February 2015 - Freeradius-Users - lists.freeradius.org

Usernames with escape sequences
by James Sumners 13 Apr '15

13 Apr '15

I have Freeradius authenticating to an Active Directory system via ntlm_auth. When a username in the format "foobar\jdoe" comes in, where "foobar" is the domain and "jdoe" is the real username, the authentication succeeds just fine. But if username is "foobar\tdoe" then it gets expanded to "foobar doe". Here's some real output where the passed in username was "CCSU\tstudent": ``` (0) mschap : Client is using MS-CHAPv1 with NT-Password (0) mschap : Executing: "/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-None} --domain=%{%{mschap:NT-Domain}:-None} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" (0) mschap : expand: "--username=%{%{mschap:User-Name}:-None}" -> '--username=CCSU student' (0) mschap : No NT-Domain was found in the User-Name. (0) mschap : expand: "--domain=%{%{mschap:NT-Domain}:-None}" -> '--domain=' (0) mschap : mschap1: ac (0) mschap : expand: "--challenge=%{%{mschap:Challenge}:-00}" -> '--challenge=ac132ce03cba1933' (0) mschap : expand: "--nt-response=%{%{mschap:NT-Response}:-00}" -> '--nt-response=ff768eafb00738e62a3a92e103bf5c7baa7d926da2248b88' (0) mschap : Program returned code (1): Logon failure (0xc000006d) (0) mschap : External script failed. (0) ERROR: mschap : External script says: Logon failure (0xc000006d) ``` How do I prevent the escape sequence from being expanded?

5 11

Fwd: Child is hung (max_request)
by srithar jeevadurai 25 Mar '15

25 Mar '15

Hi Team, We need your help to fix our radius server error. I kindly request you to help us on the same. We are facing 'Child is hung' message in our radius server and we have to restart radius server to become normal. As per our analysis the error message comes whenever there are more load on the server. *Configuration: * max_request_time = 30 cleanup_delay = 5 *max_requests = 12800* *max_queue_size = 131072* start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 Our system TPS is 100 (at max 120). Since we have kept max_request as 12,800 and max_request_time as 30 seconds, we will be able to support max backlog 3000 (TPS x max_request_time). That is our system can clear first 3000 requests in the queue before it faces 'time expire' (max_request_time). However we have set max_request as 12,800 during high load, system is facing 'child is hung' when the backlog grows more than 3000. Is our above understanding correct? If it is correct, we can resolve our issue by setting max_request as 3000 i.e. during high load, we will not face 'child is hung ' and no need to restart radius server to become normal. Looking forward for your reply. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

8 32

freeradius2 + iODBC + Informix
by vanish 19 Mar '15

19 Mar '15

Greeting, Fajar A. Nugraha-2, Alan DeKok-2. After yours answers i tried to rebuild freeradius with unixodbc module. 1. Install unixodbc and unixodbc-dev 2. Download 2.1.12 package: freeradius_2.1.12+dfsg-1.2ubuntu8.debian.tar.gz freeradius_2.1.12+dfsg-1.2ubuntu8.dsc freeradius_2.1.12+dfsg.orig.tar.bz2 2. Edit debian/rules : --prefix=/usr \ --exec-prefix=/usr \ --mandir=$(mandir) \ --sysconfdir=/etc \ --libdir=$(libdir) \ --datadir=/usr/share \ --localstatedir=/var \ --with-raddbdir=$(raddbdir) \ --with-logdir=/var/log/$(package) \ --enable-ltdl-install=no --enable-strict-dependencies \ --with-large-files --with-udpfromto --with-edir \ --enable-developer \ --config-cache \ --without-rlm_eap_tnc \ --with-rlm_sql_postgresql_lib_dir=`pg_config --libdir` \ --with-rlm_sql_postgresql_include_dir=`pg_config --includedir` \ --without-rlm_eap_ikev2 \ --without-rlm_sql_oracle \ !! --without-rlm_sql_iodbc \ !! --with-rlm_sql_unixodbc \ --with-system-libtool 3. Build package: dpkg-buildpackage -d -rfakeroot 4. Install deb packet: dpkg -i freeradius_2.1.12+dfsg-1.2ubuntu8_amd64.deb 5. Change sql.conf: +++++++++++++++++++++++++++++++++++++++++++++ sql { # # Set the database to one of: # # mysql, mssql, oracle, postgresql # database = "unixodbc" # # Which FreeRADIUS driver to use. # driver = "rlm_sql_${database}" # Connection info: server = "test.server.ru" port = 1425 login = "test" password = "test123" radius_db = "test" ... +++++++++++++++++++++++++++++++++++++++++++++ 6. freeradius -X showed me: rlm_sql (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked rlm_sql (sql): Attempting to connect to test@test.server.ru:1425/test rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_unixodbc #0 rlm_sql_unixodbc: Connection failed rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. 7. On test.server.ru i used tcpdump utils to see incoming packets from my machine with freeradius - but the entering packets was not detected. Please, help me find the mistake. -- ============================================ С уважением, Богучарский Иван Владимирович. Начальник СУТС ОРЭТС и ШПД ЗАО "Коламбия-Телеком". тел. 8-937-084-25-89.

