<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman";}
span.E-MailFormatvorlage17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="Section1">
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Hi all,<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">I am using FreeRADIUS for quite some time now, though I can't wrap my mind around one thing:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">When a module (say, mschap with ntlm_auth) returns REJECT because of the user is not present in the AD, I want to continue processing the request
to, let's say, accept the request, but provide an alternative VLAN (Tunnel-Id) to the endpoint.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">In chapter 16.3.1 of http://networkradius.com/doc/FreeRADIUS-Implementation-Ch16.pdf, section "Return Codes as Modules", it clearly states:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">* reject: Causes the request to be immediately rejected<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">So my question boils down to:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">How can I use the mscap module to check whether a user is valid, and somehow anticipate that he/she does not exist, and continue with an alternate
processing (read: decide later on whether to accept/reject the user) in such a case.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">I thank you very much in advance, and I appreciate your answer.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">For full reference, I included my current setup with explainations:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">---<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Using EAP-PEAPv0 -> valid user credentials should result in an accept with AV-Pair list A and invalid credentials should result in Accept but AV-Pair
list B<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Example:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Using EAP-PEAP<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Login OK<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Sending Accept and<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Type = VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Medium-Type = IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Private-Group-Id = "22"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Login failed<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Sending Accept and<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Type = VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Medium-Type = IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Private-Group-Id = "33"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">I want to control the result via a manipulated control attribute AcnACLType. I set these attibutes from withing rlm_perl:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">########### Snippet Perl Policy ###############################<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">if ( $RAD_CHECK{'AcnACLType'} eq "data" ) {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_CHECK{'Auth-Type'}= "Accept";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Reply-Message'}= "data";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Tunnel-Medium-Type'}= "IEEE-802";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Tunnel-Private-Group-Id'}= "22";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Tunnel-Type'}= "VLAN";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> return RLM_MODULE_OK;<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> elsif ( $RAD_CHECK{'AcnACLType'} eq "authfail" ) {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_CHECK{'Auth-Type'}= "Accept";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Reply-Message'}= "AuthFail";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Tunnel-Medium-Type'}= "IEEE-802";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Tunnel-Private-Group-Id'}= "33";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> $RAD_REPLY{'Tunnel-Type'}= "VLAN";<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> return RLM_MODULE_OK;<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">########### Snippet Perl Policy ###############################<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">In case of MSCHAP authenticating, everything works as expected:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">===================Begin LOG ================================<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [eap] processing type mschapv2<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschapv2] # Executing group from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/inner-tunnel<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschapv2] +- entering group MS-CHAP {...}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] Creating challenge hash with username: pschmidt<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] Told to do MS-CHAPv2 for pschmidt with NT-Password<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=testlab.auconet.lan<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=pschmidt<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] Creating challenge hash with username: pschmidt<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=9499863a8977daa3<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=161b24c676d1a53738cdb10037111c81f1fe1d4d5407266a<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: Exec-Program output: NT_KEY: 00D98A4AFC1CD84EED151A5ECAD45886<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: Exec-Program-Wait: plaintext: NT_KEY: 00D98A4AFC1CD84EED151A5ECAD45886<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: Exec-Program: returned: 0<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++[mschap] returns ok<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++? if (ok)<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ? Evaluating (ok) -> TRUE<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++? if (ok) -> TRUE<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++- entering if (ok) {...}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: +++[control] returns ok<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++- if (ok) returns ok<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++ ... skipping elsif for request 20: Preceding "if" was taken<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: MSCHAP Success<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++[eap] returns handled<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">} # server inner-tunnel<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++[control] returns ok<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> :<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Tunnel-Type = VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair User-Name = testlab.auconet.lan\\pschmidt<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair MS-MPPE-Recv-Key = 0x8a6959f6fd9e2f85fadce413f5691ba0ade9bd80d6fee90893d598bfc978a1d5<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair EAP-Message = 0x030b0004<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair EAP-EMSK = 0x97d3f6e398c284127ee6ad52d55d8a0e609e453971050f546c964193d18dae3c0d74518ef466560670426f120bae29e1c268494e07b5c13ce67033c7135a08d3<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Tunnel-Private-Group-Id = 22<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair AcnACLType = data<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Debug: rlm_perl: Added pair Auth-Type = Accept<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++[perlpolicy] returns ok<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: # Executing section post-auth from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/default<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: +- entering group post-auth {...}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: ++[exec] returns noop<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Sending Access-Accept of id 11 to 127.0.0.1 port 38368<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Reply-Message = "AuthFail"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> MS-MPPE-Send-Key = 0x8cc588be92973040e5f09c8ebdc30ea4480a717aaf984fdf8182c3c6c5ffbfa8<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Type:0 = VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Medium-Type:0 = IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> User-Name = "testlab.auconet.lan\\pschmidt"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> MS-MPPE-Recv-Key = 0x8a6959f6fd9e2f85fadce413f5691ba0ade9bd80d6fee90893d598bfc978a1d5<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> EAP-Message = 0x030b0004<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Private-Group-Id:0 = "22"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 09:59:50 2014 : Info: Finished request 22.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">=============================== END LOG =====================================<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">My problem begins if the credentials are invalid. In this case inner-tunnel returns with "REJECT" and then there seems to be no way to change this
