Freeradius-Users
Threads by month
- ----- 2026 -----
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
December 2017
- 59 participants
- 87 discussions
Hi,
I'd like to know why FR thinks that the outer User-Name is not anonymized when a Windows client connects with supposedly anonymized identity (blank or 'anon').
Is it because the domain part is always passed even if the user is blank?
Does it all rely on the filter_inner_identity function in policy.d?
If that's the case then this function expects @ as the user/domain seperator. Windows clients send \ as the seperator.
So I guess I can either ignore the warning or change the function.
(8) Received Access-Request Id 0 from 10.215.147.140:49154 to 10.215.144.91:1812 length 147
(8) NAS-IP-Address = 10.215.147.140
(8) NAS-Port-Type = Ethernet
(8) NAS-Port = 43
(8) User-Name = "DOMAIN\\"
(8) State = 0x8f4c1991884500fd085fc9de274e79da
(8) Calling-Station-Id = "DC-4A-3E-06-11-46"
[...]
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "DOMAIN\", looking up realm NULL
(8) suffix: No such realm "NULL"
(8) [suffix] = noop
(8) ntdomain: Checking for prefix before "\"
(8) ntdomain: Looking up realm "DOMAIN" for User-Name = "DOMAIN\"
(8) ntdomain: No such realm "DOMAIN"
(8) [ntdomain] = noop
(8) [expiration] = noop
(8) [logintime] = noop
(8) } # authorize = updated
(8) Found Auth-Type = eap
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8) authenticate {
(8) eap: Expiring EAP session with state 0x052a3c3004232630
(8) eap: Finished EAP session with state 0x8f4c1991884500fd
(8) eap: Previous EAP request found for state 0x8f4c1991884500fd, released from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: Continuing EAP-TLS
(8) eap_peap: [eaptls verify] = ok
(8) eap_peap: Done initial handshake
(8) eap_peap: [eaptls process] = ok
(8) eap_peap: Session established. Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP method MSCHAPv2 (26)
(8) eap_peap: Got tunneled request
(8) eap_peap: EAP-Message = 0x020900061a03
(8) eap_peap: Setting User-Name to DOMAIN\adminpc
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap: EAP-Message = 0x020900061a03
(8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap: User-Name = "DOMAIN\\adminpc"
(8) eap_peap: State = 0x052a3c3004232630e22377547b424230
(8) Virtual server inner-tunnel received request
(8) EAP-Message = 0x020900061a03
(8) FreeRADIUS-Proxied-To = 127.0.0.1
(8) User-Name = "DOMAIN\\adminpc"
(8) State = 0x052a3c3004232630e22377547b424230
(8) WARNING: Outer User-Name is not anonymized. User privacy is compromised.
Thanks,
Vieri
2
1
Dear list,
First, I must say that FreeRadius is in my humble opinion, the best open
source project out there: top dev team, well documented, proactive mailing
list, and above all, you can find it anywhere inside the security vendors
solutions ... and that's a few of the advantages. I had to get that out of
my chest before anything ... so Thank you for all the devs out there, for
the idea and for making such a beautiful, stable and strong product ! I
really hope that I would be able to contribute one day, even if its for the
documentation since I m not good at coding :)
Here come worries: I have setup inside 4 different companies a 802.1X
solution (of course based on FreeRadius) and everything is working like a
charm, (FreeRADIUS v 3.0.14) but in one of the secondary server (the main
and the backup is linked through UCARP VRRP) which is currently serving
around 400 supplicants, it is dropping the clients (randomly) after a
timeout. below the setup (simple enough):
FreeRADIUS authenticates the client (supplicants) to the AD, then verifies
if its MAC address is authorized to connect or not.
I suspect that is related to the following:
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: EXPAND
--nt-response=%{%{mschap:NT-Response}:-00}
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: --> --nt-response=
ebe1377d01d09cbe0bfda9256149732ec2b94b30d4cbc327
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.4 seconds.
Wed Dec 13 16:39:53 2017 : Debug: Waking up in 0.7 seconds.
Wed Dec 13 16:39:53 2017 : Debug: Waking up in 1.1 seconds.
