November 2015 - Freeradius-Users - lists.freeradius.org

Help with EAP-TTLS and PAP
by Hans Hering 23 Nov '15

23 Nov '15

Hey,I know this gets asked a lot and I spent quite a while searching for my use case, but I couldn't find anything that helped me.First a little bit about my setup:We have a Sun DS with salted SHA1 passwords, freeradius 3.0.10, Aruba IAP-225 access points and Windows and OS X clients.My goal is having the users log on to the WPA2 Enterprise wifi with their LDAP credentials and no client configuration whatsoever. This means I don't want to install network profiles on the Macs and no EAP-GTC plugins on the Windows machines.From what I've read, this should be possible with EAP-TTLS and inner PAP, as PAP can work with salted SHA1 passwords. However, in all the setup guides I looked at, it said the eap module should use default_eap_type = ttls in the outer section and default_eap_type = md5 in the ttls section and then PAP should be used. I verified PAP is working and if I use EAP-TTLS with inner EAP-GTC my Macs can logon just fine.So my question is now: what am I doing wrong? Is inner EAP-MD5 correct? Is what I'm trying to do even possible?Any help is greatly appreciated!Below the debug output of EAP-TTLS with inner EAP-MD5:Copyright (C) 1999-2015 The FreeRADIUS server project and contributorsThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR APARTICULAR PURPOSEYou may redistribute copies of FreeRADIUS under the terms of theGNU General Public LicenseFor more information about these matters, see the file named COPYRIGHTStarting - reading configuration files ...including dictionary file /usr/share/freeradius/dictionaryincluding dictionary file /usr/share/freeradius/dictionary.dhcpincluding dictionary file /usr/share/freeradius/dictionary.vqpincluding dictionary file /etc/freeradius/dictionaryincluding configuration file /etc/freeradius/radiusd.confincluding configuration file /etc/freeradius/proxy.confincluding configuration file /etc/freeradius/clients.confincluding files in directory /etc/freeradius/mods-enabled/including configuration file /etc/freeradius/mods-enabled/expirationincluding configuration file /etc/freeradius/mods-enabled/dynamic_clientsincluding configuration file /etc/freeradius/mods-enabled/digestincluding configuration file /etc/freeradius/mods-enabled/attr_filterincluding configuration file /etc/freeradius/mods-enabled/utf8including configuration file /etc/freeradius/mods-enabled/preprocessincluding configuration file /etc/freeradius/mods-enabled/linelogincluding configuration file /etc/freeradius/mods-enabled/alwaysincluding configuration file /etc/freeradius/mods-enabled/eapincluding configuration file /etc/freeradius/mods-enabled/mschapincluding configuration file /etc/freeradius/mods-enabled/unpackincluding configuration file /etc/freeradius/mods-enabled/ntlm_authincluding configuration file /etc/freeradius/mods-enabled/radutmpincluding configuration file /etc/freeradius/mods-enabled/detail.logincluding configuration file /etc/freeradius/mods-enabled/sohincluding configuration file /etc/freeradius/mods-enabled/detailincluding configuration file /etc/freeradius/mods-enabled/unixincluding configuration file /etc/freeradius/mods-enabled/papincluding configuration file /etc/freeradius/mods-enabled/chapincluding configuration file /etc/freeradius/mods-enabled/logintimeincluding configuration file /etc/freeradius/mods-enabled/realmincluding configuration file /etc/freeradius/mods-enabled/sradutmpincluding configuration file /etc/freeradius/mods-enabled/filesincluding configuration file /etc/freeradius/mods-enabled/ldapincluding configuration file /etc/freeradius/mods-enabled/echoincluding configuration file /etc/freeradius/mods-enabled/cache_eapincluding configuration file /etc/freeradius/mods-enabled/exprincluding configuration file /etc/freeradius/mods-enabled/execincluding configuration file /etc/freeradius/mods-enabled/replicateincluding configuration file /etc/freeradius/mods-enabled/passwdincluding files in directory /etc/freeradius/policy.d/including configuration file /etc/freeradius/policy.d/abfab-trincluding configuration file /etc/freeradius/policy.d/eapincluding configuration file /etc/freeradius/policy.d/operator-nameincluding configuration file /etc/freeradius/policy.d/controlincluding configuration file /etc/freeradius/policy.d/canonicalizationincluding configuration file /etc/freeradius/policy.d/filterincluding configuration file /etc/freeradius/policy.d/debugincluding configuration file /etc/freeradius/policy.d/cuiincluding configuration file /etc/freeradius/policy.d/dhcpincluding configuration file /etc/freeradius/policy.d/accountingincluding files in directory /etc/freeradius/sites-enabled/including configuration file /etc/freeradius/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/sites-enabled/defaultmain { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius"}main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client <ip> { require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } }No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client <ip>. Please fix your configurationSupport for old-style clients will be removed in a future releaseDebugger not attached # Creating Auth-Type = digestradiusd: #### Instantiating modules #### # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" }Creating attribute Unix-Group # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "ldaps://<url>" port = 636 identity = "uid=xxx,ou=xxx,dc=xxx,dc=xxx" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "isMemberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=xxx,dc=xxx" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no require_cert = "never" } }Creating attribute LDAP-Group # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } instantiate { } modules { # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject[/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocessreading pairlist file /etc/freeradius/mods-config/preprocess/huntgroupsreading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschaprlm_mschap (mschap): using internal authentication # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.logrlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/mods-enabled/filesreading pairlist file /etc/freeradius/mods-config/files/authorizereading pairlist file /etc/freeradius/mods-config/files/accountingreading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldaprlm_ldap: libldap vendor: OpenLDAP, version: 20431 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." }rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no }rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eaprlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwdrlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/freeradius/radiusd.conf} # serverserver inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}Ignoring "sql" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...}} # server inner-tunnelserver default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...