   Framed-MTU = 1500\r\n(8)   EAP-Message = 0x0208005b1900170301005035d828d77a9cd3611fc5b79937ff5a2749a2d013a332137a52fe3a206717cde550258b9914956f0b2f88dd7f4491d6d52e7b97a1fd99e59010b7e346d7692d768748d8d8efb3995a7d8d58863b0e3c9f\r\n(8)   Message-Authenticator = 0x27a3860baf38d3fd1d0e7f85c85a398e\r\n(8) session-state: No cached attributes\r\n(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(8)   authorize {\r\n(8) files: users: Matched entry bob at line 69\r\n(8)     [files] = ok\r\n(8)     [preprocess] = ok\r\n(8) suffix: Checking for suffix after \"@\"\r\n(8) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(8) suffix: No such realm \"NULL\"\r\n(8)     [suffix] = noop\r\n(8) eap: Peer sent EAP Response (code 2) ID 8 length 91\r\n(8) eap: Continuing tunnel setup\r\n(8)     [eap] = ok\r\n(8)   } # authorize = ok\r\n(8) Found Auth-Type = EAP\r\n(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(8)   authenticate {\r\n(8) eap: Expiring EAP session with state 0xa0773c37a07f2697\r\n(8) eap: Finished EAP session with state 0x7322fa16752ae364\r\n(8) eap: Previous EAP request found for state 0x7322fa16752ae364, released from the list\r\n(8) eap: Peer sent packet with method EAP PEAP (25)\r\n(8) eap: Calling submodule eap_peap to process data\r\n(8) eap_peap: Continuing EAP-TLS\r\n(8) eap_peap: [eaptls verify] = ok\r\n(8) eap_peap: Done initial handshake\r\n(8) eap_peap: [eaptls process] = ok\r\n(8) eap_peap: Session established.  Decoding tunneled attributes\r\n(8) eap_peap: PEAP state phase2\r\n(8) eap_peap: EAP method MSCHAPv2 (26)\r\n(8) eap_peap: Got tunneled request\r\n(8) eap_peap:   EAP-Message = 0x0208003e1a02080039318c4c5187cb6d3acc25374e1a666c6ebd00000000000000005c626c4605277cd81e771f53707290714956dfed703aa31a00626f62\r\n(8) eap_peap: Setting User-Name to bob\r\n(8) eap_peap: Sending tunneled request to inner-tunnel\r\n(8) eap_peap:   EAP-Message = 0x0208003e1a02080039318c4c5187cb6d3acc25374e1a666c6ebd00000000000000005c626c4605277cd81e771f53707290714956dfed703aa31a00626f62\r\n(8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(8) eap_peap:   User-Name = \"bob\"\r\n(8) eap_peap:   State = 0xa0773c37a07f269794c91e639bc0d99c\r\n(8) Virtual server inner-tunnel received request\r\n(8)   EAP-Message = 0x0208003e1a02080039318c4c5187cb6d3acc25374e1a666c6ebd00000000000000005c626c4605277cd81e771f53707290714956dfed703aa31a00626f62\r\n(8)   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(8)   User-Name = \"bob\"\r\n(8)   State = 0xa0773c37a07f269794c91e639bc0d99c\r\n(8) server inner-tunnel {\r\n(8)   session-state: No cached attributes\r\n(8)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(8)     authorize {\r\n(8) files: users: Matched entry bob at line 69\r\n(8)       [files] = ok\r\n(8)       [mschap] = noop\r\n(8) suffix: Checking for suffix after \"@\"\r\n(8) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(8) suffix: No such realm \"NULL\"\r\n(8)       [suffix] = noop\r\n(8)       update control {\r\n(8)         Proxy-To-Realm := LOCAL\r\n(8)       } # update control = noop\r\n(8) eap: Peer sent EAP Response (code 2) ID 8 length 62\r\n(8) eap: No EAP Start, assuming it's an on-going EAP conversation\r\n(8)       [eap] = updated\r\n(8)       [expiration] = noop\r\n(8)       [logintime] = noop\r\nrlm_ldap (ldap_domain): Closing connection (2): Hit idle_timeout, was idle for 90 seconds\r\nrlm_ldap (ldap_domain): Closing connection (3): Hit idle_timeout, was idle for 90 seconds\r\nrlm_ldap (ldap_domain): Closing connection (4): Hit idle_timeout, was idle for 90 seconds\r\nrlm_ldap (ldap_domain): Closing connection (0): Hit idle_timeout, was idle for 85 seconds\r\nrlm_ldap (ldap_domain): You probably need to lower \"min\"\r\nrlm_ldap (ldap_domain): Closing connection (5): Hit idle_timeout, was idle for 85 seconds\r\nrlm_ldap (ldap_domain): You probably need to lower \"min\"\r\nrlm_ldap (ldap_domain): Closing connection (1): Hit idle_timeout, was idle for 85 seconds\r\nrlm_ldap (ldap_domain): You probably need to lower \"min\"\r\nrlm_ldap (ldap_domain): 0 of 0 connections in use.  