7 10

Cache One Time Password OTP
by Gardner, Mark 16 Mar '15

16 Mar '15

Has anyone had success in getting free radius to cache a HOTP so it works like a TOTP. The problem I have is a ThinLinc authentication were our LDAP is configured for a HOTP, and ThinLink requires the OTP to be used twice in quick succession across the distributed architecture (once to master once to client) Looks like someone had some relative success IN Feb 2013 http://lists.freeradius.org/pipermail/freeradius-users/2013-February/065163… But I'm not following whats going on. Mark Gardner Www.gtopia.org/blog

3 7

Re: Expansion of \t and \n in message with linelong module
by paul.moser＠bt.com 13 Mar '15

13 Mar '15

(apologies if I've broken the threading - I shouldn't have subscribed using digest mode, now corrected) On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > The reason is that attributes can have embedded \n in them, either as binary or a as a string "\n". Using those attributes in the "linelog" module would then cause spurious new lines, and break your assumptions about what the log files mean. Very good point. Because the set of attributes we happen to use in the log entry don't include end user inputted data and the source of those packets we are safe from unexpected expansion for now, but our future intended use and as a general use case this is certainly what's known as a bad idea. Time to rethink. >Not with 3.0.6. We can take a look at correcting it for the next release. We’ve made other fixes in 3.0 which made it easier to separate the "literal" strings passed in from the config files, and the “end user” strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. Certainly that would help, but I should probably the end result we are trying to achieve in case linelog was completely the wrong approach. It sound like we are doing much the same as Matthew Newton, in addition to performing some normal authentication/authorization/accounting we also send information from those to another radius server as accounting packet - in some cases this is for additional auditing, sometimes as it enables other functionality - using the linelog module we could write out a file in the standard detail format but with just the attributes we wanted (and the type as accounting even if it had originally been an access request), and use a detail listener to pick that up and send them on. Is there some other way to do this that I've missed? I suspect the reason in our case that accounting packets are always used is just because historically it was more convenient to do so. Given we own the systems that the packets get sent onto it's possible that we may be able to change those systems to handle access request or response packets as well as accounting, and modify the source systems to use a detail writer/read and Proxy-to-realm setup rather linelog Paul ------------------------------ Message: 2 Date: Tue, 23 Dec 2014 11:05:23 -0500 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <E5F57FCB-CC38-4386-B922-3F36D37A3F88(a)deployingradius.com> Content-Type: text/plain; charset=windows-1252 On Dec 23, 2014, at 10:38 AM, paul.moser(a)bt.com wrote: > I have a 3.0.3 FR instance to which some additional logging has been added using the linelog module. The log messages that are written are multi-line and tab indented with \n and \t used in the format option in the linelog modules configuration file. That?s not really the intended use of the ?linelog? module. It logs lines of text.. not multiple lines. > I have also tried migrating another, older (v2.x) FR instance to v3.0.6. I started with a vanilla 3.0.6 configuration and successfully slowly modified that to give the same behaviour as the v2.x version. However when I finally attempted to add the additional logging that had been added to the 3.0.3 instance the log statements appearing in the log file are not multi-line or tab indented, neither the newline \n nor the tab \t have been expanded, \n and \t appear in the log file where I'd expected newlines and tabs to appear. > > I note in the changelog that for v3.0.5 correct_escapes was introduced and in a vanilla 3.0.6 configuration this is set to true It?s correct, and it creates many other simplifications of the source tree. > Taking my 3.0.3 configuration as is and running it against a 3.0.6 server it behaves just as it does with a 3.0.3 server - expanding \t and \n . However if I modify the configuration to set correct_escapes to true then literal \t and \n appear in the log file rather than tabs and newlines. Yes. That?s really the correct behaviour. The reason is that attributes can have embedded \n in them, either as binary or a as a string ?