}} # server defaultradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnelListening on auth address * port 1812 bound to server defaultListening on acct address * port 1813 bound to server defaultListening on auth address :: port 1812 bound to server defaultListening on acct address :: port 1813 bound to server defaultListening on proxy address * port 53683Listening on proxy address :: port 41662Ready to process requests(0) Received Access-Request Id 67 from <ip>:59898 to <ip>:1812 length 201(0) User-Name = "hans.hering"(0) NAS-IP-Address = <ip>(0) NAS-Port = 0(0) NAS-Identifier = "<ip>"(0) NAS-Port-Type = Wireless-802.11(0) Calling-Station-Id = "4400100e904c"(0) Called-Station-Id = "186472cd167a"(0) Service-Type = Login-User(0) Framed-MTU = 1100(0) EAP-Message = 0x020100100168616e732e686572696e67(0) Aruba-Essid-Name = "<ssid>"(0) Aruba-Location-Id = "<apname>"(0) Aruba-AP-Group = "<apname>"(0) Message-Authenticator = 0x4cb828b841364e2b93bf7cd49d37cd93(0) # Executing section authorize from file /etc/freeradius/sites-enabled/default(0) authorize {(0) policy filter_username {(0) if (!&User-Name) {(0) if (!&User-Name) -> FALSE(0) if (&User-Name =~ / /) {(0) if (&User-Name =~ / /) -> FALSE(0) if (&User-Name =~ /@.*@/ ) {(0) if (&User-Name =~ /@.*@/ ) -> FALSE(0) if (&User-Name =~ /\.\./ ) {(0) if (&User-Name =~ /\.\./ ) -> FALSE(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(0) if (&User-Name =~ /\.$/) {(0) if (&User-Name =~ /\.$/) -> FALSE(0) if (&User-Name =~ /(a)\./) {(0) if (&User-Name =~ /(a)\./) -> FALSE(0) } # policy filter_username = notfound(0) [preprocess] = ok(0) [chap] = noop(0) [mschap] = noop(0) [digest] = noop(0) suffix: Checking for suffix after "@"(0) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(0) suffix: No such realm "NULL"(0) [suffix] = noop(0) eap: Peer sent EAP Response (code 2) ID 1 length 16(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize(0) [eap] = ok(0) } # authorize = ok(0) Found Auth-Type = EAP(0) # Executing group from file /etc/freeradius/sites-enabled/default(0) authenticate {(0) eap: Peer sent packet with method EAP Identity (1)(0) eap: Calling submodule eap_ttls to process data(0) eap_ttls: Initiating new EAP-TLS session(0) eap_ttls: Flushing SSL sessions (of #0)(0) eap_ttls: [eaptls start] = request(0) eap: Sending EAP Request (code 1) ID 2 length 6(0) eap: EAP session adding &reply:State = 0x8aa7dbf48aa5ce2f(0) [eap] = handled(0) } # authenticate = handled(0) Using Post-Auth-Type Challenge(0) Post-Auth-Type sub-section not found. Ignoring.(0) # Executing group from file /etc/freeradius/sites-enabled/default(0) Sent Access-Challenge Id 67 from <ip>:1812 to <ip>:59898 length 0(0) EAP-Message = 0x010200061520(0) Message-Authenticator = 0x00000000000000000000000000000000(0) State = 0x8aa7dbf48aa5ce2f8993e0490c51278d(0) Finished requestWaking up in 4.9 seconds.(1) Received Access-Request Id 68 from <ip>:59898 to <ip>:1812 length 346(1) User-Name = "hans.hering"(1) NAS-IP-Address = <ip>(1) NAS-Port = 0(1) NAS-Identifier = "<ip>"(1) NAS-Port-Type = Wireless-802.11(1) Calling-Station-Id = "4400100e904c"(1) Called-Station-Id = "186472cd167a"(1) Service-Type = Login-User(1) Framed-MTU = 1100(1) EAP-Message = 0x0202008f15800000008516030100800100007c03015652d246ab03a55f379e0aba7bb683d2d8dbcc4d28270098815788bf8fbde73b00003400ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000ac007c011000500040100001f000a0008000600(1) State = 0x8aa7dbf48aa5ce2f8993e0490c51278d(1) Aruba-Essid-Name = "<ssid>"(1) Aruba-Location-Id = "<apname>"(1) Aruba-AP-Group = "<apname>"(1) Message-Authenticator = 0xa5b6bb20d994d289ff9bb012b9f6de16(1) session-state: No cached attributes(1) # Executing section authorize from file /etc/freeradius/sites-enabled/default(1) authorize {(1) policy filter_username {(1) if (!&User-Name) {(1) if (!&User-Name) -> FALSE(1) if (&User-Name =~ / /) {(1) if (&User-Name =~ / /) -> FALSE(1) if (&User-Name =~ /@.*@/ ) {(1) if (&User-Name =~ /@.*@/ ) -> FALSE(1) if (&User-Name =~ /\.\./ ) {(1) if (&User-Name =~ /\.\./ ) -> FALSE(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(1) if (&User-Name =~ /\.$/) {(1) if (&User-Name =~ /\.$/) -> FALSE(1) if (&User-Name =~ /(a)\./) {(1) if (&User-Name =~ /(a)\./) -> FALSE(1) } # policy filter_username = notfound(1) [preprocess] = ok(1) [chap] = noop(1) [mschap] = noop(1) [digest] = noop(1) suffix: Checking for suffix after "@"(1) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(1) suffix: No such realm "NULL"(1) [suffix] = noop(1) eap: Peer sent EAP Response (code 2) ID 2 length 143(1) eap: Continuing tunnel setup(1) [eap] = ok(1) } # authorize = ok(1) Found Auth-Type = EAP(1) # Executing group from file /etc/freeradius/sites-enabled/default(1) authenticate {(1) eap: Expiring EAP session with state 0x8aa7dbf48aa5ce2f(1) eap: Finished EAP session with state 0x8aa7dbf48aa5ce2f(1) eap: Previous EAP request found for state 0x8aa7dbf48aa5ce2f, released from the list(1) eap: Peer sent packet with method EAP TTLS (21)(1) eap: Calling submodule eap_ttls to process data(1) eap_ttls: Authenticate(1) eap_ttls: Continuing EAP-TLS(1) eap_ttls: Peer indicated complete TLS record size will be 133 bytes(1) eap_ttls: Got complete TLS record (133 bytes)(1) eap_ttls: [eaptls verify] = length included(1) eap_ttls: (other): before/accept initialization(1) eap_ttls: TLS_accept: before/accept initialization(1) eap_ttls: <<< TLS 1.0 Handshake [length 0080], ClientHello (1) eap_ttls: TLS_accept: SSLv3 read client hello A(1) eap_ttls: >>> TLS 1.0 Handshake [length 0059], ServerHello (1) eap_ttls: TLS_accept: SSLv3 write server hello A(1) eap_ttls: >>> TLS 1.0 Handshake [length 08d3], Certificate (1) eap_ttls: TLS_accept: SSLv3 write certificate A(1) eap_ttls: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (1) eap_ttls: TLS_accept: SSLv3 write key exchange A(1) eap_ttls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_ttls: TLS_accept: SSLv3 write server done A(1) eap_ttls: TLS_accept: SSLv3 flush data(1) eap_ttls: TLS_accept: Need to read more data: SSLv3 read client certificate A(1) eap_ttls: TLS_accept: Need to read more data: SSLv3 read client certificate A(1) eap_ttls: In SSL Handshake Phase(1) eap_ttls: In SSL Accept mode(1) eap_ttls: [eaptls process] = handled(1) eap: Sending EAP Request (code 1) ID 3 length 1004(1) eap: EAP session adding &reply:State = 0x8aa7dbf48ba4ce2f(1) [eap] = handled(1) } # authenticate = handled(1) Using Post-Auth-Type Challenge(1) Post-Auth-Type sub-section not found. Ignoring.(1) # Executing group from file /etc/freeradius/sites-enabled/default(1) Sent Access-Challenge Id 68 from <ip>:1812 to <ip>:59898 length 0(1) EAP-Message = 0x010303ec15c000000a8f16030100590200005503011f5637fc9907abb382f150b602d77e2cac29c21821752b2155fc5cb32e35fbdb20fb97b440265d98e05f08c2cb560622317f8389869d8117036e6e371dcfbf81d5c01400000dff01000100000b00040300010216030108d30b0008cf0008cc0003de(1) Message-Authenticator = 0x00000000000000000000000000000000(1) State = 0x8aa7dbf48ba4ce2f8993e0490c51278d(1) Finished requestWaking up in 4.9 seconds.