You  may need to increase \"spare\"\r\nrlm_ldap (ldap_domain): Opening additional connection (6), 1 of 32 pending slots used\r\nrlm_ldap (ldap_domain): Connecting to ldap://dc.domain.local:389\r\nrlm_ldap (ldap_domain): Waiting for bind result...\r\nrlm_ldap (ldap_domain): Bind successful\r\nrlm_ldap (ldap_domain): Reserved connection (6)\r\n(8) ldap_domain: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\r\n(8) ldap_domain:    --> (sAMAccountName=bob)\r\n(8) ldap_domain: Performing search in \"cn=Users,dc=domain,dc=local\" with filter \"(sAMAccountName=bob)\", scope \"sub\"\r\n(8) ldap_domain: Waiting for search result...\r\n(8) ldap_domain: Search returned no results\r\nrlm_ldap (ldap_domain): Released connection (6)\r\nrlm_ldap (ldap_domain): Need 2 more connections to reach 10 spares\r\nrlm_ldap (ldap_domain): Opening additional connection (7), 1 of 31 pending slots used\r\nrlm_ldap (ldap_domain): Connecting to ldap://dc.domain.local:389\r\nrlm_ldap (ldap_domain): Waiting for bind result...\r\nrlm_ldap (ldap_domain): Bind successful\r\n(8)       [ldap_domain] = notfound\r\n(8)       if ((ok || updated) && User-Password) {\r\n(8)       if ((ok || updated) && User-Password)  -> FALSE\r\n(8) pap: WARNING: Auth-Type already set.  Not setting to PAP\r\n(8)       [pap] = noop\r\n(8)       if (User-Password) {\r\n(8)       if (User-Password)  -> FALSE\r\n(8)     } # authorize = updated\r\n(8)   Found Auth-Type = EAP\r\n(8)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(8)     authenticate {\r\n(8) eap: Expiring EAP session with state 0xa0773c37a07f2697\r\n(8) eap: Finished EAP session with state 0xa0773c37a07f2697\r\n(8) eap: Previous EAP request found for state 0xa0773c37a07f2697, released from the list\r\n(8) eap: Peer sent packet with method EAP MSCHAPv2 (26)\r\n(8) eap: Calling submodule eap_mschapv2 to process data\r\n(8) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(8) eap_mschapv2:   Auth-Type MS-CHAP {\r\n(8) mschap: Found Cleartext-Password, hashing to create NT-Password\r\n(8) mschap: Found Cleartext-Password, hashing to create LM-Password\r\n(8) mschap: Creating challenge hash with username: bob\r\n(8) mschap: Client is using MS-CHAPv2\r\n(8) mschap: Adding MS-CHAPv2 MPPE keys\r\n(8)     [mschap] = ok\r\n(8)   } # Auth-Type MS-CHAP = ok\r\n(8) MSCHAP Success\r\n(8) eap: Sending EAP Request (code 1) ID 9 length 51\r\n(8) eap: EAP session adding &reply:State = 0xa0773c37a17e2697\r\n(8)       [eap] = handled\r\n(8)     } # authenticate = handled\r\n(8) } # server inner-tunnel\r\n(8) Virtual server sending reply\r\n(8)   EAP-Message = 0x010900331a0308002e533d41303037313532323444323837324439434432334437363345354535313444393146323441424646\r\n(8)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8)   State = 0xa0773c37a17e269794c91e639bc0d99c\r\n(8) eap_peap: Got tunneled reply code 11\r\n(8) eap_peap:   EAP-Message = 0x010900331a0308002e533d41303037313532323444323837324439434432334437363345354535313444393146323441424646\r\n(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8) eap_peap:   State = 0xa0773c37a17e269794c91e639bc0d99c\r\n(8) eap_peap: Got tunneled reply