LEAP did not work. Need some help

Tilman Baumann tilman.baumann at grandeye.com
Mon May 13 11:45:31 EDT 2013


I have been playing around with all sorts of EAP protocols and most seem
to work for me now.
LEAP however seems to fail, even though the freeradius server seems to
suggest that authentication has succeeded.
I'm using wired IEEE802.1x

I get such messages from freeradius -X

Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type leap
  rlm_eap_leap: Stage 2
  rlm_eap_leap: Issuing AP Challenge
  rlm_eap_leap: Successfully initiated
++[eap] returns handled
Sending Access-Challenge of id 208 to port 1026
        EAP-Message = 0x01470017110100088fc287d5a1a1870074657374696e67
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x8481d20384c6c3a4d66aeb67b66d8d2c
Finished request 667.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host port 1026,
id=209, length=161
        User-Name = "testing"
        NAS-Identifier = "ES-2024PWR"
        NAS-IP-Address =
        NAS-Port = 4
        NAS-Port-Type = Ethernet
        Calling-Station-Id = "00-11-35-01-00-49"
        Framed-MTU = 1400
        EAP-Message =
        State = 0x8481d20384c6c3a4d66aeb67b66d8d2c
        Message-Authenticator = 0x3404530f28d66d8a680e5c620afee120
# Executing section authorize from file
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "testing", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 71 length 39
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry testing at line 51
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/leap
[eap] processing type leap
  rlm_eap_leap: Stage 4
  rlm_eap_leap: NtChallengeResponse from AP is valid
[eap] Underlying EAP-Type set EAP ID to 72
++[eap] returns ok
Login OK: [testing/<via Auth-Type = EAP>] (from client private-network-2
port 4 cli 00-11-35-01-00-49)
# Executing section post-auth from file
+- entering group post-auth {...}

I can test my account with default_eap_type = leap set in freereadius.
]# radtest -t mschap testing password 0 testing123-2
Sending Access-Request of id 220 to port 1812
        User-Name = "testing"
        NAS-IP-Address =
        NAS-Port = 0
        Message-Authenticator = 0x00000000000000000000000000000000
        MS-CHAP-Challenge = 0x94a10b310e45252a
        MS-CHAP-Response =
rad_recv: Access-Accept packet from host port 1812,
id=220, length=84
        MS-CHAP-MPPE-Keys =
        MS-MPPE-Encryption-Policy = 0x00000001
        MS-MPPE-Encryption-Types = 0x00000006

Other EAP protocols like MD5 and PEAP work fine through my
wpa_supplicant. But not LEAP.

I have attached logs with wpa_supplicant -dd

wpa_supplicant.conf is simple



I would be glad for any hints.

PS: I would like to test LEAP-FAST as well. Is freeradius with the
hostap eap lib the best way to go?
I did not really want to re-compile it, but I would if that's the way to
go. (using debian package right now)
Tilman Baumann
Oncam Grandeye
6 Huxley Road, Surrey Research Park
Guildford, GU2 7RE, United Kingdom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: wpa.log
Type: text/x-log
Size: 8192 bytes
Desc: not available
URL: <http://lists.shmoo.com/pipermail/hostap/attachments/20130513/bd0347c4/attachment-0001.bin>

More information about the HostAP mailing list