\n?. Using those attributes in the ?linelog? module would then cause spurious new lines, and break your assumptions about what the log files mean. > With 3.0.6, with correct_escapes=true, is it possible to use backslash escape sequences, or some equivalent to format linelog log messages? Not with 3.0.6. We can take a look at correcting it for the next release. We?ve made other fixes in 3.0 which made it easier to separate the ?literal? strings passed in from the config files, and the ?end user? strings taken from a RADIUS packet. We can have the linelog module convert \n -> CR for literal strings you enter, but not do that expansion for strings taken from RADIUS packets. > It maybe that the expansion of \n and \t in 3.0.3 was just undocumented behaviour that we stumbled upon and utilised rather than expected behaviour, the fact that the module is called line (singular) log may indicated we should not expect it to write multi-line log statements. Both. > I realise that I could just set correct_escapes=false in my 3.0.6 instances, I have briefly tried this however much of the default configuration now appears to assume the correct escapes and I'd have to unwind all those changes. I suspect if I did this I'd just be storing up trouble for myself some point in the future. I?d recommend keeping the new behaviour. It?s *much* more intuitive. Alan DeKok. ------------------------------ Message: 3 Date: Tue, 23 Dec 2014 23:27:27 +0000 From: Matthew Newton <mcn4(a)leicester.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <20141223232727.GA19006(a)rootmail.cc.le.ac.uk> Content-Type: text/plain; charset=utf-8 On Tue, Dec 23, 2014 at 11:05:23AM -0500, Alan DeKok wrote: > That?s not really the intended use of the ?linelog? module. > It logs lines of text.. not multiple lines. Of course, "intended" and "what's useful" are two different things. We're also (ab-)using linelog to write out detail log format. These are then picked up by the detail reader and fed (as accounting packets) across to a central RADIUS server for common logging. It means we can set exactly which attributes to forward. Because of the way the logging and detail reader works it is also reliable if the central server goes away for some reason. I guess the alternative would be to have an "include" option for the detail module, countering the "suppress" option. But that's only for our use case. > Not with 3.0.6. We can take a look at correcting it for the > next release. We?ve made other fixes in 3.0 which made it > easier to separate the ?literal? strings passed in from the > config files, and the ?end user? strings taken from a RADIUS > packet. We can have the linelog module convert \n -> CR for > literal strings you enter, but not do that expansion for > strings taken from RADIUS packets. That would seem the more sensible option - expand \n, \t etc in the string first, then expand %{..}. But I get that string expansion is pretty tricky in the ordering it needs to be done to get a sane output for all cases. Cheers Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> ------------------------------ Message: 4 Date: Tue, 23 Dec 2014 23:48:11 +0000 From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>, Matthew Newton <mcn4(a)leicester.ac.uk> Subject: Re: Expansion of \t and \n in message with linelong module and correct_escapes = true with v3.0.6 Message-ID: <ABEC402F-CA0B-418A-A14F-C7F97692988B(a)lboro.ac.uk> Content-Type: text/plain; charset="utf-8" buffered_sql with extra attr_filter rule? alan -- Sent from my Android device with K-9 Mail. Please excuse my brevity.