(2) Received Access-Request Id 69 from <ip>:59898 to <ip>:1812 length 209(2) User-Name = "hans.hering"(2) NAS-IP-Address = <ip>(2) NAS-Port = 0(2) NAS-Identifier = "<ip>"(2) NAS-Port-Type = Wireless-802.11(2) Calling-Station-Id = "4400100e904c"(2) Called-Station-Id = "186472cd167a"(2) Service-Type = Login-User(2) Framed-MTU = 1100(2) EAP-Message = 0x020300061500(2) State = 0x8aa7dbf48ba4ce2f8993e0490c51278d(2) Aruba-Essid-Name = "<ssid>"(2) Aruba-Location-Id = "<apname>"(2) Aruba-AP-Group = "<apname>"(2) Message-Authenticator = 0x4ae0edce92e6af687df75c1ec8123562(2) session-state: No cached attributes(2) # Executing section authorize from file /etc/freeradius/sites-enabled/default(2) authorize {(2) policy filter_username {(2) if (!&User-Name) {(2) if (!&User-Name) -> FALSE(2) if (&User-Name =~ / /) {(2) if (&User-Name =~ / /) -> FALSE(2) if (&User-Name =~ /@.*@/ ) {(2) if (&User-Name =~ /@.*@/ ) -> FALSE(2) if (&User-Name =~ /\.\./ ) {(2) if (&User-Name =~ /\.\./ ) -> FALSE(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(2) if (&User-Name =~ /\.$/) {(2) if (&User-Name =~ /\.$/) -> FALSE(2) if (&User-Name =~ /(a)\./) {(2) if (&User-Name =~ /(a)\./) -> FALSE(2) } # policy filter_username = notfound(2) [preprocess] = ok(2) [chap] = noop(2) [mschap] = noop(2) [digest] = noop(2) suffix: Checking for suffix after "@"(2) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(2) suffix: No such realm "NULL"(2) [suffix] = noop(2) eap: Peer sent EAP Response (code 2) ID 3 length 6(2) eap: Continuing tunnel setup(2) [eap] = ok(2) } # authorize = ok(2) Found Auth-Type = EAP(2) # Executing group from file /etc/freeradius/sites-enabled/default(2) authenticate {(2) eap: Expiring EAP session with state 0x8aa7dbf48ba4ce2f(2) eap: Finished EAP session with state 0x8aa7dbf48ba4ce2f(2) eap: Previous EAP request found for state 0x8aa7dbf48ba4ce2f, released from the list(2) eap: Peer sent packet with method EAP TTLS (21)(2) eap: Calling submodule eap_ttls to process data(2) eap_ttls: Authenticate(2) eap_ttls: Continuing EAP-TLS(2) eap_ttls: Peer ACKed our handshake fragment(2) eap_ttls: [eaptls verify] = request(2) eap_ttls: [eaptls process] = handled(2) eap: Sending EAP Request (code 1) ID 4 length 1004(2) eap: EAP session adding &reply:State = 0x8aa7dbf488a3ce2f(2) [eap] = handled(2) } # authenticate = handled(2) Using Post-Auth-Type Challenge(2) Post-Auth-Type sub-section not found. Ignoring.(2) # Executing group from file /etc/freeradius/sites-enabled/default(2) Sent Access-Challenge Id 69 from <ip>:1812 to <ip>:59898 length 0(2) EAP-Message = 0x010403ec15c000000a8fdd874ace35d935909eb41f076af54637807355b0c44328651be631d0fac4d2c6e81f9c4b8c711b5bb5dc1da68ec9f28dd8ebb18ee0bb6f63cff5d2b1c22fe1408af1ce00ae298e0c0151ac505915f8aaec5535d093ec63ad9ddc05e9ae8b8ba4442133a51318f8c3b90004e830(2) Message-Authenticator = 0x00000000000000000000000000000000(2) State = 0x8aa7dbf488a3ce2f8993e0490c51278d(2) Finished requestWaking up in 4.9 seconds.(3) Received Access-Request Id 70 from <ip>:59898 to <ip>:1812 length 209(3) User-Name = "hans.hering"(3) NAS-IP-Address = <ip>(3) NAS-Port = 0(3) NAS-Identifier = "<ip>"(3) NAS-Port-Type = Wireless-802.11(3) Calling-Station-Id = "4400100e904c"(3) Called-Station-Id = "186472cd167a"(3) Service-Type = Login-User(3) Framed-MTU = 1100(3) EAP-Message = 0x020400061500(3) State = 0x8aa7dbf488a3ce2f8993e0490c51278d(3) Aruba-Essid-Name = "<ssid>"(3) Aruba-Location-Id = "<apname>"(3) Aruba-AP-Group = "<apname>"(3) Message-Authenticator = 0xac0e164f6b96849c48af9d3908b63255(3) session-state: No cached attributes(3) # Executing section authorize from file /etc/freeradius/sites-enabled/default(3) authorize {(3) policy filter_username {(3) if (!&User-Name) {(3) if (!&User-Name) -> FALSE(3) if (&User-Name =~ / /) {(3) if (&User-Name =~ / /) -> FALSE(3) if (&User-Name =~ /@.*@/ ) {(3) if (&User-Name =~ /@.*@/ ) -> FALSE(3) if (&User-Name =~ /\.\./ ) {(3) if (&User-Name =~ /\.\./ ) -> FALSE(3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(3) if (&User-Name =~ /\.$/) {(3) if (&User-Name =~ /\.$/) -> FALSE(3) if (&User-Name =~ /(a)\./) {(3) if (&User-Name =~ /(a)\./) -> FALSE(3) } # policy filter_username = notfound(3) [preprocess] = ok(3) [chap] = noop(3) [mschap] = noop(3) [digest] = noop(3) suffix: Checking for suffix after "@"(3) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(3) suffix: No such realm "NULL"(3) [suffix] = noop(3) eap: Peer sent EAP Response (code 2) ID 4 length 6(3) eap: Continuing tunnel setup(3) [eap] = ok(3) } # authorize = ok(3) Found Auth-Type = EAP(3) # Executing group from file /etc/freeradius/sites-enabled/default(3) authenticate {(3) eap: Expiring EAP session with state 0x8aa7dbf488a3ce2f(3) eap: Finished EAP session with state 0x8aa7dbf488a3ce2f(3) eap: Previous EAP request found for state 0x8aa7dbf488a3ce2f, released from the list(3) eap: Peer sent packet with method EAP TTLS (21)(3) eap: Calling submodule eap_ttls to process data(3) eap_ttls: Authenticate(3) eap_ttls: Continuing EAP-TLS(3) eap_ttls: Peer ACKed our handshake fragment(3) eap_ttls: [eaptls verify] = request(3) eap_ttls: [eaptls process] = handled(3) eap: Sending EAP Request (code 1) ID 5 length 725(3) eap: EAP session adding &reply:State = 0x8aa7dbf489a2ce2f(3) [eap] = handled(3) } # authenticate = handled(3) Using Post-Auth-Type Challenge(3) Post-Auth-Type sub-section not found. Ignoring.(3) # Executing group from file /etc/freeradius/sites-enabled/default(3) Sent Access-Challenge Id 70 from <ip>:1812 to <ip>:59898 length 0(3) EAP-Message = 0x010502d5158000000a8f20417574686f72697479820900da1ed77d3b2c8ff1300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b0500(3) Message-Authenticator = 0x00000000000000000000000000000000(3) State = 0x8aa7dbf489a2ce2f8993e0490c51278d(3) Finished requestWaking up in 4.8 seconds.(4) Received Access-Request Id 71 from <ip>:59898 to <ip>:1812 length 347(4) User-Name = "hans.hering"(4) NAS-IP-Address = <ip>(4) NAS-Port = 0(4) NAS-Identifier = "<ip>"(4) NAS-Port-Type = Wireless-802.11(4) Calling-Station-Id = "4400100e904c"(4) Called-Station-Id = "186472cd167a"(4) Service-Type = Login-User(4) Framed-MTU = 1100(4) EAP-Message = 0x0205009015800000008616030100461000004241043d059fc34d75c809e28246cbef26b5353671cc04f909f887bcda2bfb46e9c5c3c7c5739285ff557b4dc0124534d952022cf360cbb002e29b8e6010ef9eeff15b1403010001011603010030954522307e8512ca2a646e52885316cf319a305831139d(4) State = 0x8aa7dbf489a2ce2f8993e0490c51278d(4) Aruba-Essid-Name = "<ssid>"(4) Aruba-Location-Id = "<apname>"(4) Aruba-AP-Group = "<apname>"(4) Message-Authenticator = 0xefbaccdfebd1d3f906dffd267d63b3d4(4) session-state: No cached attributes(4) # Executing section authorize from file /etc/freeradius/sites-enabled/default(4) authorize {(4) policy filter_username {(4) if (!&User-Name) {(4) if (!&User-Name) -> FALSE(4) if (&User-Name =~ / /) {(4) if (&User-Name =~ / /) -> FALSE(4) if (&User-Name =~ /@.*@/ ) {(4) if (&User-Name =~ /@.*@/ ) -> FALSE(4) if (&User-Name =~ /\.\./ ) {(4) if (&User-Name =~ /\.\./ ) -> FALSE(4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(4) if (&User-Name =~ /\.$/) {(4) if (&User-Name =~ /\.