November 2013 - Freeradius-Users - lists.freeradius.org

radsqlrelay: can't it just give up sometimes?
by Stefan Winter 06 Nov '13

06 Nov '13

Hello, I keep having issues now and then with radsqlrelay. Sometimes we get some accounting records which miss attributes or come with too unexpected values - the resulting SQL queries then sometimes are bogus. My last instance of this generated in radsqlrelay: Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 Incorrect integer value: '' for column 'AcctSessionTime' at row 1 radsqlrelay keeps being excited over the query in question *forever* and retries to eternity. The query doesn't get any better over time though - it just makes the whole relaying process come to a grinding halt. Can't radqlrelay be a bit more clever about this, like try three times, and if the query is consistently rejected, save it to a ".reject" file and move on? I can't be the only one who falls into this, am I? Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

6 10

framed-compression error
by Ufuk Eskici 06 Nov '13

06 Nov '13

Hello, I am configuring "framed-compression = NONE" but still getting response from free radius as "Framed-Compression = Van-Jacobson-TCP-IP". Why radius is sending this even I configure the opposite?

2 5

Check Chillispot-VLAN-Id
by Stuart Baggs 06 Nov '13

06 Nov '13

Hi All First post from a longtime reader / free radius user. We have CoovaChilli (a Wi-Fi captive portal program) tied together with FreeRadius for AAA. When an access request is sent to FreeRadius, Coova-Chill sends an attribute called Chillispot-VLAN-Id. What I’d like to do is check this attribute at the time of user login and make sure they’re allowed to be on a certain VLAN. I was thinking of having a custom check attribute in the radgroupreply table with something like Permitted-VLANS := 1,2,3,4 All I need free radius to do is ignore the check if there is not Permitted-VLANS attribute for that user or, if specified, make sure Chillispot-VLAN-Id is contained within Permitted-VLANS. We do this to stop users in certain locations from gaining access. Traditional huntgroups won’t work for us as we’re using a single NAS for all areas. Thanks in advance Stuart

2 1

Windows Workstation Authentication
by Dan Lietz 05 Nov '13

05 Nov '13

I have 802.11 authentication set up using an eDirectory backend and it all works except for one thing. When a user logs in to a Windows computer using a windows account that does not exist in eDirectory the authorization fails. Since the locally logged on user does not exist in eDirectory, authorization fails before the user is prompted when initially trying to connect to the wireless. Instead the workstation sends the user credentials that were used to log in locally to the radius server. Does anyone know if there is a way to configure the Windows wireless connection or the radius backend to force a prompt for authorization? Thanks for any assistance. Dan

7 7

DHCP reply not leaving machine
by Rok Kosir 05 Nov '13

05 Nov '13

Hi, after multiple recompilation of FR (both version 2.2 and 3.0.1) i was not able to configure DHCP server so that clients would get IPs. I am currently testing on ubuntu 12.04.3 server which has connected Ubuntu 12.04 desktop version laptop on eth1 trying to get IP. I see multiple requests comming to server but no reply reaches the client (nor ethernet card). FR is built from source and following this configuration http://wiki.freeradius.org/guide/dhcp-for-static-ip-allocation (with exception of using mac2ip for IP filetable). Here is relevant info on server: eth1: inet addr:192.168.0.1 dhcp config: server dhcp { listen { ipaddr = 255.255.255.255 port = 67 type = dhcp interface = eth1 dhcp DHCP-Discover { update reply { DHCP-Message-Type = DHCP-Offer } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 192.168.0.1 DHCP-Domain-Name-Server = 193.2.1.66 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.0.1 } mac2ip ok } dhcp DHCP-Request { update reply { DHCP-Message-Type = DHCP-Ack } # The contents here are invented. Change them! update reply { DHCP-Domain-Name-Server = 192.168.0.1 DHCP-Domain-Name-Server = 193.2.1.66 DHCP-Subnet-Mask = 255.255.255.0 DHCP-Router-Address = 192.168.0.1 DHCP-IP-Address-Lease-Time = 86400 DHCP-DHCP-Server-Identifier = 192.168.0.1 } mac2ip ok } dhcp { # send a DHCP NAK. reject } } radiusd -X output is here: http://pastebin.com/raw.php?i=yY1aNf6v i have used tcpdump to check port 67 and 68, but only requests come in, no reply is released to ethernet card. Any suggestions? Regards, Rok

3 14

Re: SSL V3 client certificate error
by Danny Kurniawan 05 Nov '13

05 Nov '13

thank you so much .. yes it only have issue intermitenly on some user .. so i have to set our client laptop manually for the root CA? I believe it should be there as we use Global Sign ... -- Best Regards, Danny

2 1

EAP + SSL + Certificate chains
by Trevor Jennings 05 Nov '13

05 Nov '13

Hello, We are using freeradius with EAP/SSL and although it is working fine, I was wondering if there was a way to prevent the user from getting the prompt to accept the certificate? I have combined the intermediate and server certificates to one file and used that file in the 'certificate_file' config in eap.conf. On OSX, the certificates are marked as valid, including the root, intermediate and server, but still prompts the user to accept. Is there a way around this? Cheers, - Trevor

5 5

Change between 2.2.1 and 2.2.2
by Alex Sharaz 04 Nov '13

04 Nov '13

Hi, There seems to be a change that’s happened between vsn 2.2.1 and 2.2.2 We’re in the process of implementing a phased take-over of the management of our CSE dept radius services. What I’m doing is 1). Point CSE switches at our radius server 2) Check mac address of client ( calling station id) 3). If I know about it, perform mac-auth and send access accept with appropriate parameters 4). If I don’t know about it proxy it off to another server which in turn proxies it off to the CSE radius service and act upon the result that comes back. This all worked just fine for 2.2.0 and 2.2.1.In the log file I’d also see entries of the form Fri Nov 1 16:17:10 2013 : Auth: Login incorrect (Home Server says so): [<blah!>/<CHAP-Password>] (from client nasaaa5 port 48 cli <mac-address of client>) Which is fine, it just means that I don't know that mac address and neither does the remote (CSE) server. It’s usually a client that is trying to do a macauth 1st and then an EAP auth with user credentials. An upgrade to 2.2.2 caused these messages to disappear. I saw another freeradius message to day that implied theres been a change that silently drops access-rejects instead of passing them back up the food chain to the client … or something like that…. managed to delete the message :-(( If that’s the case, how do I get the 2.2.1/2.2.0 functionality back please. Rgds Alex

4 9

Glitch in FreeRADIUS when final Access-Accept bigger than 4096 octets
by stefan.paetow＠diamond.ac.uk 04 Nov '13