RADIUS code 11\r\n(8) eap_peap:   EAP-Message = 0x010900331a0308002e533d41303037313532323444323837324439434432334437363345354535313444393146323441424646\r\n(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8) eap_peap:   State = 0xa0773c37a17e269794c91e639bc0d99c\r\n(8) eap_peap: Got tunneled Access-Challenge\r\n(8) eap: Sending EAP Request (code 1) ID 9 length 91\r\n(8) eap: EAP session adding &reply:State = 0x7322fa16742be364\r\n(8)     [eap] = handled\r\n(8)   } # authenticate = handled\r\n(8) Using Post-Auth-Type Challenge\r\n(8) Post-Auth-Type sub-section not found.  Ignoring.\r\n(8) Sent Access-Challenge Id 50 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(8)   EAP-Message = 0x0109005b19001703010050859ea345fa5ac6b144a9e42ed8bff28f0b2320a237ac8370d029cb70f52d482a0d76da88b813e4df36252cb6397300ec8d8d78b8622e934b5283b40ee5a8abe75b64b6667666fd21f0cac5fcc60f98ed\r\n(8)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(8)   State = 0x7322fa16742be3641bb25e163c98a49d\r\n(8) Finished request\r\nWaking up in 4.7 seconds.\r\n(9) Received Access-Request Id 168 from 192.168.2.250:3072 to 192.168.8.27:1812 length 229\r\n(9)   User-Name = \"bob\"\r\n(9)   Service-Type = Framed-User\r\n(9)   NAS-IP-Address = 192.168.2.250\r\n(9)   NAS-Port = 10\r\n(9)   NAS-Port-Id = \"10\"\r\n(9)   State = 0x7322fa16742be3641bb25e163c98a49d\r\n(9)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(9)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(9)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(9)   NAS-Identifier = \"AP-domain01\"\r\n(9)   NAS-Port-Type = Wireless-802.11\r\n(9)   Framed-MTU = 1500\r\n(9)   EAP-Message = 0x0209002b19001703010020ef0b01a2e1a2ce59b84fcd3a36f6101ad280a2da6de9e3034ee1142fd2c2d87b\r\n(9)   Message-Authenticator = 0xcbef8a5238f2450a86714781617cb91e\r\n(9) session-state: No cached attributes\r\n(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(9)   authorize {\r\n(9) files: users: Matched entry bob at line 69\r\n(9)     [files] = ok\r\n(9)     [preprocess] = ok\r\n(9) suffix: Checking for suffix after \"@\"\r\n(9) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(9) suffix: No such realm \"NULL\"\r\n(9)     [suffix] = noop\r\n(9) eap: Peer sent EAP Response (code 2) ID 9 length 43\r\n(9) eap: Continuing tunnel setup\r\n(9)     [eap] = ok\r\n(9)   } # authorize = ok\r\n(9) Found Auth-Type = EAP\r\n(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(9)   authenticate {\r\n(9) eap: Expiring EAP session with state 0xa0773c37a17e2697\r\n(9) eap: Finished EAP session with state 0x7322fa16742be364\r\n(9) eap: Previous EAP request found for state 0x7322fa16742be364, released from the list\r\n(9) eap: Peer sent packet with method EAP PEAP (25)\r\n(9) eap: Calling submodule eap_peap to process data\r\n(9) eap_peap: Continuing EAP-TLS\r\n(9) eap_peap: [eaptls verify] = ok\r\n(9) eap_peap: Done initial handshake\r\n(9) eap_peap: [eaptls process] = ok\r\n(9) eap_peap: Session established.  Decoding tunneled attributes\r\n(9) eap_peap: PEAP state phase2\r\n(9) eap_peap: EAP method MSCHAPv2 (26)\r\n(9) eap_peap: Got tunneled request\r\n(9) eap_peap:   EAP-Message = 0x020900061a03\r\n(9) eap_peap: Setting User-Name to bob\r\n(9) eap_peap: Sending tunneled request to inner-tunnel\r\n(9) eap_peap:   EAP-Message = 0x020900061a03\r\n(9) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(9) eap_peap:   User-Name = \"bob\"\r\n(9) eap_peap:   State = 0xa0773c37a17e269794c91e639bc0d99c\r\n(9) Virtual server inner-tunnel received request\r\n(9)   EAP-Message = 0x020900061a03\r\n(9)   FreeRADIUS-Proxied-To = 127.0.0.1\r\n(9)   User-Name = \"bob\"\r\n(9)   State = 0xa0773c37a17e269794c91e639bc0d99c\r\n(9) server inner-tunnel {\r\n(9)   session-state: No cached attributes\r\n(9)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(9)     authorize {\r\n(9) files: users: Matched entry bob at line 69\r\n(9)       [files] = ok\r\n(9)       [mschap] = noop\r\n(9) suffix: Checking for suffix after \"@\"\r\n(9) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(9) suffix: No such realm \"NULL\"\r\n(9)       [suffix] = noop\r\n(9)       update control {\r\n(9)         Proxy-To-Realm := LOCAL\r\n(9)       } # update control = noop\r\n(9) eap: Peer sent EAP Response (code 2) ID 9 length 6\r\n(9) eap: No EAP Start, assuming it's an on-going EAP conversation\r\n(9)       [eap] = updated\r\n(9)       [expiration] = noop\r\n(9)       [logintime] = noop\r\nrlm_ldap (ldap_domain): Reserved connection (6)\r\n(9) ldap_domain: EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})\r\n(9) ldap_domain:    --> (sAMAccountName=bob)\r\n(9) ldap_domain: Performing search in \"cn=Users,dc=domain,dc=local\" with filter \"(sAMAccountName=bob)\", scope \"sub\"\r\n(9) ldap_domain: Waiting for search result...\r\n(9) ldap_domain: Search returned no results\r\nrlm_ldap (ldap_domain): Released connection (6)\r\n(9)       [ldap_domain] = notfound\r\n(9)       if ((ok || updated) && User-Password) {\r\n(9)       if ((ok || updated) && User-Password)  -> FALSE\r\n(9) pap: WARNING: Auth-Type already set.  Not setting to PAP\r\n(9)       [pap] = noop\r\n(9)       if (User-Password) {\r\n(9)       if (User-Password)  -> FALSE\r\n(9)     } # authorize = updated\r\n(9)   Found Auth-Type = EAP\r\n(9)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-domain\r\n(9)     authenticate {\r\n(9) eap: Expiring EAP session with state 0xa0773c37a17e2697\r\n(9) eap: Finished EAP session with state 0xa0773c37a17e2697\r\n(9) eap: Previous EAP request found for state 0xa0773c37a17e2697, released from the list\r\n(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)\r\n(9) eap: Calling submodule eap_mschapv2 to process data\r\n(9) eap: Sending EAP Success (code 3) ID 9 length 4\r\n(9) eap: Freeing handler\r\n(9)       [eap] = ok\r\n(9)     } # authenticate = ok\r\n(9) } # server inner-tunnel\r\n(9) Virtual server sending reply\r\n(9)   MS-MPPE-Encryption-Policy = Encryption-Required\r\n(9)   MS-MPPE-Encryption-Types = 4\r\n(9)   MS-MPPE-Send-Key = 0xc40f7d178a19b383691a863644016790\r\n(9)   MS-MPPE-Recv-Key = 0x1f490d8645a1a87f762bc38738f37149\r\n(9)   EAP-Message = 0x03090004\r\n(9)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9)   User-Name = \"bob\"\r\n(9) eap_peap: Got tunneled reply code 2\r\n(9) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Required\r\n(9) eap_peap:   MS-MPPE-Encryption-Types = 4\r\n(9) eap_peap:   MS-MPPE-Send-Key = 0xc40f7d178a19b383691a863644016790\r\n(9) eap_peap:   MS-MPPE-Recv-Key = 0x1f490d8645a1a87f762bc38738f37149\r\n(9) eap_peap:   EAP-Message = 0x03090004\r\n(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9) eap_peap:   User-Name = \"bob\"\r\n(9) eap_peap: Got tunneled reply RADIUS code 2\r\n(9) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Required\r\n(9) eap_peap:   MS-MPPE-Encryption-Types = 4\r\n(9) eap_peap:   MS-MPPE-Send-Key = 0xc40f7d178a19b383691a863644016790\r\n(9) eap_peap:   MS-MPPE-Recv-Key = 0x1f490d8645a1a87f762bc38738f37149\r\n(9) eap_peap:   EAP-Message = 0x03090004\r\n(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9) eap_peap:   User-Name = \"bob\"\r\n(9) eap_peap: Tunneled authentication was successful\r\n(9) eap_peap: SUCCESS\r\n(9) eap: Sending EAP Request (code 1) ID 10 length 43\r\n(9) eap: EAP session adding &reply:State = 0x7322fa167b28e364\r\n(9)     [eap] = handled\r\n(9)   } # authenticate = handled\r\n(9) Using Post-Auth-Type Challenge\r\n(9) Post-Auth-Type sub-section not found.  