3 5

MACSEC on Cisco 3750-X and FreeRADIUS 2.2.5
by Krause, Kilian 10 Mar '15

10 Mar '15

Hi, we're currently trying to get MACSEC (802.1ae) configured on a Cisco WS-C3750X-48P running IP base 15.0(2)SE7 on customer facing ports. For authentication we've got a radiator 4.14 as radius proxy configured on the switch and forward all (in this case only EAP) requests onto a FreeRADIUS 2.2.5+dfsg-0.1~bpo70+1 (Debian wheezy backports). The authenticating client is a Win7 (x86_64) running AnyConnect 3.1.06079. As per http://lists.freeradius.org/pipermail/freeradius-users/2013-February/065041… MACSEC should be working ok (since around 2.2.1 or 2.2.2) when uncommenting the relevant part in sites-enabled/default (which we've done). Yet, we do see: - with PEAP: ... Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +group authenticate { [eap] Badly formatted EAP Message: Ignoring the packet [eap] Failed in handler ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. This seems to be identical whether use_mppe is set to 'yes' or 'no' in modules/mschap. - with EAP-TTLS just an empty EAP-Key-Name/reply:EAP-Session-Id (in sites-enabled/default) Even though EAP-TTLS is sending an Access-Accept I don't get the AnyConnect supplicant to be happy about it and the auth is stuck in an authentication loop without actually getting connectivity to the system. Since all of the relevant howtos I could find on the 'net either cover only the switch config alone or a combination of switch and Cisco ISE I'd like to raise the question whether anyone around here has gotten a similar setup up and running already. If anyone has a good starting point to continue debugging further I'm all ears. TIA! Best regards, Kilian -- Kilian Krause Netze und Kommunikationssysteme (NKS) Informations- und Kommunikationszentrum der Universität Stuttgart (IZUS) Technische Informations- und Kommunikationsdienste (TIK, ehem. RUS) Tel.: +49 (711) 685-64512 Fax.: +49 (711) 685-54512 (PC) Fax.: +49 (711) 68 23 57 Allmandring 30a 70550 Stuttgart DEUTSCHLAND

9 54

Eap-Sim cannot initiate in Free Radius 3.0.6
by Ankit Prajapati 10 Mar '15

10 Mar '15

Hi , I am trying to run Eap-Sim in Free Radius v.3.0.6. I have configured RAND,KC's,SRES value in "raddb/mods-config/files/authorize" file , as per suggestion from some forum i have added eap sim trilpets values in straight line : IMSI EAP-Type :=SIM ,EAP-Sim-Rand1 :=<>,EAP-Sim-SRES1 :=<> ,Eap-Sim-KC1 :=<>, ........EAP-Sim-KC3 := <>. also configured eap-sim in eap configuration file. Now when i am trying to connect with the device get following errors: S *at Feb 28 14:27:38 2015 : Debug: (0) eap: Peer sent method Identity (1)Sat Feb 28 14:27:38 2015 : Debug: (0) eap: Calling eap_sim to process EAP dataSat Feb 28 14:27:38 2015 : ERROR: (0) eap_sim: ERROR: EAP-SIM-RAND1 not foundSat Feb 28 14:27:38 2015 : ERROR: (0) eap: ERROR: Failed starting EAP SIM (18) session. EAP sub-module failedSat Feb 28 14:27:38 2015 : Debug: (0) eap: Failed in EAP selectSat Feb 28 14:27:38 2015 : Debug: (0) modsingle[authenticate]: returned from eap (rlm_eap) for request 0* Also tried this solution also http://freeradius.1045715.n5.nabble.com/freeradius-3-cannot-initiate-eap-si… but not to able to resolve the issue ... Can some one help me ? -- -Thanks Ankit Prajapati

2 6

ipaddr, ipv4addr ipv6addr
by Arran Cudbard-Bell 06 Mar '15

06 Mar '15

The behaviour of the ipaddr config item has changed slightly for 3.0.4. If the ipaddr value contains ':' or '[' or ']', it will be treated as an IPv6 address. If it fails to parse as an IPv6 address the server will refuse to start. If the ipaddr value does not contain any ipv6 chars the server will first check to see if it looks like an ipv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else if a AAAA record is available else the server will refuse to start. If instead of the ipaddr config item the ipv4addr config item is used the server will check if it looks like an IPv4 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching A record is available it will be used, else the server will refuse to start. If instead of the ipaddr config item the ipv6addr config item is used the server will check if it looks like an IPv6 address. If it does, the server will parse it, if it doesn't and DNS resolution is enabled, it will instead attempt to resolve it. If DNS resolution is not enabled the server will refuse to start. If a matching AAAA record is available it will be used, else the server will refuse to start. The behaviour is similar for the client, home_server and listen sections. Though those config items in client sections may have an optional /[0-9]{1,3} suffix to map clients to ranges of IP addresses. This should also work with things like example.org/96 though i'm not entirely sure why you'd ever want to do that. 'netmask' is now deprecated but will still function as expected until 3.1.0. These changes should make it slightly easier to manage v4/v6 transitions. Wildcard clients 0.0.0.0 <ipaddr>/0 '*' are not supported. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 15