04 Nov '13

Alan D, Arran, This issue was raised on the Project Moonshot list, where an Access-Accept packet was exceeding the 4096 octet limit as per the RFC. Apparently the daemon goes into a loop (as seen below) once the packet size exceeds the limit, and the original poster pointed out that his debug session had continued looping for several minutes before he terminated the session with a Ctrl+C. This was a build of FreeRADIUS 3.0, possibly rc0 or rc1 (I know we're now in release, but I'm sure I can try to reproduce this again even with the release version). Logically, I would expect the warning message to be printed once per attribute statement remaining (according to the complete reply section fragment at http://pastebin.com/ZqUh5Tzj, there are 5 more "SAML-AAA-Assertion +=" statements left), and then leave it at that, not loop on for minutes (or hours). Perhaps it would be useful to point out WHY encoding failed, instead of merely saying that it failed. In this specific case, it was a matter of exceeding the packet size (proven by the original poster by extending each += statement to the full 252 or so characters per attribute at my suggestion, which reduced the number of statements and hence the 2-octet overhead per statement). The full debug log is below: freeradius: FreeRADIUS Version 3.0.0, for host , built on Jun 1 2013 at 18:02:35 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/wimax including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/attr_rewrite including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/psk including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/cui including configuration file /etc/freeradius/mods-enabled/../sql/cui/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/krb_tgt2 including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/dhcp including configuration file /etc/freeradius/mods-enabled/krb_tgt including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/checkval including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/inner-eap including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/counter including configuration file /etc/freeradius/mods-enabled/echo including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/control including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/tls main { security { user = "freerad" group = "freerad" allow_core_dumps = no } } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server tls { ipaddr = 127.0.0.1 port = 2083 type = "auth" proto = "tcp" secret = "testing123" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no ecdh_curve = "prime256v1" } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool tls { type = fail-over home_server = tls } realm tls { auth_pool = tls } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Linked to module rlm_dhcp Module: Instantiating module "dhcp" from file /etc/freeradius/mods-enabled/dhcp Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { } # modules } # server server default { # from file /etc/freeradius/sites-enabled/default modules { Module: Creating Auth-Type = digest Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap pap { auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } debug: Using cached TLS configuration from previous invocation Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Loading virtual module filter_username Module: Linked to module rlm_always Module: Instantiating module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no default_community = "apc.moonshot.ja.net" rp_realm = "local" trust_router = "localhost" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/mods-enabled/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Loading virtual module acct_unique Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { file = "/etc/freeradius/filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/filter/accounting_response Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Loading virtual module remove_reply_message_if_eap Module: Instantiating module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { file = "/etc/freeradius/filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/filter/access_reject Module: Loading virtual module remove_reply_message_if_eap } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 2083 max_pps = 0 proto = "tcp" tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "PSK:ALL:!aNULL:!eNULL" require_client_cert = yes ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Thread 5 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 1 waiting to be assigned a request clients = "radsec" client 127.0.0.1 { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" virtual_server = "default" proto = "tcp" } client default { ipaddr = 0.0.0.0 netmask = 0 require_message_authenticator = no secret = "radsec" virtual_server = "default" proto = "tcp" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 4000 max_pps = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } listen { type = "auth" ipaddr = * port = 0 max_pps = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } listen { type = "acct" ipaddr = * port = 0 max_pps = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 max_pps = 0 client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on authentication proto tcp address * port 2083 (TLS) Listening on authentication address 127.0.0.1 port 4000 Listening on authentication address * port 1812 as server default Listening on accounting address * port 1813 as server default Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy address * port 2085 Listening on proxy address * port 2085 Ready to process requests. ... new connection request on TCP socket. Listening on authentication from client (127.0.0.1, 35521) -> (*, 2083) Waking up in 0.7 seconds. (0) Requiring client certificate (0) Initiate (0) (other): before/accept initialization (0) TLS_accept: before/accept initialization (0) <<< TLS 1.0 Handshake [length 00dd], ClientHello (0) TLS_accept: SSLv3 read client hello A (0) >>> TLS 1.0 Handshake [length 003e], ServerHello (0) TLS_accept: SSLv3 write server hello A (0) >>> TLS 1.0 Handshake [length 085e], Certificate (0) TLS_accept: SSLv3 write certificate A (0) >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (0) TLS_accept: SSLv3 write key exchange A (0) >>> TLS 1.0 Handshake [length 00a6], CertificateRequest (0) TLS_accept: SSLv3 write certificate request A (0) TLS_accept: SSLv3 flush data (0) TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode Waking up in 0.7 seconds. (0) <<< TLS 1.0 Handshake [length 0853], Certificate (0) chain-depth=1, (0) error=0 (0) --> BUF-Name = Example Certificate Authority (0) --> subject = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority (0) --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority (0) --> verify return:1 (0) chain-depth=0, (0) error=0 (0) --> BUF-Name = user(a)example.com (0) --> subject = /C=FR/ST=Radius/O=Example Inc./CN=user@example.com/emailAddress=user@example.com (0) --> issuer = /C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=Example Certificate Authority (0) --> verify return:1 (0) TLS_accept: SSLv3 read client certificate A (0) <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (0) TLS_accept: SSLv3 read client key exchange A (0) <<< TLS 1.0 Handshake [length 0106], CertificateVerify (0) TLS_accept: SSLv3 read certificate verify A (0) <<< TLS 1.0 ChangeCipherSpec [length 0001] (0) <<< TLS 1.0 Handshake [length 0010], Finished (0) TLS_accept: SSLv3 read finished A (0) >>> TLS 1.0 ChangeCipherSpec [length 0001] (0) TLS_accept: SSLv3 write change cipher spec A (0) >>> TLS 1.0 Handshake [length 0010], Finished (0) TLS_accept: SSLv3 write finished A (0) TLS_accept: SSLv3 flush data (0) (other): SSL negotiation finished successfully SSL Connection Established Waking up in 0.7 seconds. (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=76 Threads: total/active/spare threads = 5/0/5 Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) (0) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) <thread> : group authorize { (0) <thread> : - entering group authorize {...