But I am not sure. If the above is however correct, does it mean that it is
waiting for the AD to reply or is it just misbehaving ? Please find below
the full log for your reference.
Wed Dec 13 16:37:53 2017 : Debug: (57) Cleaning up request packet ID 238
with timestamp +1892
Wed Dec 13 16:37:53 2017 : Debug: (58) Cleaning up request packet ID 239
with timestamp +1892
Wed Dec 13 16:37:53 2017 : Debug: (59) Cleaning up request packet ID 240
with timestamp +1892
Wed Dec 13 16:37:53 2017 : Debug: (60) Cleaning up request packet ID 241
with timestamp +1892
Wed Dec 13 16:37:53 2017 : Debug: (61) Cleaning up request packet ID 242
with timestamp +1892
Wed Dec 13 16:37:53 2017 : Debug: Waking up in 2.6 seconds.
Wed Dec 13 16:37:55 2017 : Debug: (62) Cleaning up request packet ID 243
with timestamp +1892
Wed Dec 13 16:37:55 2017 : Debug: (63) Cleaning up request packet ID 244
with timestamp +1894
Wed Dec 13 16:37:55 2017 : Debug: (64) Cleaning up request packet ID 245
with timestamp +1894
Wed Dec 13 16:37:55 2017 : Info: Ready to process requests
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.3 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 4 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 4 handling request 66, (14 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (66) Received Access-Request Id 246 from
10.100.100.114:1645 to 192.168.10.13:1812 length 182
Wed Dec 13 16:39:52 2017 : Debug: (66) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (66) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (66) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (66) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (66) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (66) EAP-Message =
0x02e4001b01686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (66) Message-Authenticator =
0x04fc640c7390637c2393ca8d33dd9bc1
Wed Dec 13 16:39:52 2017 : Debug: (66) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (66) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (66) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (66) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (66) session-state: No State attribute
Wed Dec 13 16:39:52 2017 : Debug: (66) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (66) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (66) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (66) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (66) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (66) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (66) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (66) update request {
Wed Dec 13 16:39:52 2017 : Debug: (66) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (66) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (66) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (66) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (66) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (66) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (66) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (66) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (66) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (66) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (66) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (66) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (11):
Hit idle_timeout, was idle for 124 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (18):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (20):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (19):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (16):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (14):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (13):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (17):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): You probably need to lower
"min"
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (12):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): You probably need to lower
"min"
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Closing connection (15):
Hit idle_timeout, was idle for 122 seconds
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): You probably need to lower
"min"
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Socket destructor called,
closing socket
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): 0 of 0 connections in
use. You may need to increase "spare"
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Opening additional
connection (21), 1 of 32 pending slots used
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Starting connect to MySQL
server
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Connected to database
'radius' on Localhost via UNIX socket, server version
10.1.23-MariaDB-9+deb9u1, protocol version 10
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (66) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (66) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (66) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Info: Need 2 more connections to reach min
connections (3)
Wed Dec 13 16:39:52 2017 : Info: rlm_sql (sql): Opening additional
connection (22), 1 of 31 pending slots used
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Starting connect to MySQL
server
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql_mysql: Connected to database
'radius' on Localhost via UNIX socket, server version
10.1.23-MariaDB-9+deb9u1, protocol version 10
Wed Dec 13 16:39:52 2017 : Debug: (66) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (66) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (66) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (66) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (66) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (66) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (66) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (66) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (66) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (66) else {
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (66) eap: Peer sent EAP Response (code 2)
ID 228 length 27
Wed Dec 13 16:39:52 2017 : Debug: (66) eap: EAP-Identity reply, returning
'ok' so we can short-circuit the rest of authorize
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (66) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (66) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (66) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (66) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (66) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (66) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (66) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (66) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (66) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (66) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (66) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (66) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (66) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (66) eap: Peer sent packet with method
EAP Identity (1)
Wed Dec 13 16:39:52 2017 : Debug: (66) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (66) eap_peap: Initiating new EAP-TLS
session
Wed Dec 13 16:39:52 2017 : Debug: (66) eap_peap: [eaptls start] = request
Wed Dec 13 16:39:52 2017 : Debug: (66) eap: Sending EAP Request (code 1) ID
229 length 6
Wed Dec 13 16:39:52 2017 : Debug: (66) eap: EAP session adding &reply:State
= 0xb2f1dd18b214c4f8
Wed Dec 13 16:39:52 2017 : Debug: (66) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (66) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (66) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (66) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (66) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (66) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (66) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (66) Sent Access-Challenge Id 246 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (66) EAP-Message = 0x01e500061920
Wed Dec 13 16:39:52 2017 : Debug: (66) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (66) State =
0xb2f1dd18b214c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (66) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 4 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.3 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 3 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 3 handling request 67, (14 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (67) Received Access-Request Id 247 from
10.100.100.114:1645 to 192.168.10.13:1812 length 314