$/) -> FALSE(4) if (&User-Name =~ /(a)\./) {(4) if (&User-Name =~ /(a)\./) -> FALSE(4) } # policy filter_username = notfound(4) [preprocess] = ok(4) [chap] = noop(4) [mschap] = noop(4) [digest] = noop(4) suffix: Checking for suffix after "@"(4) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(4) suffix: No such realm "NULL"(4) [suffix] = noop(4) eap: Peer sent EAP Response (code 2) ID 5 length 144(4) eap: Continuing tunnel setup(4) [eap] = ok(4) } # authorize = ok(4) Found Auth-Type = EAP(4) # Executing group from file /etc/freeradius/sites-enabled/default(4) authenticate {(4) eap: Expiring EAP session with state 0x8aa7dbf489a2ce2f(4) eap: Finished EAP session with state 0x8aa7dbf489a2ce2f(4) eap: Previous EAP request found for state 0x8aa7dbf489a2ce2f, released from the list(4) eap: Peer sent packet with method EAP TTLS (21)(4) eap: Calling submodule eap_ttls to process data(4) eap_ttls: Authenticate(4) eap_ttls: Continuing EAP-TLS(4) eap_ttls: Peer indicated complete TLS record size will be 134 bytes(4) eap_ttls: Got complete TLS record (134 bytes)(4) eap_ttls: [eaptls verify] = length included(4) eap_ttls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (4) eap_ttls: TLS_accept: SSLv3 read client key exchange A(4) eap_ttls: <<< TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_ttls: <<< TLS 1.0 Handshake [length 0010], Finished (4) eap_ttls: TLS_accept: SSLv3 read finished A(4) eap_ttls: >>> TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_ttls: TLS_accept: SSLv3 write change cipher spec A(4) eap_ttls: >>> TLS 1.0 Handshake [length 0010], Finished (4) eap_ttls: TLS_accept: SSLv3 write finished A(4) eap_ttls: TLS_accept: SSLv3 flush data(4) eap_ttls: (other): SSL negotiation finished successfully(4) eap_ttls: SSL Connection Established(4) eap_ttls: [eaptls process] = handled(4) eap: Sending EAP Request (code 1) ID 6 length 69(4) eap: EAP session adding &reply:State = 0x8aa7dbf48ea1ce2f(4) [eap] = handled(4) } # authenticate = handled(4) Using Post-Auth-Type Challenge(4) Post-Auth-Type sub-section not found. Ignoring.(4) # Executing group from file /etc/freeradius/sites-enabled/default(4) Sent Access-Challenge Id 71 from <ip>:1812 to <ip>:59898 length 0(4) EAP-Message = 0x0106004515800000003b14030100010116030100303df00af3f5b715f6f8a2e59efbbcd7cf2e70d4d3391ec7706b0e96ace65e108dab33d36f365c0040c5b627503d501828(4) Message-Authenticator = 0x00000000000000000000000000000000(4) State = 0x8aa7dbf48ea1ce2f8993e0490c51278d(4) Finished requestWaking up in 4.8 seconds.(5) Received Access-Request Id 72 from <ip>:59898 to <ip>:1812 length 266(5) User-Name = "hans.hering"(5) NAS-IP-Address = <ip>(5) NAS-Port = 0(5) NAS-Identifier = "<ip>"(5) NAS-Port-Type = Wireless-802.11(5) Calling-Station-Id = "4400100e904c"(5) Called-Station-Id = "186472cd167a"(5) Service-Type = Login-User(5) Framed-MTU = 1100(5) EAP-Message = 0x0206003f1580000000351703010030c39c440ecadb79d70661f5c2457440ae369e59eb3b10505f97b78b5d96cc87fb563fb5cb5edc6057e18560f1b7fafcfd(5) State = 0x8aa7dbf48ea1ce2f8993e0490c51278d(5) Aruba-Essid-Name = "<ssid>"(5) Aruba-Location-Id = "<apname>"(5) Aruba-AP-Group = "<apname>"(5) Message-Authenticator = 0x63c04f4574a68ea285f031dc5bda5089(5) session-state: No cached attributes(5) # Executing section authorize from file /etc/freeradius/sites-enabled/default(5) authorize {(5) policy filter_username {(5) if (!&User-Name) {(5) if (!&User-Name) -> FALSE(5) if (&User-Name =~ / /) {(5) if (&User-Name =~ / /) -> FALSE(5) if (&User-Name =~ /@.*@/ ) {(5) if (&User-Name =~ /@.*@/ ) -> FALSE(5) if (&User-Name =~ /\.\./ ) {(5) if (&User-Name =~ /\.\./ ) -> FALSE(5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(5) if (&User-Name =~ /\.$/) {(5) if (&User-Name =~ /\.$/) -> FALSE(5) if (&User-Name =~ /(a)\./) {(5) if (&User-Name =~ /(a)\./) -> FALSE(5) } # policy filter_username = notfound(5) [preprocess] = ok(5) [chap] = noop(5) [mschap] = noop(5) [digest] = noop(5) suffix: Checking for suffix after "@"(5) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(5) suffix: No such realm "NULL"(5) [suffix] = noop(5) eap: Peer sent EAP Response (code 2) ID 6 length 63(5) eap: Continuing tunnel setup(5) [eap] = ok(5) } # authorize = ok(5) Found Auth-Type = EAP(5) # Executing group from file /etc/freeradius/sites-enabled/default(5) authenticate {(5) eap: Expiring EAP session with state 0x8aa7dbf48ea1ce2f(5) eap: Finished EAP session with state 0x8aa7dbf48ea1ce2f(5) eap: Previous EAP request found for state 0x8aa7dbf48ea1ce2f, released from the list(5) eap: Peer sent packet with method EAP TTLS (21)(5) eap: Calling submodule eap_ttls to process data(5) eap_ttls: Authenticate(5) eap_ttls: Continuing EAP-TLS(5) eap_ttls: Peer indicated complete TLS record size will be 53 bytes(5) eap_ttls: Got complete TLS record (53 bytes)(5) eap_ttls: [eaptls verify] = length included(5) eap_ttls: [eaptls process] = ok(5) eap_ttls: Session established. Proceeding to decode tunneled attributes(5) eap_ttls: Got tunneled request(5) eap_ttls: EAP-Message = 0x020000100168616e732e686572696e67(5) eap_ttls: Got tunneled identity of hans.hering(5) eap_ttls: Setting default EAP type for tunneled EAP session(5) eap_ttls: Sending tunneled request(5) Virtual server inner-tunnel received request(5) EAP-Message = 0x020000100168616e732e686572696e67(5) User-Name = "hans.hering"(5) server inner-tunnel {(5) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel(5) authorize {(5) [chap] = noop(5) [mschap] = noop(5) suffix: Checking for suffix after "@"(5) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(5) suffix: No such realm "NULL"(5) [suffix] = noop(5) update control {(5) &Proxy-To-Realm := LOCAL(5) } # update control = noop(5) eap: Peer sent EAP Response (code 2) ID 0 length 16(5) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize(5) [eap] = ok(5) } # authorize = ok(5) Found Auth-Type = EAP(5) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel(5) authenticate {(5) eap: Peer sent packet with method EAP Identity (1)(5) eap: Calling submodule eap_md5 to process data(5) eap_md5: Issuing MD5 Challenge(5) eap: Sending EAP Request (code 1) ID 1 length 22(5) eap: EAP session adding &reply:State = 0x47026ba347036f9f(5) [eap] = handled(5) } # authenticate = handled(5) } # server inner-tunnel(5) Virtual server sending reply(5) EAP-Message = 0x01010016041081dfab5920bbad29c708489ae35dc75f(5) Message-Authenticator = 0x00000000000000000000000000000000(5) State = 0x47026ba347036f9fb85e0642fabc31d4(5) eap_ttls: Got tunneled Access-Challenge(5) eap: Sending EAP Request (code 1) ID 7 length 79(5) eap: EAP session adding &reply:State = 0x8aa7dbf48fa0ce2f(5) [eap] = handled(5) } # authenticate = handled(5) Using Post-Auth-Type Challenge(5) Post-Auth-Type sub-section not found. Ignoring.(5) # Executing group from file /etc/freeradius/sites-enabled/default(5) Sent Access-Challenge Id 72 from <ip>:1812 to <ip>:59898 length 0(5) EAP-Message = 0x0107004f1580000000451703010040c1a48501dcf5e2b5d4a72196219fa0f279498885465d123a4c95d6490ec55d1496b6503b8410ce0b7c568fc6e46440e90e4730eb8883c0e71a858916a1a66354(5) Message-Authenticator = 0x00000000000000000000000000000000(5) State = 0x8aa7dbf48fa0ce2f8993e0490c51278d(5) Finished requestWaking up in 4.7 seconds.