} (0) <thread> : policy filter_username { (0) <thread> : - entering policy filter_username {...} (0) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (0) <thread> : expand: '%{User-Name}' -> '@local' (0) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (0) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) <thread> : ? if (User-Name =~ / /) (0) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (0) <thread> : ? if (User-Name =~ / /) -> FALSE (0) <thread> : ? if (User-Name =~ /@.*@/ ) (0) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (0) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (0) <thread> : ? if (User-Name =~ /\\.\\./ ) (0) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (0) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) <thread> : ? if (User-Name =~ /\\.$/) (0) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (0) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (0) <thread> : ? if (User-Name =~ /(a)\\./) (0) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (0) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (0) <thread> : - policy filter_username returns notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Looking up realm "local" for User-Name = "@local" (0) suffix : Found realm "LOCAL" (0) suffix : Adding Stripped-User-Name = "" (0) suffix : Adding Realm = "LOCAL" (0) suffix : Authentication realm is LOCAL. (0) [suffix] = ok (0) eap : EAP packet type response id 0 length 11 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) group authenticate { (0) - entering group authenticate {...} (0) eap : EAP Identity (0) eap : processing type ttls (0) ttls : Flushing SSL sessions (of #0) (0) ttls : Initiate (0) ttls : Start returned 1 (0) eap : New EAP session, adding 'State' attribute to reply 0x5547a69c5546b331 (0) [eap] = handled (0) Finished request 0. Thread 5 waiting to be assigned a request Waking up in 0.3 seconds. (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=145 (0) Cleaning up request packet ID 0 with timestamp +10 Waking up in 0.3 seconds. Thread 4 got semaphore Thread 4 handling request 1, (1 handled so far) (1) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) <thread> : group authorize { (1) <thread> : - entering group authorize {...} (1) <thread> : policy filter_username { (1) <thread> : - entering policy filter_username {...} (1) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (1) <thread> : expand: '%{User-Name}' -> '@local' (1) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (1) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) <thread> : ? if (User-Name =~ / /) (1) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (1) <thread> : ? if (User-Name =~ / /) -> FALSE (1) <thread> : ? if (User-Name =~ /@.*@/ ) (1) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (1) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (1) <thread> : ? if (User-Name =~ /\\.\\./ ) (1) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (1) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (1) <thread> : ? if (User-Name =~ /\\.$/) (1) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (1) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (1) <thread> : ? if (User-Name =~ /(a)\\./) (1) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (1) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (1) <thread> : - policy filter_username returns notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : Looking up realm "local" for User-Name = "@local" (1) suffix : Found realm "LOCAL" (1) suffix : Adding Stripped-User-Name = "" (1) suffix : Adding Realm = "LOCAL" (1) suffix : Authentication realm is LOCAL. (1) [suffix] = ok (1) eap : EAP packet type response id 1 length 62 (1) eap : Continuing tunnel setup. (1) [eap] = ok (1) Found Auth-Type = EAP (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) group authenticate { (1) - entering group authenticate {...} (1) eap : Expiring EAP session with state 0x5547a69c5546b331 (1) eap : Finished EAP session with state 0x5547a69c5546b331 (1) eap : Previous EAP request found for state 0x5547a69c5546b331, released from the list (1) eap : EAP/ttls (1) eap : processing type ttls (1) ttls : Authenticate (1) ttls : processing EAP-TLS (1) ttls : eaptls_verify returned 7 (1) ttls : Done initial handshake (1) ttls : (other): before/accept initialization (1) ttls : TLS_accept: before/accept initialization (1) ttls : <<< TLS 1.0 Handshake [length 0033], ClientHello (1) ttls : TLS_accept: SSLv3 read client hello A (1) ttls : >>> TLS 1.0 Handshake [length 004a], ServerHello (1) ttls : TLS_accept: SSLv3 write server hello A (1) ttls : >>> TLS 1.0 Handshake [length 085e], Certificate (1) ttls : TLS_accept: SSLv3 write certificate A (1) ttls : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) ttls : TLS_accept: SSLv3 write server done A (1) ttls : TLS_accept: SSLv3 flush data (1) ttls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) ttls : eaptls_process returned 13 (1) eap : New EAP session, adding 'State' attribute to reply 0x5547a69c5445b331 (1) [eap] = handled (1) Finished request 1. Thread 4 waiting to be assigned a request (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=89 (1) Cleaning up request packet ID 0 with timestamp +10 Waking up in 0.3 seconds. Thread 3 got semaphore Thread 3 handling request 2, (1 handled so far) (2) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (2) <thread> : group authorize { (2) <thread> : - entering group authorize {...} (2) <thread> : policy filter_username { (2) <thread> : - entering policy filter_username {...} (2) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (2) <thread> : expand: '%{User-Name}' -> '@local' (2) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (2) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (2) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (2) <thread> : ? if (User-Name =~ / /) (2) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (2) <thread> : ? if (User-Name =~ / /) -> FALSE (2) <thread> : ? if (User-Name =~ /@.*@/ ) (2) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (2) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (2) <thread> : ? if (User-Name =~ /\\.\\./ ) (2) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (2) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (2) <thread> : ? if (User-Name =~ /\\.