Wed Dec 13 16:39:52 2017 : Debug: (67) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (67) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (67) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (67) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (67) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (67) EAP-Message =
0x02e5008d198000000083160301007e0100007a03015a312da838e7eb1277eaaa0fe2229f41baff2203ce5cf8f0da422f16716293f02090ca41f41126a4070993bf7e66c7af11671f312c47dfa47f49044b66fb877aad0018002f00350005000ac013c014c009c00a003200380013000401000019000a00
Wed Dec 13 16:39:52 2017 : Debug: (67) Message-Authenticator =
0xf634b9f7b146caf2075346e7d611b0df
Wed Dec 13 16:39:52 2017 : Debug: (67) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (67) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (67) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (67) State =
0xb2f1dd18b214c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (67) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (67) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (67) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (67) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (67) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (67) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (67) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (67) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (67) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (67) update request {
Wed Dec 13 16:39:52 2017 : Debug: (67) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (67) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (67) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (67) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (67) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (67) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (67) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (67) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (67) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (67) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (67) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (67) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (67) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (67) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (67) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (67) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (67) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (67) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (67) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (67) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (67) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (67) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (67) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (67) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (67) else {
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Peer sent EAP Response (code 2)
ID 229 length 141
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (67) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (67) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (67) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (67) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (67) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (67) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (67) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (67) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (67) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (67) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (67) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (67) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (67) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Expiring EAP session with state
0xb2f1dd18b214c4f8
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Finished EAP session with state
0xb2f1dd18b214c4f8
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Previous EAP request found for
state 0xb2f1dd18b214c4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: Peer sent flags --L
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: Peer indicated complete
TLS record size will be 131 bytes
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: Got complete TLS record
(131 bytes)
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: [eaptls verify] = length
included
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: (other): before SSL
initialization
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: before SSL
initialization
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: before SSL
initialization
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: <<< recv TLS 1.2 [length
007e]
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: SSLv3/TLS read
client hello
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: >>> send TLS 1.0 Handshake
[length 0055], ServerHello
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: SSLv3/TLS
write server hello
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: >>> send TLS 1.0 Handshake
[length 08da], Certificate
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: SSLv3/TLS
write certificate
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: >>> send TLS 1.0 Handshake
[length 0004], ServerHelloDone
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: SSLv3/TLS
write server done
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: TLS_accept: Need to read
more data: SSLv3/TLS write server done
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: In SSL Handshake Phase
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: In SSL Accept mode
Wed Dec 13 16:39:52 2017 : Debug: (67) eap_peap: [eaptls process] = handled
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: Sending EAP Request (code 1) ID
230 length 1014
Wed Dec 13 16:39:52 2017 : Debug: (67) eap: EAP session adding &reply:State
= 0xb2f1dd18b317c4f8
Wed Dec 13 16:39:52 2017 : Debug: (67) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (67) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (67) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (67) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (67) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (67) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (67) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (67) Sent Access-Challenge Id 247 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (67) EAP-Message =
0x01e603f619c0000009421603010055020000510301689a651941a5eb17ffc97c35e3d98edfef8bb6c4bc562ac4d3a5af00efaa4ca52095db7d9e2523aae891c1d018e9ed1044ea85ec6edaec542ec57336414956fad0002f000009ff010001000017000016030108da0b0008d60008d30003e2308203de
Wed Dec 13 16:39:52 2017 : Debug: (67) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (67) State =
0xb2f1dd18b317c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (67) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 3 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.3 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 2 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 2 handling request 68, (14 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (68) Received Access-Request Id 248 from
10.100.100.114:1645 to 192.168.10.13:1812 length 179
Wed Dec 13 16:39:52 2017 : Debug: (68) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (68) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (68) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (68) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (68) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (68) EAP-Message = 0x02e600061900
Wed Dec 13 16:39:52 2017 : Debug: (68) Message-Authenticator =
0x089978e5410c85c595afe9a72f4c9187
Wed Dec 13 16:39:52 2017 : Debug: (68) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (68) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (68) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (68) State =
0xb2f1dd18b317c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (68) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (68) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (68) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (68) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (68) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (68) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (68) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (68) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (68) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (68) update request {