(6) Received Access-Request Id 73 from <ip>:59898 to <ip>:1812 length 298(6) User-Name = "hans.hering"(6) NAS-IP-Address = <ip>(6) NAS-Port = 0(6) NAS-Identifier = "<ip>"(6) NAS-Port-Type = Wireless-802.11(6) Calling-Station-Id = "4400100e904c"(6) Called-Station-Id = "186472cd167a"(6) Service-Type = Login-User(6) Framed-MTU = 1100(6) EAP-Message = 0x0207005f1580000000551703010050e5017cf29ca351ffb06cf4226e56c7883502556146fae26cdf965b030636de8a2610906ac579874eddfd9f70e78328af1248d230f5341da8e86db06d17154a8da3f6531540e5a2d35d4bc51e942c9beb(6) State = 0x8aa7dbf48fa0ce2f8993e0490c51278d(6) Aruba-Essid-Name = "<ssid>"(6) Aruba-Location-Id = "<apname>"(6) Aruba-AP-Group = "<apname>"(6) Message-Authenticator = 0x68cac7c8d75f2ff01b8a0e0ab93beeb6(6) session-state: No cached attributes(6) # Executing section authorize from file /etc/freeradius/sites-enabled/default(6) authorize {(6) policy filter_username {(6) if (!&User-Name) {(6) if (!&User-Name) -> FALSE(6) if (&User-Name =~ / /) {(6) if (&User-Name =~ / /) -> FALSE(6) if (&User-Name =~ /@.*@/ ) {(6) if (&User-Name =~ /@.*@/ ) -> FALSE(6) if (&User-Name =~ /\.\./ ) {(6) if (&User-Name =~ /\.\./ ) -> FALSE(6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(6) if (&User-Name =~ /\.$/) {(6) if (&User-Name =~ /\.$/) -> FALSE(6) if (&User-Name =~ /(a)\./) {(6) if (&User-Name =~ /(a)\./) -> FALSE(6) } # policy filter_username = notfound(6) [preprocess] = ok(6) [chap] = noop(6) [mschap] = noop(6) [digest] = noop(6) suffix: Checking for suffix after "@"(6) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(6) suffix: No such realm "NULL"(6) [suffix] = noop(6) eap: Peer sent EAP Response (code 2) ID 7 length 95(6) eap: Continuing tunnel setup(6) [eap] = ok(6) } # authorize = ok(6) Found Auth-Type = EAP(6) # Executing group from file /etc/freeradius/sites-enabled/default(6) authenticate {(6) eap: Expiring EAP session with state 0x47026ba347036f9f(6) eap: Finished EAP session with state 0x8aa7dbf48fa0ce2f(6) eap: Previous EAP request found for state 0x8aa7dbf48fa0ce2f, released from the list(6) eap: Peer sent packet with method EAP TTLS (21)(6) eap: Calling submodule eap_ttls to process data(6) eap_ttls: Authenticate(6) eap_ttls: Continuing EAP-TLS(6) eap_ttls: Peer indicated complete TLS record size will be 85 bytes(6) eap_ttls: Got complete TLS record (85 bytes)(6) eap_ttls: [eaptls verify] = length included(6) eap_ttls: [eaptls process] = ok(6) eap_ttls: Session established. Proceeding to decode tunneled attributes(6) eap_ttls: Got tunneled request(6) eap_ttls: EAP-Message = 0x020100210410a1caf80086694cc7efcdb9214433cb1f68616e732e686572696e67(6) eap_ttls: Sending tunneled request(6) Virtual server inner-tunnel received request(6) EAP-Message = 0x020100210410a1caf80086694cc7efcdb9214433cb1f68616e732e686572696e67(6) User-Name = "hans.hering"(6) State = 0x47026ba347036f9fb85e0642fabc31d4(6) server inner-tunnel {(6) session-state: No cached attributes(6) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel(6) authorize {(6) [chap] = noop(6) [mschap] = noop(6) suffix: Checking for suffix after "@"(6) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(6) suffix: No such realm "NULL"(6) [suffix] = noop(6) update control {(6) &Proxy-To-Realm := LOCAL(6) } # update control = noop(6) eap: Peer sent EAP Response (code 2) ID 1 length 33(6) eap: No EAP Start, assuming it's an on-going EAP conversation(6) [eap] = updated(6) [files] = nooprlm_ldap (ldap): Reserved connection (0)(6) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(6) ldap: --> (uid=hans.hering)(6) ldap: Performing search in "dc=xxx,dc=xxx" with filter "(uid=hans.hering)", scope "sub"(6) ldap: Waiting for search result...(6) ldap: User object found at DN "uid=hans.hering,ou=xxx,dc=xxx,dc=xxx"(6) ldap: Processing user attributes(6) ldap: control:Password-With-Header += '{SSHA}IiE+U9IKv4ttaILiThSWbftqrdBOSERS0nuCKQ=='rlm_ldap (ldap): Released connection (0)rlm_ldap (ldap): Need 5 more connections to reach 10 sparesrlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful(6) [ldap] = updated(6) [expiration] = noop(6) [logintime] = noop(6) pap: Converted: Password-With-Header -> SSHA1-Password(6) pap: Removing &control:Password-With-Header(6) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes(6) pap: WARNING: Auth-Type already set. Not setting to PAP(6) [pap] = noop(6) } # authorize = updated(6) Found Auth-Type = EAP(6) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel(6) authenticate {(6) eap: Expiring EAP session with state 0x47026ba347036f9f(6) eap: Finished EAP session with state 0x47026ba347036f9f(6) eap: Previous EAP request found for state 0x47026ba347036f9f, released from the list(6) eap: Peer sent packet with method EAP MD5 (4)(6) eap: Calling submodule eap_md5 to process data(6) eap_md5: Cleartext-Password is required for EAP-MD5 authentication(6) eap: ERROR: Failed continuing EAP MD5 (4) session. EAP sub-module failed(6) eap: Sending EAP Failure (code 4) ID 1 length 4(6) eap: Failed in EAP select(6) [eap] = invalid(6) } # authenticate = invalid(6) Failed to authenticate the user(6) Using Post-Auth-Type Reject(6) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel(6) Post-Auth-Type REJECT {(6) attr_filter.access_reject: EXPAND %{User-Name}(6) attr_filter.access_reject: --> hans.hering(6) attr_filter.access_reject: Matched entry DEFAULT at line 11(6) [attr_filter.access_reject] = updated(6) update outer.session-state {(6) &Module-Failure-Message := &request:Module-Failure-Message -> 'eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed'(6) } # update outer.session-state = noop(6) } # Post-Auth-Type REJECT = updated(6) } # server inner-tunnel(6) Virtual server sending reply(6) EAP-Message = 0x04010004(6) Message-Authenticator = 0x00000000000000000000000000000000(6) eap_ttls: Got tunneled Access-Reject(6) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed(6) eap: Sending EAP Failure (code 4) ID 7 length 4(6) eap: Failed in EAP select(6) [eap] = invalid(6) } # authenticate = invalid(6) Failed to authenticate the user(6) Using Post-Auth-Type Reject(6) # Executing group from file /etc/freeradius/sites-enabled/default(6) Post-Auth-Type REJECT {(6) attr_filter.access_reject: EXPAND %{User-Name}(6) attr_filter.access_reject: --> hans.hering(6) attr_filter.access_reject: Matched entry DEFAULT at line 11(6) [attr_filter.access_reject] = updated(6) [eap] = noop(6) policy remove_reply_message_if_eap {(6) if (&reply:EAP-Message && &reply:Reply-Message) {(6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE(6) else {(6) [noop] = noop(6) } # else = noop(6) } # policy remove_reply_message_if_eap = noop(6) } # Post-Auth-Type REJECT = updated(6) Delaying response for 1.000000 secondsWaking up in 0.2 seconds.Waking up in 0.7 seconds.(6) Sending delayed response(6) Sent Access-Reject Id 73 from <ip>:1812 to <ip>:59898 length 44(6) EAP-Message = 0x04070004(6) Message-Authenticator = 0x00000000000000000000000000000000Waking up in 3.6 seconds.(0) Cleaning up request packet ID 67 with timestamp +24(1) Cleaning up request packet ID 68 with timestamp +24(2) Cleaning up request packet ID 69 with timestamp +24(3) Cleaning up request packet ID 70 with timestamp +24(4) Cleaning up request packet ID 71 with timestamp +24(5) Cleaning up request packet ID 72 with timestamp +25(6) Cleaning up request packet ID 73 with timestamp +25Ready to process requests