Ignoring.\r\n(9) Sent Access-Challenge Id 168 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(9)   EAP-Message = 0x010a002b190017030100209ebe5c178129e763273f16ddd56f3f5e123f6a27587c42e7e480f2874b2985ac\r\n(9)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(9)   State = 0x7322fa167b28e3641bb25e163c98a49d\r\n(9) Finished request\r\nWaking up in 4.7 seconds.\r\n(10) Received Access-Request Id 89 from 192.168.2.250:3072 to 192.168.8.27:1812 length 229\r\n(10)   User-Name = \"bob\"\r\n(10)   Service-Type = Framed-User\r\n(10)   NAS-IP-Address = 192.168.2.250\r\n(10)   NAS-Port = 10\r\n(10)   NAS-Port-Id = \"10\"\r\n(10)   State = 0x7322fa167b28e3641bb25e163c98a49d\r\n(10)   Called-Station-Id = \"0E-0B-6B-2F-12-67:domain 8021X\"\r\n(10)   Calling-Station-Id = \"B8-E8-56-41-2C-2A\"\r\n(10)   Connect-Info = \"CONNECT 54 Mbps 802.11g\"\r\n(10)   NAS-Identifier = \"AP-domain01\"\r\n(10)   NAS-Port-Type = Wireless-802.11\r\n(10)   Framed-MTU = 1500\r\n(10)   EAP-Message = 0x020a002b19001703010020ae6a94676019ad167b393353926209ead29be3185de748899304ff6a50957c1a\r\n(10)   Message-Authenticator = 0x64a847e3ae161cf68eccda80a2f11f16\r\n(10) session-state: No cached attributes\r\n(10) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/domain\r\n(10)   authorize {\r\n(10) files: users: Matched entry bob at line 69\r\n(10)     [files] = ok\r\n(10)     [preprocess] = ok\r\n(10) suffix: Checking for suffix after \"@\"\r\n(10) suffix: No '@' in User-Name = \"bob\", looking up realm NULL\r\n(10) suffix: No such realm \"NULL\"\r\n(10)     [suffix] = noop\r\n(10) eap: Peer sent EAP Response (code 2) ID 10 length 43\r\n(10) eap: Continuing tunnel setup\r\n(10)     [eap] = ok\r\n(10)   } # authorize = ok\r\n(10) Found Auth-Type = EAP\r\n(10) # Executing group from file /usr/local/etc/raddb/sites-enabled/domain\r\n(10)   authenticate {\r\n(10) eap: Expiring EAP session with state 0x7322fa167b28e364\r\n(10) eap: Finished EAP session with state 0x7322fa167b28e364\r\n(10) eap: Previous EAP request found for state 0x7322fa167b28e364, released from the list\r\n(10) eap: Peer sent packet with method EAP PEAP (25)\r\n(10) eap: Calling submodule eap_peap to process data\r\n(10) eap_peap: Continuing EAP-TLS\r\n(10) eap_peap: [eaptls verify] = ok\r\n(10) eap_peap: Done initial handshake\r\n(10) eap_peap: [eaptls process] = ok\r\n(10) eap_peap: Session established.  Decoding tunneled attributes\r\n(10) eap_peap: PEAP state send tlv success\r\n(10) eap_peap: Received EAP-TLV response\r\n(10) eap_peap: Success\r\n(10) eap: Sending EAP Success (code 3) ID 10 length 4\r\n(10) eap: Freeing handler\r\n(10)     [eap] = ok\r\n(10)   } # authenticate = ok\r\n(10) Sent Access-Accept Id 89 from 192.168.8.27:1812 to 192.168.2.250:3072 length 0\r\n(10)   MS-MPPE-Recv-Key = 0xa16bc44cb5331571c4f3d362fd38e1bb11a2670822b415e53eb7ebbc67c2cb93\r\n(10)   MS-MPPE-Send-Key = 0xbd2081385181a9a51170b7fa40bfd3b32e396b6e7d46f9b5369a38d64be27cc8\r\n(10)   EAP-Message = 0x030a0004\r\n(10)   Message-Authenticator = 0x00000000000000000000000000000000\r\n(10)   User-Name = \"bob\"\r\n(10) Finished request\r\nWaking up in 4.7 seconds.\r\n(3) Cleaning up request packet ID 54 with timestamp +90\r\n(4) Cleaning up request packet ID 29 with timestamp +90\r\nWaking up in 0.1 seconds.