$/) (2) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (2) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (2) <thread> : ? if (User-Name =~ /(a)\\./) (2) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (2) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (2) <thread> : - policy filter_username returns notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : Looking up realm "local" for User-Name = "@local" (2) suffix : Found realm "LOCAL" (2) suffix : Adding Stripped-User-Name = "" (2) suffix : Adding Realm = "LOCAL" (2) suffix : Authentication realm is LOCAL. (2) [suffix] = ok (2) eap : EAP packet type response id 2 length 6 (2) eap : Continuing tunnel setup. (2) [eap] = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) group authenticate { (2) - entering group authenticate {...} (2) eap : Expiring EAP session with state 0x5547a69c5445b331 (2) eap : Finished EAP session with state 0x5547a69c5445b331 (2) eap : Previous EAP request found for state 0x5547a69c5445b331, released from the list (2) eap : EAP/ttls (2) eap : processing type ttls (2) ttls : Authenticate (2) ttls : processing EAP-TLS (2) ttls : Received TLS ACK (2) ttls : Received TLS ACK (2) ttls : ACK handshake fragment handler (2) ttls : eaptls_verify returned 1 (2) ttls : eaptls_process returned 13 (2) eap : New EAP session, adding 'State' attribute to reply 0x5547a69c5744b331 (2) [eap] = handled User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x0200000b01406c6f63616c Message-Authenticator = 0x0270fc6d540b3fcba6c2c457f5fa90e7 Sending Access-Challenge of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5547a69c5546b3319371950f23751f07 User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x0201003e150016030100330100002f030152714f7bcd9d2ea5d160057846af3c7e070bce5fc18925544d4f4e3aff4f43f5000008002f000a000500040100 State = 0x5547a69c5546b3319371950f23751f07 Message-Authenticator = 0x5da266f79063df9470a7e8a2820aa238 Sending Access-Challenge of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 EAP-Message = 0x010203ec15c0000008bb160301004a02000046030152714f7b3f2e08219fdc96ec7bfbde0a4f9ed0e45054a702692e2619de46769d2068c663d2584e6ad5c297c0b4a0abaf1d9cf417fda2bb4abb885001ca535288de002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3133303731353132343733345a170d3134303731353132343733345a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cb4c7c0f30d1d64db6ade1d89fbe70189bf7fcbd61dd48395bd3687efde1 EAP-Message = 0xac77abbbaa8881fb01f1edc3da1c2532fc53ee021cafc92aa28701e707ff3e1b36848e22d40a025074a0f7536597daa683ac7cf093101909452aa4f10164510fa57d12a0d9ddeee693532d8e1c3e135eaa3c5d5501c3ca0696db562d518ac6cf2e9ce268f5e44eba748726ebc354d87fbe95fe8d255628b2ed3213d1199506f0458da6adc25d1fd3b2d0fd404931b848ecb5ba4606ab3b281d11e82289a55da473804653d8510a4128cef182e65ded7ec54e1b64186d887e7d16c4f31de7c91a125b4dff30effba255179f5bf1dc5a4fdac5db9756cb85bff82ff4f60a9e9e63b9090203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010505000382010100c1be2cfc27d57e0f3e6b4256286b39f6e8150e4b7ebd8e8f59e40cf852afe17a7265523e4024a06ae1e189df86b460850628e4ad6c1bed4af7c255f805504dfe478dee6913088d44850ccda56deb94aee83211a425b78bc14b7701f2d4c7d0be73bced64ff5f4467cfedc2520960e43a534f23aa84626597f19c02c779fb5af8e7e32d22112c642d168e802a38096c43e406ee20c42cc3e9eed96bff2b8e47f3cc92fa3d3fce3005c507aa9c05265b9e34f64720b142a5db3e55c1a000c702542dadbfd4b3ed8c36cecfd4897f21d328c27f6045fa5f289b9a4355375686 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5547a69c5445b3319371950f23751f07 User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x020200061500 State = 0x5547a69c5445b3319371950f23751f07 Message-Authenticator = 0x84a704dc26e7de0546c51cd00ba99029 Sending Access-Challenge of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 EAP-Message = 0x010303ec15c0000008bb864211062c5217e1ea6839c544d0135a95b159048453d6b73d8a96ad30741e050edb0004ab308204a73082038fa003020102020900c9cdc1e9c0118238300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3133303731353132343733345a EAP-Message = 0x170d3134303731353132343733345a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706(2) Finished request 2. Thread 3 waiting to be assigned a request (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=89 (2) Cleaning up request packet ID 0 with timestamp +10 Waking up in 0.3 seconds. Thread 2 got semaphore Thread 2 handling request 3, (1 handled so far) (3) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) <thread> : group authorize { (3) <thread> : - entering group authorize {...} (3) <thread> : policy filter_username { (3) <thread> : - entering policy filter_username {...} (3) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (3) <thread> : expand: '%{User-Name}' -> '@local' (3) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (3) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (3) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (3) <thread> : ? if (User-Name =~ / /) (3) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (3) <thread> : ? if (User-Name =~ / /) -> FALSE (3) <thread> : ? if (User-Name =~ /@.*@/ ) (3) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (3) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (3) <thread> : ? if (User-Name =~ /\\.\\./ ) (3) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (3) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (3) <thread> : ? if (User-Name =~ /\\.$/) (3) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (3) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (3) <thread> : ? if (User-Name =~ /(a)\\./) (3) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (3) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (3) <thread> : - policy filter_username returns notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : Looking up realm "local" for User-Name = "@local" (3) suffix : Found realm "LOCAL" (3) suffix : Adding Stripped-User-Name = "" (3) suffix : Adding Realm = "LOCAL" (3) suffix : Authentication realm is LOCAL. (3) [suffix] = ok (3) eap : EAP packet type response id 3 length 6 (3) eap : Continuing tunnel setup. (3) [eap] = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) group authenticate { (3) - entering group authenticate {...} (3) eap : Expiring EAP session with state 0x5547a69c5744b331 (3) eap : Finished EAP session with state 0x5547a69c5744b331 (3) eap : Previous EAP request found for state 0x5547a69c5744b331, released from the list (3) eap : EAP/ttls (3) eap : processing type ttls (3) ttls : Authenticate (3) ttls : processing EAP-TLS (3) ttls : Received TLS ACK (3) ttls : Received TLS ACK (3) ttls : ACK handshake fragment handler (3) ttls : eaptls_verify returned 1 (3) ttls : eaptls_process returned 13 (3) eap : New EAP session, adding 'State' attribute to reply 0x5547a69c5643b331 (3) [eap] = handled (3) Finished request 3. Thread 2 waiting to be assigned a request (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=417 (3) Cleaning up request packet ID 0 with timestamp +10 Waking up in 0.3 seconds. Thread 1 got semaphore Thread 1 handling request 4, (1 handled so far) (4) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) <thread> : group authorize { (4) <thread> : - entering group authorize {...} (4) <thread> : policy filter_username { (4) <thread> : - entering policy filter_username {...} (4) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (4) <thread> : expand: '%{User-Name}' -> '@local' (4) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (4) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (4) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (4) <thread> : ? if (User-Name =~ / /) (4) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (4) <thread> : ? if (User-Name =~ / /) -> FALSE (4) <thread> : ? if (User-Name =~ /@.