4 5

FreeRadius - Version porting
by srithar jeevadurai 23 Nov '15

23 Nov '15

Dear Friends, We have customized module (lib) written for freeRadius version freeradius-server-2.2.0. The same code can be reused for latest version of free Radius (say 3.0.9). Provided all basic message structures are remain same (in both versions of free Radius). One basic questions, We were having child hung issue at free Radius due to slow response from external module. once free Radius server (version 2.2.0) goes to child hung state then we have to restart the server (though the external module resumed after 1-2 minutes). Is there any throttling done at Free Radius server (latest version 3.0.9)? so that when external module response is slow, Radius server would not fill the queue with incoming messages (from NAS). i.e. taking messages into queue and run into child hung issue. It uses throttling to have control over pending request queue when there is a slowness in the external system and queue size increases (since NAS is flooding the radius server). Thanks a lot for your response in advance. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

8 33

3GPP-Location-Info
by Marc Beaumont 23 Nov '15

23 Nov '15

I've got accouinting data with the following attribute: 3GPP-Location-Info = 0x0032f4030921b8e8 Does anyone know how to decode this or what data is contained in this? Marc ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud http://www.intycascade.com/products/symantec/ ______________________________________________________________________

2 2

FreeRadius 3.0.4
by Oscar Jofre 22 Nov '15

22 Nov '15

Hi, I'm using FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu on Centos_7 I'm using server with 4GB RAM, 4xCPU, 50GB Disk and 100% FreeRadius dedicated The database MariaDB 10.x is running on a different server with more RAM and CPU. I've changed radiusd.conf with: max_requests = 2500000 max_servers = 256 max_spare_servers = 400 I have 10.000 test users connectes with PPoE with 5 minutes timeout and interim every 1 minute. I have this Errors on log: 1) Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'e35620bfd04391bc9c6f5afe3628449d' for key 'acctuniqueid'' Fri Nov 20 00:10:14 2015 : Error: rlm_sql (sql): Duplicate entry 'ab0c9cb893d6af4de3388749d7004c2b' for key 'acctuniqueid' Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: Cannot store result Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'ab0c9cb893d6af4de3388749d7004c2b' for key 'acctuniqueid'' Fri Nov 20 00:10:14 2015 : Error: rlm_sql (sql): Duplicate entry '8902d57334a046e00c6231ad91aad63e' for key 'acctuniqueid' Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: Cannot store result Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '8902d57334a046e00c6231ad91aad63e' for key 'acctuniqueid'' Fri Nov 20 00:10:23 2015 : Error: rlm_sql (sql): Duplicate entry '4b5b0717c9b3c5f2100ff001efa9f6b3' for key 'acctuniqueid' Fri Nov 20 00:10:23 2015 : Error: rlm_sql_mysql: Cannot store result Fri Nov 20 00:10:23 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '4b5b0717c9b3c5f2100ff001efa9f6b3' for key 'acctuniqueid'' 2) Fri Nov 20 00:16:25 2015 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Fri Nov 20 00:16:25 2015 : Warning: rlm_sql (sql): 21 of 21 connections in use. You probably need to increase "spare" Fri Nov 20 00:16:25 2015 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Fri Nov 20 00:16:25 2015 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Fri Nov 20 00:16:25 2015 : Info: rlm_sql (sql): Opening additional connection (543) Fri Nov 20 00:16:25 2015 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Fri Nov 20 00:16:25 2015 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress 1) As Alan Dekok told this duplicate key error is because FreeRadius 3.0.4 . but I'm not able to compile and install newer version because is not on the Centos_7 repository .. Is there any PATCH or file I can modify to fix this error ? 2) I modify max_spare_server to 400 and still you probably need to increase spare . wich value do you think could be ok ? Do I need to modify any other value ? Thanks a lot !

3 5

use_tunneled_reply = yes didn't help.
by Frank Rizzo 22 Nov '15

22 Nov '15

Hello list, I'm using FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 on Ubuntu 14.04 LTS. I'm using hostapd v2.1 as the AP front end. I'm getting this: Nov 20 16:43:57 test-desktop hostapd: wlan0: STA 08:d4:2b:xx:xx:xx IEEE 802.1X: authentication server did not include required VLAN ID in Access-Accept Nov 20 16:43:57 test-desktop hostapd: wlan0: STA 08:d4:2b:xx:xx:xx IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) My eap.conf looks like this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no use_tunneled_reply = yes md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = password private_key_file = /etc/certs/wpa2_priv.pem certificate_file = /etc/certs/wpa2_cert.pem CA_file = /etc/certs/wpa2_ca_cert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 use_tunneled_reply = yes } mschapv2 { } } My project was due to ship on TUESDAY. So, I'm in a bit of a panic. Can anyone help? THANK YOU! -Frank

2 7

Error setting up Freeradius
by Roger Kidd 22 Nov '15

22 Nov '15

I'm trying to get free radius to work with my ASUS RT-AC68U router. I get the below in my debug output. Any help would be much appreciated. FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Oct 15 2015 at 11:03:19 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = yes secret = "Shanna12" nastype = "other" } client 192.168.1.1/24 { require_message_authenticator = no secret = "Shanna12" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "pa55word" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.1.134 port = 1812 } listen { type = "acct" ipaddr = 192.168.1.134 port = 1813 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 53488 Listening on authentication address 192.168.1.134 port 1812 Listening on accounting address 192.168.1.134 port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address 192.168.1.134 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=123 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a01526f676572 Message-Authenticator = 0xacfd48611b5bf251509d7c87051f4ea6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> Roger [sql] sql_set_user escaped user --> 'Roger' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Roger' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Roger' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'Roger' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x010100160410eec27c2d5ae0e5194e6ffad14031c95f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a32c7751d29f4e02a70d44a6 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=139 Cleaning up request 0 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a32c7751d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100080319152b Message-Authenticator = 0x83f5a682e7a110e06e3c3907c891632a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> Roger [sql] sql_set_user escaped user --> 'Roger' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Roger' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Roger' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'Roger' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a22f6a51d29f4e02a70d44a6 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=274 Cleaning up request 1 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a22f6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202008f19800000008516030100800100007c0301564d2bfa7661f3983bdffd87d0ed07af3bf587102c4e8cd89799bcd8e1b935cb00003400ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000050005010000000000120000 Message-Authenticator = 0xe34fb29a3e55a09c5d24209a8a41853c # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 143 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 133 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 Handshake [length 0080], ClientHello [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 02ca], Certificate [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0103040019c00000046616030100390200003503011bac8077204837b3c17a315a5c6fcc7f6f820786d20aaca66e3caf6ca9aead1900c01400000dff01000100000b00040300010216030102ca0b0002c60002c30002c0308202bc308201a4a003020102020900ab18ec010a534348300d06092a864886f70d01010b050030163114301206035504030c0b726f6765723739302d5043301e170d3135313131313139323131325a170d3235313130383139323131325a30163114301206035504030c0b726f6765723739302d504330820122300d06092a864886f70d01010105000382010f003082010a0282010100de10c6b14996036d9805cfb545f7 EAP-Message = 0x2b0ea4bc389a025e8d8329809ecdb037c293223c02fb7cf535025ea1adff3a1bd27f51c7d33efc42aa07ae76ff8a4e754f3ce243999d81378418b67c9b9fd7db151937b3d2da687e813d0080ae3b1ae10854ba5eb7eb6d699b0b55e81f85ebf52a7b13ae4be74f99a67af5a540ed5a98d7b4bfaa24369f9aaefbf32b53069fab030133ce868f7409c0d37671c8f8a03111ad79becc9f59f70278ee6ef642d5e2140d2898959801356cdb9efec93a962fdf8438d7d91510c5cdbce8f0d45547b45776676c7ed5f10a2eeb6bc8b16b8b0840d082b7aecc74a82e09ebd17cad1dae87c193d8efe2105aa93ac0aaa98d052e356f0203010001a30d300b3009 EAP-Message = 0x0603551d1304023000300d06092a864886f70d01010b050003820101009e1c02d3ee395a20352bed2ecc9d1f14b61a8efa4b34f4470df6808f61875f0e205d4d962aaa170f85b757dfa205f84927d8f31d235d116578e94ce670c2517bfeb6e6809873fb8865ac2a06222efb6ef716246cde5d3ba102265412fdfcc3c1a525501de261642456b81809042df83dcbcc4d67db63b8b7a99643f8f3bbbe3491dc9f902f59f1635218b42f1e85f1bcc4865b26a57f7a9fffe00dc8e6b17091b9f9116c49404a0c5c3631c8070b7945625f65cb87fac77aded7795fcb7e8b4ae0f32e8edebda397665c5d2c7cca68b93a3dee2c28c1ae1881429f2c337a243d EAP-Message = 0xc6088f13fc380c7d27ddcfa896981e022fe66a7c7b462cfadbe13f5dfe5ecd4e160301014b0c00014703001741046573a309fbd2ffa1ad28c14f69ad09818d25908dd621cfe2251e4bd7eacbcdc9ed13f6ce8133a332eeacd7ee980343890ce6b707f2c03dbd046ca4f2f1312c6801005d799cf291313738b0cb27c592bcbeb766cd18cd01fa2dbd0423f844592f8ec5f092e2f51b9bc03cedb8bcd7362938e46abe505e4dcf1877f4e467cf1bba5437e6311d8815a1bdbaca9e6da9a1e0e507e8621054d9f93dbdb8e7a8341c164db28ac0128bfbecd2e35a3580143f1e34a35ace74074834b7640c92e5045bfd246454d7fa6358ac65455ac8f68351 EAP-Message = 0xb00f79ab95910999a2865fc1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a12e6a51d29f4e02a70d44a6 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=137 Cleaning up request 2 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a12e6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x0250778ac6d982d856d34ae7373a717d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x010400761900137384072d800273752fa164043d3831297bc23b04310a9fef3833c1983a337b84343c113cae0a917f5541502062b7e4c8220b04dcce7452afc151e8f5c81842e91be3bf3b5eb571aba01c6c016ce08bd390ea8c1d269845906b09d08c8421a2242aaaa6f5f43416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a0296a51d29f4e02a70d44a6 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=275 Cleaning up request 3 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a0296a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204009019800000008616030100461000004241040f10c7fbfcfe339c630ab8c88276da3fba376780357b2d14e23f0e2db70069e14079e0b9860d84a708a6a9bef37ee88eebe260dd5d0e3a0fea977fe7fcd17b691403010001011603010030c6bdfa012c9fdefeb916132d4de9ff8c1a1a283f15441df6d8fc052629c748c4a44aff347500ca01dbece59fbc393856 Message-Authenticator = 0x57786aa1d5b675f65e684f0940291b62 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0105004119001403010001011603010030f61da070708c43f6dcbe41409fdf2e51cef8af0256ad4b8828349c69c10ed97fe1e82b69230f4405d2b0100e3e3ec20a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a7286a51d29f4e02a70d44a6 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=137 Cleaning up request 4 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a7286a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xb6949019762097b54db555bcc6b9d8e3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED [peap] >>> Unknown TLS version [length 0005] ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0106002b1900170301002068c18a036c48de0eb66bdbbf81b8787ae912570a2aef56f40ddbc40c13c0b9da Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a62b6a51d29f4e02a70d44a6 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=174 Cleaning up request 5 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a62b6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206002b190017030100204c3876f131f068fe79e951f813c5cb207e4016221643c7aea94152cb78abf875 Message-Authenticator = 0xbdfef7d06256d6eca1eb5496f1180756 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - Roger [peap] Got inner identity 'Roger' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0206000a01526f676572 server { [peap] Setting User-Name to Roger Sending tunneled request EAP-Message = 0x0206000a01526f676572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Roger" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0107001f1a0107001a100004ddc71e23923b2be4b11419c99909526f676572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8298ef44829ff58ff79b4166c44b0a5b [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0107001f1a0107001a100004ddc71e23923b2be4b11419c99909526f676572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8298ef44829ff58ff79b4166c44b0a5b [peap] Got tunneled Access-Challenge [peap] >>> Unknown TLS version [length 0005] ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0107003b190017030100307b70512e13ec9b5d3f78eab651ac96375f3978054c49bda43168cc53dc066b892ae61bed91033e6dcc2295be608ea5b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a52a6a51d29f4e02a70d44a6 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=238 Cleaning up request 6 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a52a6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207006b19001703010060f91730c057463659319d67a0cb0a0eaa899328ca1dcd043d97521f3fb09acc3c301ba9d5af3fe15a544aad005996d12bb9802b18b600a77fb0434e701b7fab642cfc6092e157dc279a7fa7d99499627db8f1bfe8d0f895ddc540cf79dbf99627 Message-Authenticator = 0x25fd8c0a7055dad08db9ad50c209d5f3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700401a0207003b31eabc7c85d8a95307b769e4ba2c0d887700000000000000009753306f44120327dcf92e9b8955f68a63442b9c007d6f7200526f676572 server { [peap] Setting User-Name to Roger Sending tunneled request EAP-Message = 0x020700401a0207003b31eabc7c85d8a95307b769e4ba2c0d887700000000000000009753306f44120327dcf92e9b8955f68a63442b9c007d6f7200526f676572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Roger" State = 0x8298ef44829ff58ff79b4166c44b0a5b server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: Roger [mschap] Told to do MS-CHAPv2 for Roger with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE [peap] >>> Unknown TLS version [length 0005] ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0108002b1900170301002024a54b33cd00c91f3bc96de1a6a5e649fd987111d6535d05627943f2ade90bbf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a4256a51d29f4e02a70d44a6 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=174 Cleaning up request 7 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a4256a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208002b190017030100203f1b35d2fb7020ac9b9a174a085fdcdedc704e9385d24a06f68a55e15c5ff01d Message-Authenticator = 0x15ca385972b2294e5667e36abeb2162d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Roger attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 8 ID 0 with timestamp +33 Ready to process requests.