\r\n(5) Cleaning up request packet ID 215 with timestamp +90\r\n(6) Cleaning up request packet ID 116 with timestamp +90\r\n(7) Cleaning up request packet ID 108 with timestamp +90\r\n(8) Cleaning up request packet ID 50 with timestamp +90\r\n(9) Cleaning up request packet ID 168 with timestamp +90\r\n(10) Cleaning up request packet ID 89 with timestamp +90\r\nReady to process requests\r\n\r\n\r\n\r\n\r\nI think that everything goes wrong with encrypt/decrypt the Domain User password or no User-Password is given after eap or something else. I tried a lot of stuff, but nothing works. \r\n\r\n\r\nusers configuration\r\n\r\nbob     Cleartext-Password := \"hello\"\r\n\r\nDEFAULT Framed-Protocol == PPP\r\n        Framed-Protocol = PPP,\r\n        Framed-Compression = Van-Jacobson-TCP-IP\r\n\r\nDEFAULT Hint == \"CSLIP\"\r\n        Framed-Protocol = SLIP,\r\n        Framed-Compression = Van-Jacobson-TCP-IP\r\n\r\nDEFAULT Hint == \"SLIP\"\r\n        Framed-Protocol = SLIP\r\n\r\n\r\n\r\n\r\nMessages:\r\n\r\n(7) ldap_nedeco: Processing user attributes\r\n(7) ldap_nedeco: WARNING: No \"known good\" password added. Ensure the admin user has permission to read the password attribute\r\n(7) ldap_nedeco: WARNING: PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure)\r\nrlm_ldap (ldap_nedeco): Released connection (0)\r\n..\r\n(7) mschap: WARNING: No Cleartext-Password configured.  Cannot create NT-Password\r\n(7) mschap: WARNING: No Cleartext-Password configured.  Cannot create LM-Password\r\n(7) mschap: Creating challenge hash with username: test\r\n(7) mschap: Client is using MS-CHAPv2\r\n(7) mschap: ERROR: FAILED: No NT/LM-Password.  Cannot perform authentication\r\n(7) mschap: ERROR: MS-CHAP2-Response is incorrect\r\n..\r\n(8) eap_peap: Received EAP-TLV response\r\n(8) eap_peap:   The users session was previously rejected: returning reject (again.)\r\n(8) eap_peap:   This means you need to read the PREVIOUS messages in the debug output\r\n(8) eap_peap:   to find out the reason why the user was rejected\r\n(8) eap_peap:   Look for \"reject\" or \"fail\".  Those earlier messages will tell you\r\n(8) eap_peap:   what went wrong, and how to fix the problem\r\n(8) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module failed\r\n..\r\n\r\n\r\n\r\nAny Idea?\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/FreeRADIUS/freeradius-server/issues/comments/155063909","html_url":"https://github.com/FreeRADIUS/freeradius-server/issues/1314#issuecomment-155063909","issue_url":"https://api.github.com/repos/FreeRADIUS/freeradius-server/issues/1314","id":155063909,"user":{"login":"alandekok","id":17612,"avatar_url":"https://avatars.githubusercontent.com/u/17612?v=3","gravatar_id":"","url":"https://api.github.com/users/alandekok","html_url":"https://github.com/alandekok","followers_url":"https://api.github.com/users/alandekok/followers","following_url":"https://api.github.com/users/alandekok/following{/other_user}","gists_url":"https://api.github.com/users/alandekok/gists{/gist_id}","starred_url":"https://api.github.com/users/alandekok/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alandekok/subscriptions","organizations_url":"https://api.github.com/users/alandekok/orgs","repos_url":"https://api.github.com/users/alandekok/repos","events_url":"https://api.github.com/users/alandekok/events{/privacy}","received_events_url":"https://api.github.com/users/alandekok/received_events","type":"User","site_admin":false},"created_at":"2015-11-09T13:34:30Z","updated_at":"2015-11-09T13:34:30Z","body":"Questions belong on the freeradius-users list.  If you keep posting questions here, you will be blocked from opening or commenting on github issues."}}