Accept all users?
by Dominik Menke 04 Mar '15

04 Mar '15

Hello list, I'm trying to secure my wireless networks with RADIUS, so that any combination of username/password will let the user in. So far I tried to add this line to my `users` file: DEFAULT Auth-Type := Accept With radtest I could get a positive feedback, but when I wire up the RADIUS server with my wireless AP and try to connect (via EAP-TTLS/MSCHAPv2), no connection is established. This happens on both a TP-Link router with OpenWRT and an Ubiquity UniFy AP as access point. Here's the debug output of freeradius (excerpt, the full log is attached): > rad_recv: Access-Request packet from host 192.168.8.1 port 60199, id=16, length=190 > User-Name = "foousername" > Called-Station-Id = "C2-4A-00-6C-F1-53:use.any.password" > NAS-Port-Type = Wireless-802.11 > NAS-Port = 1 > Calling-Station-Id = "E8-DE-27-1D-04-02" > Connect-Info = "CONNECT 54Mbps 802.11g" > Acct-Session-Id = "54EC901D-00000008" > Framed-MTU = 1400 > EAP-Message = 0x029f001001666f6f757365726e616d65 > Message-Authenticator = 0xd8aca58525e34524e692e7a0d3f6eab9 > # Executing section authorize from file /etc/freeradius/sites-enabled/default > +group authorize { > ++[preprocess] = ok > ++[chap] = noop > ++[mschap] = noop > [eap] EAP packet type response id 159 length 16 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] = updated > [files] users: Matched entry DEFAULT at line 1 > ++[files] = ok > ++[logintime] = noop > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] = noop > +} # group authorize = updated > Found Auth-Type = Accept > Auth-Type = Accept, accepting the user > # Executing section post-auth from file /etc/freeradius/sites-enabled/default > +group post-auth { > ++[exec] = noop > +} # group post-auth = noop > Sending Access-Accept of id 16 to 192.168.8.1 port 60199 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 0 ID 16 with timestamp +5 The "sites-enabled/default" config is pretty much untouched from installation. For me it seems like a successful user authorization? When running tcpdump on the access point, I only see the outgoing EAP package. I'm a bit clueless now... Greetings, Dominik