3 4

erx router and coa requests
by Bill Schoolfield 20 Nov '15

20 Nov '15

Hi All, This isn't freeradius specific per se but I can't find anything on the web about this. Maybe someone here has experience with this. I'm trying to drop a session using radclient: Sending Disconnect-Request of id 169 to 204.101.13.1 port 1700 User-Name = "someid(a)example.com" Acct-Session-Id = "erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002" rad_recv: Disconnect-NAK packet from host 204.101.13.1 port 1700, id=169, length=26 Error-Cause = Session-Context-Not-Found But regardless of what I try I can't seem to send the right attrs to get (ie. find) an active session dropped. The NAS is a Juniper Edge Routing Switch ERX-310. Best I can tell I have the right attrs. Including others results in Unsupported attr error. Omitting either of these two results in attr missing error. Does anybody know the what should be passed? Here is the radacct record for the session: radacctid: 959301 acctsessionid: erx ip:67.69.123.10:67.69.201.164:1698:d542:29da:ae8e:33d542:002 acctuniqueid: d0c22edd21381824 username: someid(a)example.com groupname: realm: nasipaddress: 204.101.13.1 nasportid: 124498 nasporttype: Virtual acctstarttime: 2015-11-19 10:28:55 acctstoptime: NULL acctsessiontime: 3600 acctauthentic: RADIUS connectinfo_start: connectinfo_stop: NULL acctinputoctets: 6638966 acctoutputoctets: 140935633 calledstationid: callingstationid: GigabitEthernet 5/0/4.1300052:130-52=23587452684=2 acctterminatecause: servicetype: Framed-User framedprotocol: PPP framedipaddress: 204.101.88.246 acctstartdelay: 0 acctstopdelay: NULL xascendsessionsvrkey: Bill

3 6

IP Allocation FAILED : Best practice for inserting new IPs into mysql
by Sophie Loewenthal 20 Nov '15

20 Nov '15

Hi, Please find attached a debug of 62 lines. My ippool seems full: [sqlippool] pool appears to be full [sqlippool] expand: IP Allocation FAILED from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) -> IP Allocation FAILED from proximus-carli (did proximus.trimbletl.com cli 32770XXXX port 29449 user 45486XXXXX) How could I check if the ippool had run out of IPs or was close to? I tried with these but clearly this was not good enough . Is there a better method of currently allocated addresses? mysql> select count(*) from radippool where username = ''; +----------+ | count(*) | +----------+ | 383727 | +----------+ and with, mysql> select count(*) from radippool where expiry_time is NULL ; +----------+ | count(*) | +----------+ | 396466 | +----------+ I am surprised this filled up, because we don't have enough devices to fill up our IP space. What could happen if NAS did not send back accounting stop packets? Can I add more IP addresses into radippol with FreeRADIUS running, or should I shut down FreeRADIUS during this insert? Kind regards, Sophie

4 10

Hoping to understand a little more on mysql table radippool ( ippool.conf )
by Sophie Loewenthal 20 Nov '15

20 Nov '15

Hi, I am interested to know under what circumstances would an IP address have a username assigned and with most other attributes empty or NULL? e.g *mysql> select * from radippool where username = '10000078e' ; id pool_name framedipaddress nasipaddress calledstationid callingstationid expiry_time username pool_key 3GPP_Imsi 392053, vodafone, 10.26.7.134,,,, NULL, 10000078e, 0, * *mysql> select * from radippool where username = '10000078e' ;* id pool_name framedipaddress nasipaddress calledstationid callingstationid expiry_time username pool_key 3GPP_Imsi 392053 vodafone 10.26.7.134 NULL 10000078e 0 mysql> select count(*) from radippool where expiry_time is NULL and username != '' ; +----------+ | count(*) | +----------+ | 12797 | +----------+ Kind regards, Sophie