*@/ ) (4) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (4) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (4) <thread> : ? if (User-Name =~ /\\.\\./ ) (4) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (4) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (4) <thread> : ? if (User-Name =~ /\\.$/) (4) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (4) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (4) <thread> : ? if (User-Name =~ /(a)\\./) (4) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (4) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (4) <thread> : - policy filter_username returns notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : Looking up realm "local" for User-Name = "@local" (4) suffix : Found realm "LOCAL" (4) suffix : Adding Stripped-User-Name = "" (4) suffix : Adding Realm = "LOCAL" (4) suffix : Authentication realm is LOCAL. (4) [suffix] = ok (4) eap : EAP packet type response id 4 length 253 (4) eap : Continuing tunnel setup. (4) [eap] = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) group authenticate { (4) - entering group authenticate {...} (4) eap : Expiring EAP session with state 0x5547a69c5643b331 (4) eap : Finished EAP session with state 0x5547a69c5643b331 (4) eap : Previous EAP request found for state 0x5547a69c5643b331, released from the list (4) eap : EAP/ttls (4) eap : processing type ttls (4) ttls : Authenticate (4) ttls : processing EAP-TLS (4) ttls : eaptls_verify returned 7 (4) ttls : Done initial handshake (4) ttls : <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange (4) ttls : TLS_accept: SSLv3 read client key exchange A (4) ttls : <<< TLS 1.0 ChangeCipherSpec [length 0001] (4) ttls : <<< TLS 1.0 Handshake [length 0010], Finished (4) ttls : TLS_accept: SSLv3 read finished A (4) ttls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (4) ttls : TLS_accept: SSLv3 write change cipher spec A (4) ttls : >>> TLS 1.0 Handshake [length 0010], Finished (4) ttls : TLS_accept: SSLv3 write finished A (4) ttls : TLS_accept: SSLv3 flush data SSL: adding session 68c663d2584e6ad5c297c0b4a0abaf1d9cf417fda2bb4abb885001ca535288de to cache (4) ttls : (other): SSL negotiation finished successfully SSL Connection Established (4) ttls : eaptls_process returned 13 (4) eap : New EAP session, adding 'State' attribute to reply 0x5547a69c5142b331 (4) [eap] = handled (4) Finished request 4. Thread 1 waiting to be assigned a request (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=142 (4) Cleaning up request packet ID 0 with timestamp +10 Waking up in 0.2 seconds. Thread 5 got semaphore Thread 5 handling request 5, (2 handled so far) (5) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (5) <thread> : group authorize { (5) <thread> : - entering group authorize {...} (5) <thread> : policy filter_username { (5) <thread> : - entering policy filter_username {...} (5) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (5) <thread> : expand: '%{User-Name}' -> '@local' (5) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (5) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (5) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (5) <thread> : ? if (User-Name =~ / /) (5) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (5) <thread> : ? if (User-Name =~ / /) -> FALSE (5) <thread> : ? if (User-Name =~ /@.*@/ ) (5) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (5) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (5) <thread> : ? if (User-Name =~ /\\.\\./ ) (5) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (5) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (5) <thread> : ? if (User-Name =~ /\\.$/) (5) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (5) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (5) <thread> : ? if (User-Name =~ /(a)\\./) (5) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (5) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (5) <thread> : - policy filter_username returns notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : Looking up realm "local" for User-Name = "@local" (5) suffix : Found realm "LOCAL" (5) suffix : Adding Stripped-User-Name = "" (5) suffix : Adding Realm = "LOCAL" (5) suffix : Authentication realm is LOCAL. (5) [suffix] = ok (5) eap : EAP packet type response id 5 length 59 (5) eap : Continuing tunnel setup. (5) [eap] = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) group authenticate { (5) - entering group authenticate {...} (5) eap : Expiring EAP session with state 0x5547a69c5142b331 (5) eap : Finished EAP session with state 0x5547a69c5142b331 (5) eap : Previous EAP request found for state 0x5547a69c5142b331, released from the list (5) eap : EAP/ttls (5) eap : processing type ttls (5) ttls : Authenticate (5) ttls : processing EAP-TLS (5) ttls : eaptls_verify returned 7 (5) ttls : Done initial handshake (5) ttls : eaptls_process returned 7 (5) ttls : Session established. Proceeding to decode tunneled attributes. (5) ttls : Got tunneled request c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c7c0b514e13e357465467c8844f27180928b32a60a0b1096f0e2987672615b18e54b3b7fc1cd15fde9f3a5afcf32570266a401ba3425da EAP-Message = 0x2e99ba99dc539e351794f8c23872645f02629c74f112c4dfcad9f26b27483a0e0ef25e61aa644004dfeef77fd6bd34fce35531b81ed472ef64633896b1020347e8e876c940461fe5a0b321017524fc6ecd79942135c16fc3c04c679e73e0f9fa5cb5da67de0cc9013ebf17881351b3963896b6e1123c8f763d507f4df0a0250a3200314abc21b5a563a0212b4652dfaca9264b2ffc77dbe891a59391f92f0b1011cfb255c85eac3e5b3eba7ed6565db1d10475678e3b8b595f0b03cbb6307808e3eabfa08f9b99d8930203010001a381fb3081f8301d0603551d0e04160414a330989c80aede5ae5df40a911898d5a705fcc013081c80603551d230481 EAP-Message = 0xc03081bd8014a330989c80aede5ae5df40a911898d5a705fcc01a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900c9cdc1e9c0118238300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008cc8230ef7bfc46ff89497446d5fb541534b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5547a69c5744b3319371950f23751f07 User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x020300061500 State = 0x5547a69c5744b3319371950f23751f07 Message-Authenticator = 0x74c6d5fa6cd77f54303872bc138b5614 Sending Access-Challenge of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 EAP-Message = 0x010401011580000008bb90e187b84335167cdf78f98aa689351940859c6e85ab8a446878da189707bc1106384de02da1d850011d5f28e5f3337cecf7df59707fe2dc03ab76284f1c29d4cd52a5f26bd69986da96ed77dfaaa9c97635958b52bf2fb6a92a97c354e1c15972efa4f611d9fe921cebc1e8f25a9201fef323e2f11cda768d8df1c9a161aa8f0629ce7b4f21c925c23f92d3e9ac02006287881cbbcdf1c919909cb7adc61bde055564ff281a37f2c176a135915ca4f379f1b4a56f8ff7077c7c9f287034cb59ebd80ddca3861bb6a3add8fbe1edb7175af027eb5c898a9fbbebcb53a61759bcd389d5140d7658c6dbcf8e3838a51603010004 EAP-Message = 0x0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5547a69c5643b3319371950f23751f07 User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x0204014c150016030101061000010201006510ccb3a4efaf2740df07a579e16cec7d68ca8f8229e00ad556fd7d3fafcd976faed918f8930e7111e7f839df5a032ed2dc9ccbeda99a014ee2e811ce0d6bc20c50d9ce75f349c952e73e23d4337917786a2b033903982a77111938504dbe9db114538a14c94fef3cb04950c96e3fb4e152462e07926cbc8e43cad5fa5cef5ce7e79d92907a5ff45d3258e7928c3a16b0b75dc965a721b8f5a98b9a3eea4b91ae396b5fafdb8c8a80d4798e79de8a63e1d95752394d10cce9958c66a824c4a5e58319fc80fdf8adda1f1d7f9ef1a6d41872f2e944477ecd7c7bbdfd7e77013b436d110f0b00f28663c805e9 