4 5

rlm_cache NT-Password with EAP-PEAP
by Sherker, Donald 02 Mar '15

02 Mar '15

We are trying to setup a freeradius 3.0.7 server that uses EAP-PEAP and EAP-TTLS, both with MSCHAPv2. This server reads a users Cleartext-Password from an ldap server. In order to minimize the calls to the ldap server we are trying to use rlm_cache to cache the NT-Password and LM-Password so that when a user logs in after the initial log in freeradius does not need to query the ldap server. This works with EAP-TTLS, but it does not work with EAP-PEAP. The NT-Password and LM-Password do not seem to be available to the caching module with EAP-PEAP. I am pasting the parts of the config files related to this below. Please let me know if there is any other information needed. mods-enabled/cache: update { control:NT-Password := "%{control:NT-Password}" control:LM-Password := "%{control:LM-Password}" } mods-enabled/eap: eap { default_eap_type = peap ignore_unknown_eap_types = no ttls { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } peap { tls = tls-common default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } } sites-enabled/inner-tunnel: authorize { eap { ok = return } update control { Cache-Status-Only = 'yes' } cache if (notfound) { ldap } else { cache } mschap } post-auth { cache } I am also posting excerpts from the debug, again if more is needed let me know. This is for en EAP-TTLS session: Tue Feb 24 16:32:57 2015 : Debug: (7) modsingle[post-auth]: calling cache (rlm_cache) for request 7 Tue Feb 24 16:32:57 2015 : Debug: %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:32:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:32:57 2015 : Debug: attribute --> User-Name Tue Feb 24 16:32:57 2015 : Debug: attribute --> Calling-Station-Id Tue Feb 24 16:32:57 2015 : Debug: (7) cache: EXPAND %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:32:57 2015 : Debug: (7) cache: --> andyresd022be6e8229 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Mutex acquired Tue Feb 24 16:32:57 2015 : Debug: (7) cache: No cache entry found for "andyresd022be6e8229" Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Creating new cache entry Tue Feb 24 16:32:57 2015 : Debug: %{control:NT-Password} Tue Feb 24 16:32:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:32:57 2015 : Debug: attribute --> NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: EXPAND %{control:NT-Password} Tue Feb 24 16:32:57 2015 : Debug: (7) cache: --> 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: control:NT-Password := 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Merging cache entry into request Tue Feb 24 16:32:57 2015 : Debug: (7) cache: &control:NT-Password := 0x927b45aa1c222ebeaad483703f11c465 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: FROM 1 TO 6 MAX 7 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: Examining NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: OVERWRITING NT-Password FROM 0 TO 4 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: TO in 6 out 6 Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[0] = Proxy-To-Realm Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[1] = Ldap-UserDn Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[2] = Cleartext-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[3] = Auth-Type Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[4] = NT-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: ::: to[5] = LM-Password Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Commited entry, TTL 86400 seconds Tue Feb 24 16:32:57 2015 : Debug: (7) cache: Mutex released Tue Feb 24 16:32:57 2015 : Debug: (7) modsingle[post-auth]: returned from cache (rlm_cache) for request 7 Tue Feb 24 16:32:57 2015 : Debug: (7) [cache] = updated Tue Feb 24 16:32:57 2015 : Debug: (7) } # post-auth = updated Tue Feb 24 16:32:57 2015 : Debug: (7) } # server inner-tunnel This is for an EAP-PEAP Session: Tue Feb 24 16:34:57 2015 : Debug: (8) modsingle[post-auth]: calling cache (rlm_cache) for request 8 Tue Feb 24 16:34:57 2015 : Debug: %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> User-Name Tue Feb 24 16:34:57 2015 : Debug: attribute --> Calling-Station-Id Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{User-Name}%{outer.request:Calling-Station-Id} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> qaresdonE8-99-C4-72-33-D8 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Mutex acquired Tue Feb 24 16:34:57 2015 : Debug: (8) cache: No cache entry found for "qaresdonE8-99-C4-72-33-D8" Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Creating new cache entry Tue Feb 24 16:34:57 2015 : Debug: %{control:NT-Password} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{control:NT-Password} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> Tue Feb 24 16:34:57 2015 : Debug: (8) cache: control:NT-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: %{control:LM-Password} Tue Feb 24 16:34:57 2015 : Debug: Parsed xlat tree: Tue Feb 24 16:34:57 2015 : Debug: attribute --> LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: EXPAND %{control:LM-Password} Tue Feb 24 16:34:57 2015 : Debug: (8) cache: --> Tue Feb 24 16:34:57 2015 : Debug: (8) cache: control:LM-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Merging cache entry into request Tue Feb 24 16:34:57 2015 : Debug: (8) cache: &control:NT-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: &control:LM-Password := 0x Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: FROM 2 TO 4 MAX 6 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: Examining NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: APPENDING NT-Password FROM 0 TO 4 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: Examining LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: APPENDING LM-Password FROM 1 TO 5 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: TO in 4 out 6 Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[0] = Proxy-To-Realm Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[1] = Auth-Type Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[2] = Ldap-UserDn Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[3] = Cleartext-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[4] = NT-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: ::: to[5] = LM-Password Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Commited entry, TTL 86400 seconds Tue Feb 24 16:34:57 2015 : Debug: (8) cache: Mutex released ________________________________ CONFIDENTIALITY NOTICE: This e-mail may contain information that is privileged, confidential or otherwise protected from disclosure. **If you are not the intended recipient of this e-mail, please notify the sender immediately by return e-mail, purge it and do not disseminate or copy it.

4 16