2 1

Stack trace of crash with FR 3.0.10
by Sebastian Hagedorn 20 Nov '15

20 Nov '15

Hi, we've been running FR 3.0.10 in production for about a month now. We have four production servers on RHEL 6. Every few days one of the radiusd processes quits without an error message. We have now enabled the panic action and installed the debuginfo RPMs. Last night we got the first usable gbd.log. Here's the relevant part: Thread 4 (Thread 0x7f8b6cb36700 (LWP 9823)): #0 0x0000003a1ae0cdab in pthread_once () from /lib64/libpthread.so.0 No symbol table info available. #1 0x0000003a1aafea04 in backtrace () from /lib64/libc.so.6 No symbol table info available. #2 0x0000003a1aa7054b in __libc_message () from /lib64/libc.so.6 No symbol table info available. #3 0x0000003a1aa75e66 in malloc_printerr () from /lib64/libc.so.6 No symbol table info available. #4 0x0000003a1aa799a4 in _int_malloc () from /lib64/libc.so.6 No symbol table info available. #5 0x0000003a1aa7a3e6 in calloc () from /lib64/libc.so.6 No symbol table info available. #6 0x0000003a1a60addf in _dl_new_object () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #7 0x0000003a1a6071de in _dl_map_object_from_fd () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #8 0x0000003a1a60839a in _dl_map_object () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #9 0x0000003a1a612b95 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #10 0x0000003a1a60e286 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #11 0x0000003a1a61263a in _dl_open () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #12 0x0000003a1ab26cd0 in do_dlopen () from /lib64/libc.so.6 No symbol table info available. #13 0x0000003a1a60e286 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2 No symbol table info available. #14 0x0000003a1ab26e27 in __libc_dlopen_mode () from /lib64/libc.so.6 No symbol table info available. #15 0x0000003a1aafe8d5 in init () from /lib64/libc.so.6 No symbol table info available. #16 0x0000003a1ae0cdb3 in pthread_once () from /lib64/libpthread.so.0 No symbol table info available. #17 0x0000003a1aafea04 in backtrace () from /lib64/libc.so.6 No symbol table info available. #18 0x0000003a1aa7054b in __libc_message () from /lib64/libc.so.6 No symbol table info available. #19 0x0000003a1aa75e66 in malloc_printerr () from /lib64/libc.so.6 No symbol table info available. #20 0x0000003a1aa789ba in _int_free () from /lib64/libc.so.6 No symbol table info available. #21 0x0000003a20202389 in ?? () from /usr/lib64/libtalloc.so.2 No symbol table info available. #22 0x000000396dc15dbc in fr_pair_value_strsteal (vp=0x7f8b48732dc0, src=0x7f8b4874f5e0 "leap:session-key=\200hl\240:l\236\255t\256\247\366Z\315%f\233\220q~\343-\207VΟ\334\366N%i\372p\274Q\242\243\232ީ/\257\362\315\376f\344\067>0\356\262\v\233\343\240\344pH\213\177") at /usr/src/debug/freeradius-server-3.0.10/src/lib/pair.c:2125 q = <value optimized out> #23 0x00007f8b751ac8da in mod_post_proxy (inst=0x19c0c60, request=0x1c6c590) at /usr/src/debug/freeradius-server-3.0.10/src/modules/rlm_eap/rlm_eap.c:675 i = 34 len = 130 p = 0x7f8b4874f5e0 "leap:session-key=\200hl\240:l\236\255t\256\247\366Z\315%f\233\220q~\343-\207VΟ\334\366N%i\372p\274Q\242\243\232ީ/\257\362\315\376f\344\067>0\356\262\v\233\343\240\344pH\213\177" vp = 0x7f8b48732dc0 handler = <value optimized out> cursor = {first = 0x1c170d8, found = 0x7f8b48732dc0, last = 0x0, current = 0x7f8b48732dc0, next = 0x7f8b48708160} #24 0x0000000000425f4f in call_modsingle (request=0x1c6c590, component=MOD_POST_PROXY, depth=1, entry=0x7f8b6cb359c8, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:302 blocked = <value optimized out> indent = 4 #25 modcall_recurse (request=0x1c6c590, component=MOD_POST_PROXY, depth=1, entry=0x7f8b6cb359c8, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:574 sp = 0x1a672f0 if_taken = false was_if = false c = <value optimized out> priority = <value optimized out> result = RLM_MODULE_OK #26 0x00000000004267ba in modcall_child (request=<value optimized out>, component=<value optimized out>, depth=<value optimized out>, entry=0x7f8b6cb359b0, c=<value optimized out>, result=0x7f8b6cb3580c, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:408 next = 0x7f8b6cb359c8 #27 0x0000000000425575 in modcall_recurse (request=0x1c6c590, component=MOD_POST_PROXY, depth=0, entry=0x7f8b6cb359b0, do_next_sibling=true) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:785 g = 0x1a67150 if_taken = false was_if = false c = <value optimized out> priority = <value optimized out> result = RLM_MODULE_UNKNOWN #28 0x0000000000426753 in modcall (component=<value optimized out>, c=<value optimized out>, request=<value optimized out>) at /usr/src/debug/freeradius-server-3.0.10/src/main/modcall.c:1130 stack = {{result = RLM_MODULE_NOOP, priority = 0, unwind = 0, c = 0x1a67150}, {result = RLM_MODULE_OK, priority = 3, unwind = 0, c = 0x1a672f0}, {result = 1823693344, priority = 32651, unwind = 29811200, c = 0x0}, {result = 1841447521, priority = 57, unwind = 1823693888, c = 0x3a1d2e8029}, {result = RLM_MODULE_FAIL, priority = 0, unwind = 490166044, c = 0x7f8b48708160}, {result = 1215624496, priority = 32651, unwind = 3, c = 0x1d5}, {result = 24099536, priority = 0, unwind = 1823693448, c = 0x7f8b480008c0}, {result = 24099488, priority = 0, unwind = 24099536, c = 0x3a1d2e7e92}, {result = 1823693504, priority = 32651, unwind = 489586107, c = 0x0}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 0, c = 0x7f8b6cb35d20}, {result = 11, priority = 32651, unwind = 489586811, c = 0x0}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 9, c = 0x2}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 176, c = 0x0}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 0, c = 0x3200000009}, {result = 91, priority = 124, unwind = 119, c = 0x396dc2f86a}, {result = 1215353712, priority = 32651, unwind = 129, c = 0x7f8b48000020}, {result = 29454432, priority = 0, unwind = 1823693888, c = 0x7f8b6cb35c40}, {result = 4382876, priority = 0, unwind = 1215353712, c = 0xe6dfd36399d685d1}, {result = 49, priority = 0, unwind = 29454432, c = 0x1c1727c}, {result = 29811200, priority = 0, unwind = 29454432, c = 0x7f8b6cb35c40}, {result = 1823693888, priority = 32651, unwind = 1841429743, c = 0x3}, {result = RLM_MODULE_HANDLED, priority = 0, unwind = 1823693888, c = 0x10}, {result = RLM_MODULE_USERLOCK, priority = 0, unwind = 26404800, c = 0x8}, {result = 1841415815, priority = 57, unwind = 8, c = 0x7f8b589caf50}, {result = 1841506360, priority = 57, unwind = 1486663584, c = 0x0}, {result = 1843648576, priority = 57, unwind = 1843648576, c = 0x3a20202389}, {result = 1486663584, priority = 32651, unwind = 27885456, c = 0x0}, {result = 1486663584, priority = 32651, unwind = 1843648576, c = 0x396dc20f10}, {result = RLM_MODULE_REJECT, priority = 0, unwind = 1486663584, c = 0x1a97f90}, {result = 27852576, priority = 0, unwind = 29811200, c = 0x1}, {result = 1823693984, priority = 32651, unwind = 1516734484, c = 0x7f8b6cb35ce0}, {result = 4323808, priority = 0, unwind = 1823694016, c = 0x1c6c590}} #29 0x000000000041fd95 in indexed_modcall (comp=MOD_POST_PROXY, idx=0, request=0x1c6c590) at /usr/src/debug/freeradius-server-3.0.10/src/main/modules.c:1009 rcode = <value optimized out> list = 0x1a67150 server = 0x1a5df00 #30 0x000000000042e8f3 in process_proxy_reply (request=0x1c6c590, reply=0x1c17060) at /usr/src/debug/freeradius-server-3.0.10/src/main/process.c:2394 rcode = <value optimized out> post_proxy_type = <value optimized out> vp = <value optimized out> #31 0x00000000004354c9 in proxy_running (request=0x1c6c590, action=<value optimized out>) at /usr/src/debug/freeradius-server-3.0.10/src/main/process.c:2741 __FUNCTION__ = "proxy_running" #32 0x000000000042cb4a in request_handler_thread (arg=0x16fbaa0) at /usr/src/debug/freeradius-server-3.0.10/src/main/threads.c:690 self = 0x16fbaa0 #33 0x0000003a1ae07a51 in start_thread () from /lib64/libpthread.so.0 No symbol table info available. #34 0x0000003a1aae89ad in clone () from /lib64/libc.so.6 No symbol table info available. As far as we have been able to discern, previous crashes didn't all occur in post-proxy. The same user authenticated successfully before, so it also doesn't seem to related to that specific user. I will post future backtraces if they offer new evidence. Please let me know if additional info would be helpful. -- .:.Sebastian Hagedorn - Weyertal 121 (Gebäude 133), Zimmer 2.02.:. .:.Regionales Rechenzentrum (RRZK).:. .:.Universität zu Köln / Cologne University - ✆ +49-221-470-89578.:.

3 7