EAP-Message = 0x5030df44439795b29b56b6def7f4bd0fe42dd3cd1403010001011603010030ed9db0209ea11578554dcfefafac72a829471e5db3c9feee31f24b20fe493b94c46ceb741fe075290a04326d0ef69d87 State = 0x5547a69c5643b3319371950f23751f07 Message-Authenticator = 0xe2c8c94ea046c5067dbba80d54abd56a Sending Access-Challenge of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 EAP-Message = 0x0105004515800000003b1403010001011603010030cf3496d880a56ab898975f792c2fdef629f79da719647dc1029ee716a5fa8a867c8eed4b7b91376cc2cf5b4af226419d Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5547a69c5142b3319371950f23751f07 User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x0205003b15001703010030a4af959ed2d484f2c45b000995ea7a041f5001e1da0cf44c8ee06d555efe12c20ba7ea91a735bd88b709803eff3596cc State = 0x5547a69c5142b3319371950f23751f07 Message-Authenticator = 0x8b573629de542e890c5a41bc62ca7f8d EAP-Message = 0x02000010017374657665406c6f63616c FreeRADIUS-Proxied-To = 127.0.0.1 (5) ttls : Got tunneled identity of steve@local (5) ttls : Setting default EAP type for tunneled EAP session. (5) ttls : Sending tunneled request EAP-Message = 0x02000010017374657665406c6f63616c FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "steve@local" (5) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (5) group authorize { (5) - entering group authorize {...} (5) [chap] = noop (5) [mschap] = noop (5) suffix : Looking up realm "local" for User-Name = "steve@local" (5) suffix : Found realm "LOCAL" (5) suffix : Adding Stripped-User-Name = "steve" (5) suffix : Adding Realm = "LOCAL" (5) suffix : Authentication realm is LOCAL. (5) [suffix] = ok (5) update control { (5) } # update control = ok (5) eap : EAP packet type response id 0 length 16 (5) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (5) [eap] = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (5) group authenticate { (5) - entering group authenticate {...} (5) eap : EAP Identity (5) eap : processing type md5 rlm_eap_md5: Issuing Challenge (5) eap : New EAP session, adding 'State' attribute to reply 0x784c0f04784d0b4a (5) [eap] = handled (5) ttls : Got tunneled reply code 11 server inner-tunnel { } # server inner-tunnel EAP-Message = 0x010100160410b939bb8dae2fd97f9e6307eea70e4398 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x784c0f04784d0b4abb8299b1e3c275ed (5) ttls : Got tunneled Access-Challenge (5) eap : New EAP session, adding 'State' attribute to reply 0x5547a69c5041b331 (5) [eap] = handled (5) Finished request 5. Thread 5 waiting to be assigned a request (0) Application data status 7 (0) tls_recv: Access-Request packet from host 127.0.0.1 port 35521, id=0, length=158 (5) Cleaning up request packet ID 0 with timestamp +10 Waking up in 0.2 seconds. Thread 4 got semaphore Thread 4 handling request 6, (2 handled so far) (6) <thread> : # Executing section authorize from file /etc/freeradius/sites-enabled/default (6) <thread> : group authorize { (6) <thread> : - entering group authorize {...} (6) <thread> : policy filter_username { (6) <thread> : - entering policy filter_username {...} (6) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") (6) <thread> : expand: '%{User-Name}' -> '@local' (6) <thread> : expand: '%{tolower:%{User-Name}}' -> '@local' (6) <thread> : ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE (6) <thread> : ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (6) <thread> : ? if (User-Name =~ / /) (6) <thread> : ? Evaluating (User-Name =~ / /) -> FALSE (6) <thread> : ? if (User-Name =~ / /) -> FALSE (6) <thread> : ? if (User-Name =~ /@.*@/ ) (6) <thread> : ? Evaluating (User-Name =~ /@.*@/) -> FALSE (6) <thread> : ? if (User-Name =~ /@.*@/ ) -> FALSE (6) <thread> : ? if (User-Name =~ /\\.\\./ ) (6) <thread> : ? Evaluating (User-Name =~ /\\.\\./) -> FALSE (6) <thread> : ? if (User-Name =~ /\\.\\./ ) -> FALSE (6) <thread> : ? if (User-Name =~ /\\.$/) (6) <thread> : ? Evaluating (User-Name =~ /\\.$/) -> FALSE (6) <thread> : ? if (User-Name =~ /\\.$/) -> FALSE (6) <thread> : ? if (User-Name =~ /(a)\\./) (6) <thread> : ? Evaluating (User-Name =~ /(a)\\./) -> FALSE (6) <thread> : ? if (User-Name =~ /(a)\\./) -> FALSE (6) <thread> : - policy filter_username returns notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : Looking up realm "local" for User-Name = "@local" (6) suffix : Found realm "LOCAL" (6) suffix : Adding Stripped-User-Name = "" (6) suffix : Adding Realm = "LOCAL" (6) suffix : Authentication realm is LOCAL. (6) [suffix] = ok (6) eap : EAP packet type response id 6 length 75 (6) eap : Continuing tunnel setup. (6) [eap] = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) group authenticate { (6) - entering group authenticate {...} (6) eap : Expiring EAP session with state 0x784c0f04784d0b4a (6) eap : Finished EAP session with state 0x5547a69c5041b331 (6) eap : Previous EAP request found for state 0x5547a69c5041b331, released from the list (6) eap : EAP/ttls (6) eap : processing type ttls (6) ttls : Authenticate (6) ttls : processing EAP-TLS (6) ttls : eaptls_verify returned 7 (6) ttls : Done initial handshake (6) ttls : eaptls_process returned 7 (6) ttls : Session established. Proceeding to decode tunneled attributes. (6) ttls : Got tunneled request Sending Access-Challenge of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 EAP-Message = 0x0106004f15800000004517030100409264112c179a134cd880bff6c5d6929b98b33d975c659e8563c9f4123d6b9cc16d3b97a075f776b6a9e68b564f555be43b8ab55dc6d06de6dec516365118b861 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5547a69c5041b3319371950f23751f07 User-Name = "@local" Attr-164 = 0x677373 Attr-165 = 0x6d6f6f6e73686f747063 EAP-Message = 0x0206004b15001703010040c4b8acddaf7709767af14b6857f12552b95cac3327fb74e156c354f9958d160035b003e43dded3cbc2e87d3b886361c44785960685fb1373dc363b075044d365 State = 0x5547a69c5041b3319371950f23751f07 Message-Authenticator = 0x7a3f61592c1ddbe896aeeb2e987d1bd8 EAP-Message = 0x020100160410ec392501be988e8997d5f9d6672da988 FreeRADIUS-Proxied-To = 127.0.0.1 (6) ttls : Sending tunneled request EAP-Message = 0x020100160410ec392501be988e8997d5f9d6672da988 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "steve@local" State = 0x784c0f04784d0b4abb8299b1e3c275ed (6) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (6) group authorize { (6) - entering group authorize {...} (6) [chap] = noop (6) [mschap] = noop (6) suffix : Looking up realm "local" for User-Name = "steve@local" (6) suffix : Found realm "LOCAL" (6) suffix : Adding Stripped-User-Name = "steve" (6) suffix : Adding Realm = "LOCAL" (6) suffix : Authentication realm is LOCAL. (6) [suffix] = ok (6) update control { (6) } # update control = ok (6) eap : EAP packet type response id 1 length 22 (6) eap : No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated (6) files : users: Matched entry steve at line 76 (6) [files] = ok (6) [expiration] = noop (6) [logintime] = noop (6) WARNING: pap : Auth-Type already set. Not setting to PAP (6) [pap] = noop (6) Found Auth-Type = EAP (6) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (6) group authenticate { (6) - entering group authenticate {...