Wed Dec 13 16:39:52 2017 : Debug: (68) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (68) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (68) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (68) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (68) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (68) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (68) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (68) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (68) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (68) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (68) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (68) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (68) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (68) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (68) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (68) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (68) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (68) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (68) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (68) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (68) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (68) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (68) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (68) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (68) else {
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Peer sent EAP Response (code 2)
ID 230 length 6
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (68) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (68) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (68) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (68) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (68) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (68) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (68) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (68) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (68) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (68) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (68) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (68) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (68) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Expiring EAP session with state
0xb2f1dd18b317c4f8
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Finished EAP session with state
0xb2f1dd18b317c4f8
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Previous EAP request found for
state 0xb2f1dd18b317c4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (68) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (68) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:52 2017 : Debug: (68) eap_peap: Peer ACKed our handshake
fragment
Wed Dec 13 16:39:52 2017 : Debug: (68) eap_peap: [eaptls verify] = request
Wed Dec 13 16:39:52 2017 : Debug: (68) eap_peap: [eaptls process] = handled
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: Sending EAP Request (code 1) ID
231 length 1010
Wed Dec 13 16:39:52 2017 : Debug: (68) eap: EAP session adding &reply:State
= 0xb2f1dd18b016c4f8
Wed Dec 13 16:39:52 2017 : Debug: (68) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (68) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (68) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (68) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (68) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (68) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (68) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (68) Sent Access-Challenge Id 248 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (68) EAP-Message =
0x01e703f219402fd0040cc7a2836a3d5a9474629f257654ef4ae2e1aa2252a7cf7ad7ba7b88669dcd3e1d83545f01725b22bcf9611db89530220d34b7613c31723b148c10d512e6c3fc3b03a5fd663feb73996729bcb9317599a1532f494c64ceb1d42978530004eb308204e7308203cfa0030201020209
Wed Dec 13 16:39:52 2017 : Debug: (68) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (68) State =
0xb2f1dd18b016c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (68) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 2 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 1 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 1 handling request 69, (14 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (69) Received Access-Request Id 249 from
10.100.100.114:1645 to 192.168.10.13:1812 length 179
Wed Dec 13 16:39:52 2017 : Debug: (69) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (69) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (69) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (69) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (69) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (69) EAP-Message = 0x02e700061900
Wed Dec 13 16:39:52 2017 : Debug: (69) Message-Authenticator =
0xf29aeea458cb4107726abd1c6e709dad
Wed Dec 13 16:39:52 2017 : Debug: (69) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (69) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (69) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (69) State =
0xb2f1dd18b016c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (69) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (69) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (69) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (69) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (69) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (69) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (69) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (69) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (69) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (69) update request {
Wed Dec 13 16:39:52 2017 : Debug: (69) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (69) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (69) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (69) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (69) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (69) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (69) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (69) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (69) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (69) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (69) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (69) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (69) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (69) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (69) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (69) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (69) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (69) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (69) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (69) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (69) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (69) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (69) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (69) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (69) else {
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Peer sent EAP Response (code 2)
ID 231 length 6
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (69) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (69) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (69) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (69) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (69) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (69) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (69) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (69) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (69) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (69) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (69) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (69) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (69) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Expiring EAP session with state
0xb2f1dd18b016c4f8
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Finished EAP session with state
0xb2f1dd18b016c4f8
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Previous EAP request found for
state 0xb2f1dd18b016c4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (69) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (69) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:52 2017 : Debug: (69) eap_peap: Peer ACKed our handshake
fragment
Wed Dec 13 16:39:52 2017 : Debug: (69) eap_peap: [eaptls verify] = request
Wed Dec 13 16:39:52 2017 : Debug: (69) eap_peap: [eaptls process] = handled
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: Sending EAP Request (code 1) ID