into an "ACCEPT". My feeling at this point is that I miss an important concept in the way FreeRADIUS processes requests.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Here is a snippet from inner-tunnel section:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">############### SNIP ##########################<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">authenticate {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Auth-Type EAP {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> eap {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> ok = 1<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> reject = return<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> fail=return<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">#<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> if (ok) {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> update control {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Auth-Type := "Accept"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> AcnACLType="data"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> elsif (reject) {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> update control {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Auth-Type := "Accept"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> AcnACLType="authfail"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> LogMessage := "RadiusReject"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> auconetLog<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> ########################## End Inner tunnel ###########################<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> and in default server<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> ############################ Default Server ###########################<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Auth-Type EAP {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> eap {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> ok = 1<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> reject = return<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> invalid =1<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> if (ok) {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> update control {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> #Auth-Type := "Accept"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> AcnACLType := "data"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> #update reply {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> # Tunnel-Type := VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> # Tunnel-Medium-Type := IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> # Tunnel-Private-Group-Id := "22"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> #}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> elsif (reject || invalid ) {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> update control {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> AcnACLType := "authfail"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> LogMessage := "RadiusReject"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Auth-Type := "Accept"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> auconetLog<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> update reply {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Type := VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Medium-Type := IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Private-Group-Id := "33"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> update control {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> FreeRADIUS-Client-Shortname="%{Client-Shortname}"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> perlpolicy<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> ######################################################<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> The log is:<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> ================ LOG Begin ===================================<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Wed Jun 18 10:48:04 2014 : Info: [eap] processing type mschapv2<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschapv2] # Executing group from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/inner-tunnel<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschapv2] +- entering group MS-CHAP {...}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] Creating challenge hash with username: radiusfail<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] Told to do MS-CHAPv2 for radiusfail with NT-Password<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] No NT-Domain was found in the User-Name.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --username=%{mschap:User-Name} -> --username=radiusfail<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] Creating challenge hash with username: radiusfail<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=3fc42259705d168a<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=1a7a459b40d3527944a7aadcdf32a499c097cf0dc1c296ad<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: Exec-Program output: Logon failure (0xc000006d)<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: Exec-Program-Wait: plaintext: Logon failure (0xc000006d)<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: Exec-Program: returned: 1<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] External script failed.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [mschap] FAILED: MS-CHAP2-Response is incorrect<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: ++[mschap] returns reject<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [eap] Freeing handler<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: ++[eap] returns reject <<<<<<<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: Failed to authenticate the user.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">} # server inner-tunnel<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [peap] Got tunneled reply code 3<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> MS-CHAP-Error = "\tE=691 R=1"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> EAP-Message = 0x04090004<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [peap] Got tunneled reply RADIUS code 3<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> MS-CHAP-Error = "\tE=691 R=1"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> EAP-Message = 0x04090004<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: [peap] Tunneled authentication was rejected.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair State = 0xe26df394eb67ea7b6c664f076e6e6a50<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Calling-Station-Id = 02:00:00:00:00:01<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Message-Authenticator = 0x6ab434e42ece49cdb13eb90438443c03<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair User-Name = radiusfail<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair EAP-Message = 0x020a0050190017030100208c1c20ac2dcb12e53b8a57d494b40657b43bd5019ca84e352e57a1069a1176a917030100209ed7b46fa6d167c1aacf327ae328c70674c366c0ddeceab26e7ba5232f3b029e<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Connect-Info = CONNECT 11Mbps 802.11b<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair EAP-Type = PEAP<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair NAS-IP-Address = 127.0.0.1<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Framed-MTU = 1400<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Reply-Message = AuthFail<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair EAP-Message = 0x040a0004<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Tunnel-Type = VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Tunnel-Private-Group-Id = 33<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair FreeRADIUS-Client-Shortname = localhost<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair LogMessage = RadiusReject<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair AcnACLType = authfail<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: rlm_perl: Added pair Auth-Type = Accept<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: ++[perlpolicy] returns ok<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: # Executing section post-auth from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/default<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: +- entering group post-auth {...}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: ++[exec] returns noop<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: Using Post-Auth-Type Reject<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: # Executing group from file /home/auconet/freeradius/test/CSI/etc/raddb//sites-enabled/default<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: +- entering group REJECT {...}<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: ++- group REJECT returns noop<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Info: Delaying reject of request 10 for 1 seconds<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: Going to the next request<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:04 2014 : Debug: Waking up in 0.9 seconds.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:05 2014 : Info: Sending delayed reject for request 10<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Sending Access-Reject of id 10 to 127.0.0.1 port 51730<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Reply-Message = "AuthFail"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> EAP-Message = 0x040a0004<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Medium-Type:0 = IEEE-802<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Type:0 = VLAN<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Tunnel-Private-Group-Id:0 = "33"<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Message-Authenticator = 0x00000000000000000000000000000000<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Wed Jun 18 10:48:05 2014 : Debug: Waking up in 3.9 seconds.<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">================= LOG End =====================================<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">My naïve idea is to instead send an Access-Accept with a Tunnel-Id of 11. I disabled the filter in<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> Post-Auth-Type REJECT {<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> #attr_filter.access_reject<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"> }<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">to see attributes from my perl-policy.
<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial">Thanks
<o:p></o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="2" face="Arial"><span lang="EN-GB" style="font-size:
10.0pt;font-family:Arial"><o:p> </o:p></span></font></p>
<p class="MsoNormal"><font size="3" face="Times New Roman"><span style="font-size:
12.0pt"><o:p> </o:p></span></font></p>
</div>
</body>
</html>