} (6) eap : Expiring EAP session with state 0x784c0f04784d0b4a (6) eap : Finished EAP session with state 0x784c0f04784d0b4a (6) eap : Previous EAP request found for state 0x784c0f04784d0b4a, released from the list (6) eap : EAP/md5 (6) eap : processing type md5 (6) eap : Freeing handler (6) [eap] = ok (6) WARNING: Empty post-auth section. Using default return values. (6) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (6) ttls : Got tunneled reply code 2 server inner-tunnel { } # server inner-tunnel EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "steve" (6) ttls : Got tunneled Access-Accept (6) ttls : Saving session 68c663d2584e6ad5c297c0b4a0abaf1d9cf417fda2bb4abb885001ca535288de vps 0xa0e6c40 in the cache (6) eap : Freeing handler rlm_eap_ttls: Freeing handler for user steve@local (6) [eap] = ok (6) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (6) group post-auth { (6) - entering group post-auth {...} (6) update reply { (6) } # update reply = noop (6) [exec] = noop (6) policy remove_reply_message_if_eap { (6) - entering policy remove_reply_message_if_eap {...} (6) ? if (reply:EAP-Message && reply:Reply-Message) (6) ? Evaluating (reply:EAP-Message ) -> TRUE (6) ? Evaluating (reply:Reply-Message) -> FALSE (6) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (6) else else { (6) - entering else else {...} (6) [noop] = noop (6) - else else returns noop (6) - policy remove_reply_message_if_eap returns noop Sending Access-Accept of id 0 from 0.0.0.0 port 2083 to 127.0.0.1 port 35521 MS-MPPE-Recv-Key = 0x13232a1746a4113151339205bd2aa4224b2385cd8dcb98bb115b23d3448aa09b MS-MPPE-Send-Key = 0x905ca07a796a6acf044a0d0642e2eb8d78fad0650cc1c56ab3c4b51bdd970d85 Attr-26.6.122.4 = 0x1552714f7bcd9d2ea5d160057846af3c7e070bce5fc18925544d4f4e3aff4f43f552714f7b3f2e08219fdc96ec7bfbde0a4f9ed0e45054a702692e2619de46769d EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "" WARNING: Skipping zero-length attribute User-Name SAML-AAA-Assertion = "<saml:Assertion xmlns:saml=\"urn:oasis:names:tc:SAML:2.0:assertion\" IssueInstant=\"2011-04-19T08:30:00Z\" ID=\"foo3\" Version=\"2.0\">" SAML-AAA-Assertion = "<saml:Issuer>urn:mace:incommon:osu.edu</saml:Issuer>" SAML-AAA-Assertion = "<saml:AttributeStatement>" SAML-AAA-Assertion = "<saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"urn:oid:1.3.6.1.4.1.5923.1.1.1.6\"><saml:AttributeValue>steve@local</saml:AttributeValue></saml:Attribute>" SAML-AAA-Assertion = "<saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"urn:oid:1.3.6.1.4.1.5923.1.1.1.7\"><saml:AttributeValue>moonshot</saml:AttributeValue></saml:Attribute>" SAML-AAA-Assertion = "</saml:AttributeStatement>" SAML-AAA-Assertion = "<saml:AttributeStatement>" SAML-AAA-Assertion = "<saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"http://some.url.testing.cert\"><saml:AttributeValue>" SAML-AAA-Assertion = "-----BEGIN CERTIFICATE-----" SAML-AAA-Assertion = "MIIDkzCCAnugAwIBAgIBEjANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDWjEl" SAML-AAA-Assertion = "MCMGA1UECgwcTW9vbnNob3QgdGVzdGluZyBkZWxlZ2F0aW9uczEbMBkGA1UEAwwS" SAML-AAA-Assertion = "TW9vbnNob3QgTWFydmVsIENBMB4XDTEzMTAzMDEwMTYyNVoXDTIzMTAyODEwMTYy" SAML-AAA-Assertion = "NVowTDELMAkGA1UEBhMCQ1oxJTAjBgNVBAoMHE1vb25zaG90IHRlc3RpbmcgZGVs" SAML-AAA-Assertion = "ZWdhdGlvbnMxFjAUBgNVBAMMDXRlc3RpbmcgdXNlcjIwggEiMA0GCSqGSIb3DQEB" SAML-AAA-Assertion = "AQUAA4IBDwAwggEKAoIBAQC1RPpEyWts7MWXmIRfhZjbjwmLeEShf7P+/+0ryBgJ" SAML-AAA-Assertion = "ptw5BHYbdsZkdVOGnTs/FmuZLYd9UbF//pgQCaPWc5952uRbijPYWwFWlFS7pn2k" SAML-AAA-Assertion = "LTvTTsCEvxUA33J1iE9ZDSHevaChpa2V8y2sBG3pu8z1K9qxQ87eJ4/jEkBSElvp" SAML-AAA-Assertion = "clfBZ+3O4lMQ2gPMzunMFVcPEdbrPGlYIoEVEe2XZarbubvntTLMV5mlKDjN2XTB" SAML-AAA-Assertion = "0SCyoovUgPiNBJ9KiYGIiP4tRtSiZRA5KjI6/nbPC2MDv7aFqeidPba/rUX2ba2E" SAML-AAA-Assertion = "4C1CGL/uO0QSxgCwTNdXVMZ0ej5SzhBFHrmwzWvVpwWTAgMBAAGjezB5MAkGA1Ud" SAML-AAA-Assertion = "EwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmlj" SAML-AAA-Assertion = "YXRlMB0GA1UdDgQWBBRUc95gdP0zoU4KeP34y7KoIn/WHjAfBgNVHSMEGDAWgBQK" SAML-AAA-Assertion = "Cjk66p5IbJNBXKfu/loXUSeFhDANBgkqhkiG9w0BAQUFAAOCAQEAfzvKUpbxiWlz" SAML-AAA-Assertion = "/xsofv8CsmGfn+WwZ6EDh0YHkv6wFxzDV8QcJgqQPlmpAzaNNnW98QxpQ7VwyLaN" SAML-AAA-Assertion = "F5+gf7Qpoyo2dn7DvF+tOQ3LQkbbIwhfNGWm9rLYkABbtTNvS8laK/+mY6pqnque" SAML-AAA-Assertion = "pSSRZ+MosFwS+C1RsdjaFTW9nE4UDnhutEAktg6k82V9HwS+nCakHidDumI2vCh5" SAML-AAA-Assertion = "ijiNSnITrorvmH10s0qhGXVizem5C4gLA5qwD1g3KxwvqP734BDg19n96P7jBkkV" SAML-AAA-Assertion = "+e7Iz9+SgE1piniM3M9h5jhqfllZ2ztDh2HmuYRzXGtu6KkD607Yjz7SKfCL/S5U" SAML-AAA-Assertion = "FUstGvd2aQ==" SAML-AAA-Assertion = "-----END CERTIFICATE-----" SAML-AAA-Assertion = "</saml:AttributeValue></saml:Attribute></saml:AttributeStatement>" SAML-AAA-Assertion = "<saml:AttributeStatement>" SAML-AAA-Assertion = "<saml:Attribute NameFormat=\"urn:oasis:names:tc:SAML:2.0:attrname-format:uri\" Name=\"http://some.url.testing.key\"><saml:AttributeValue>" SAML-AAA-Assertion = "-----BEGIN PRIVATE KEY-----" SAML-AAA-Assertion = "MIIDkzCCAnugAwIBAgIBEjANBgkqhkiG9w0BAQUFADBRMQswCQYDVQQGEwJDWjEl" SAML-AAA-Assertion = "MCMGA1UECgwcTW9vbnNob3QgdGVzdGluZyBkZWxlZ2F0aW9uczEbMBkGA1UEAwwS" SAML-AAA-Assertion = "TW9vbnNob3QgTWFydmVsIENBMB4XDTEzMTAzMDEwMTYyNVoXDTIzMTAyODEwMTYy" SAML-AAA-Assertion = "NVowTDELMAkGA1UEBhMCQ1oxJTAjBgNVBAoMHE1vb25zaG90IHRlc3RpbmcgZGVs" SAML-AAA-Assertion = "ZWdhdGlvbnMxFjAUBgNVBAMMDXRlc3RpbmcgdXNlcjIwggEiMA0GCSqGSIb3DQEB" SAML-AAA-Assertion = "AQUAA4IBDwAwggEKAoIBAQC1RPpEyWts7MWXmIRfhZjbjwmLeEShf7P+/+0ryBgJ" SAML-AAA-Assertion = "ptw5BHYbdsZkdVOGnTs/FmuZLYd9UbF//pgQCaPWc5952uRbijPYWwFWlFS7pn2k" SAML-AAA-Assertion = "LTvTTsCEvxUA33J1iE9ZDSHevaChpa2V8y2sBG3pu8z1K9qxQ87eJ4/jEkBSElvp" SAML-AAA-Assertion = "clfBZ+3O4lMQ2gPMzunMFVcPEdbrPGlYIoEVEe2XZarbubvntTLMV5mlKDjN2XTB" SAML-AAA-Assertion = "0SCyoovUgPiNBJ9KiYGIiP4tRtSiZRA5KjI6/nbPC2MDv7aFqeidPba/rUX2ba2E" SAML-AAA-Assertion = "4C1CGL/uO0QSxgCwTNdXVMZ0ej5SzhBFHrmwzWvVpwWTAgMBAAGjezB5MAkGA1Ud" SAML-AAA-Assertion = "EwQCMAAwLAYJYIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmlj" SAML-AAA-Assertion = "YXRlMB0GA1UdDgQWBBRUc95gdP0zoU4KeP34y7KoIn/WHjAfBgNVHSMEGDAWgBQK" SAML-AAA-Assertion = "Cjk66p5IbJNBXKfu/loXUSeFhDANBgkqhkiG9w0BAQUFAAOCAQEAfzvKUpbxiWlz" SAML-AAA-Assertion = "/xsofv8CsmGfn+WwZ6EDh0YHkv6wFxzDV8QcJgqQPlmpAzaNNnW98QxpQ7VwyLaN" SAML-AAA-Assertion = "F5+gf7Qpoyo2dn7DvF+tOQ3LQkbbIwhfNGWm9rLYkABbtTNvS8laK/+mY6pqnque" SAML-AAA-Assertion = "pSSRZ+MosFwS+C1RsdjaFTW9nE4UDnhutEAktg6k82V9HwS+nCakHidDumI2vCh5" SAML-AAA-Assertion = "ijiNSnITrorvmH10s0qhGXVizem5C4gLA5qwD1g3KxwvqP734BDg19n96P7jBkkV" WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion WARNING: Failed encoding attribute SAML-AAA-Assertion -- This e-mail and any attachments may contain confidential, copyright and or privileged material, and are for the use of the intended addressee only. If you are not the intended addressee or an authorised recipient of the addressee please notify us of receipt by returning the e-mail and do not use, copy, retain, distribute or disclose the information in or attached to the e-mail. Any opinions expressed within this e-mail are those of the individual and not necessarily of Diamond Light Source Ltd. Diamond Light Source Ltd. cannot guarantee that this e-mail or any attachments are free from viruses and we cannot accept liability for any damage which you may sustain as a result of software viruses which may be transmitted in or with the message. Diamond Light Source Limited (company no. 4375679). Registered in England and Wales with its registered office at Diamond House, Harwell Science and Innovation Campus, Didcot, Oxfordshire, OX11 0DE, United Kingdom