232 length 368
Wed Dec 13 16:39:52 2017 : Debug: (69) eap: EAP session adding &reply:State
= 0xb2f1dd18b119c4f8
Wed Dec 13 16:39:52 2017 : Debug: (69) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (69) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (69) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (69) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (69) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (69) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (69) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (69) Sent Access-Challenge Id 249 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (69) EAP-Message =
0x01e80170190024b44b9e300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b0500038201010008f415e3691f090f70e2a03127503e0d
Wed Dec 13 16:39:52 2017 : Debug: (69) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (69) State =
0xb2f1dd18b119c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (69) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 1 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 5 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 5 handling request 70, (15 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (70) Received Access-Request Id 250 from
10.100.100.114:1645 to 192.168.10.13:1812 length 511
Wed Dec 13 16:39:52 2017 : Debug: (70) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (70) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (70) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (70) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (70) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (70) EAP-Message =
0x02e801501980000001461603010106100001020100eaef314b15e9bd4de9194789038a3fe2d488a349d02e6fe56721aa3d6ef8c0c66a59aed00c5e3df4fd312b0dcca1f0fc3a93d89bd3134b0905fa518d3622ce610ba422e9965aaa9d4b87a8180efb7d567874f40bc9276ed0750387c4f997f721e9e5
Wed Dec 13 16:39:52 2017 : Debug: (70) Message-Authenticator =
0x27e98b94cc274bf7fdad3396f2e191fe
Wed Dec 13 16:39:52 2017 : Debug: (70) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (70) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (70) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (70) State =
0xb2f1dd18b119c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (70) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (70) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (70) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (70) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (70) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (70) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (70) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (70) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (70) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (70) update request {
Wed Dec 13 16:39:52 2017 : Debug: (70) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (70) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (70) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (70) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (70) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (70) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (70) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (70) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (70) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (70) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (70) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (70) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (70) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (70) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (70) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (70) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (70) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (70) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (70) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (70) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (70) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (70) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (70) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (70) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (70) else {
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Peer sent EAP Response (code 2)
ID 232 length 336
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (70) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (70) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (70) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (70) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (70) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (70) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (70) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (70) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (70) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (70) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (70) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (70) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (70) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Expiring EAP session with state
0xb2f1dd18b119c4f8
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Finished EAP session with state
0xb2f1dd18b119c4f8
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Previous EAP request found for
state 0xb2f1dd18b119c4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: Peer sent flags --L
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: Peer indicated complete
TLS record size will be 326 bytes
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: Got complete TLS record
(326 bytes)
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: [eaptls verify] = length
included
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: TLS_accept: SSLv3/TLS
write server done
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: <<< recv TLS 1.0 Handshake
[length 0106], ClientKeyExchange
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: TLS_accept: SSLv3/TLS read
client key exchange
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: TLS_accept: SSLv3/TLS read
change cipher spec
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: <<< recv TLS 1.0 Handshake
[length 0010], Finished
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: TLS_accept: SSLv3/TLS read
finished
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: >>> send TLS 1.0
ChangeCipherSpec [length 0001]
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: TLS_accept: SSLv3/TLS
write change cipher spec
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: >>> send TLS 1.0 Handshake
[length 0010], Finished
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: TLS_accept: SSLv3/TLS
write finished
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: (other): SSL negotiation
finished successfully
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: SSL Connection Established
Wed Dec 13 16:39:52 2017 : Debug: (70) eap_peap: [eaptls process] = handled
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: Sending EAP Request (code 1) ID
233 length 65
Wed Dec 13 16:39:52 2017 : Debug: (70) eap: EAP session adding &reply:State
= 0xb2f1dd18b618c4f8
Wed Dec 13 16:39:52 2017 : Debug: (70) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (70) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (70) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (70) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (70) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (70) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (70) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (70) Sent Access-Challenge Id 250 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (70) EAP-Message =
0x01e900411900140301000101160301003066ffee845b52179f6faf0d91732f48ea0af013c1bf71f9d0b802f57d679e6aaac945e788b62aa2e358c26dbfedfa283c
Wed Dec 13 16:39:52 2017 : Debug: (70) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (70) State =
0xb2f1dd18b618c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (70) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 5 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 4 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 4 handling request 71, (15 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (71) Received Access-Request Id 251 from
10.100.100.114:1645 to 192.168.10.13:1812 length 179
Wed Dec 13 16:39:52 2017 : Debug: (71) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (71) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (71) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (71) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (71) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (71) EAP-Message = 0x02e900061900