2 2

freeradius 3 sqlcounter not expanding and executing sql query
by Heinz Ketchup 01 Nov '13

01 Nov '13

Hi all, a big thanks to all developers for freeradius 3! Having successfully set it up with mysql, I try hard to get sqlcouter going. It is always returning 'noop' because the configured query is not being expanded and executed: the only one entry in sqlcounter.conf: sqlcounter expire_on_firstuse { sql_module_instance = sql counter_name = Expire-After-Initial-Login check_name = Expire-After reply_name = Session-Timeout key = User-Name reset = never query = "SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='%{${key}}' ORDER BY acctstarttime LIMIT 1" } dictionary.local: ATTRIBUTE Expire-After 3004 integer debug output: (0) expire_on_firstuse : Entering module authorize code (0) expire_on_firstuse : expand: "%{sql:%{sql:}" -> '' (0) expire_on_firstuse : No integer found in string "" (0) [expire_on_firstuse] = noop should look like: (0) expire_on_firstuse : expand: "%{sql:SELECT TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime)) FROM radacct WHERE UserName='testuser' ORDER BY acctstarttime LIMIT 1" -> '1234' The query from the configfile with a correct username works as expected at the mysql console and returns an integer. Any ideas what is going wrong??? Thanks and Regards, Heinz

2 3