Wed Dec 13 16:39:52 2017 : Debug: (71) Message-Authenticator =
0xd779fd84efcfda5554cca7b2bf28828b
Wed Dec 13 16:39:52 2017 : Debug: (71) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (71) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (71) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (71) State =
0xb2f1dd18b618c4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (71) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (71) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (71) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (71) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (71) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (71) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (71) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (71) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (71) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (71) update request {
Wed Dec 13 16:39:52 2017 : Debug: (71) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (71) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (71) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (71) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (71) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (71) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (71) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (71) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (71) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (71) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (71) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (71) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (71) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (71) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (71) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (71) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (71) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (71) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (71) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (71) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (71) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (71) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (71) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (71) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (71) else {
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Peer sent EAP Response (code 2)
ID 233 length 6
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (71) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (71) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (71) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (71) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (71) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (71) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (71) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (71) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (71) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (71) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (71) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (71) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (71) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Expiring EAP session with state
0xb2f1dd18b618c4f8
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Finished EAP session with state
0xb2f1dd18b618c4f8
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Previous EAP request found for
state 0xb2f1dd18b618c4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: Peer ACKed our handshake
fragment. handshake is finished
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: [eaptls verify] = success
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: [eaptls process] = success
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: Session established.
Decoding tunneled attributes
Wed Dec 13 16:39:52 2017 : Debug: (71) eap_peap: PEAP state TUNNEL
ESTABLISHED
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: Sending EAP Request (code 1) ID
234 length 43
Wed Dec 13 16:39:52 2017 : Debug: (71) eap: EAP session adding &reply:State
= 0xb2f1dd18b71bc4f8
Wed Dec 13 16:39:52 2017 : Debug: (71) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (71) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (71) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (71) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (71) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (71) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (71) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (71) Sent Access-Challenge Id 251 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (71) EAP-Message =
0x01ea002b19001703010020041b240740ab5e4a795f0b3d392eed72516bbce615dc6c9699f88d3989a8a6d2
Wed Dec 13 16:39:52 2017 : Debug: (71) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (71) State =
0xb2f1dd18b71bc4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (71) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 4 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 3 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 3 handling request 72, (15 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (72) Received Access-Request Id 252 from
10.100.100.114:1645 to 192.168.10.13:1812 length 232
Wed Dec 13 16:39:52 2017 : Debug: (72) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (72) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (72) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (72) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (72) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (72) EAP-Message =
0x02ea003b19001703010030689c2c40650b330b047d146fb0ae29c039a839ef95960137b24edc752e5f8c40d5af2ae1204f4ae5557ab0c8011a8112
Wed Dec 13 16:39:52 2017 : Debug: (72) Message-Authenticator =
0xea42077a165451293384643a255be922
Wed Dec 13 16:39:52 2017 : Debug: (72) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (72) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (72) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (72) State =
0xb2f1dd18b71bc4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (72) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (72) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (72) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (72) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (72) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (72) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (72) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (72) update request {
Wed Dec 13 16:39:52 2017 : Debug: (72) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (72) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (72) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (72) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (72) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (72) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (72) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (72) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (72) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (72) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (72) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (72) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (72) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (72) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (72) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (72) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (72) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (72) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (72) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) else {
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Peer sent EAP Response (code 2)
ID 234 length 59
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (72) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (72) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (72) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (72) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (72) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (72) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (72) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (72) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (72) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Expiring EAP session with state
0xb2f1dd18b71bc4f8
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Finished EAP session with state
0xb2f1dd18b71bc4f8
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Previous EAP request found for
state 0xb2f1dd18b71bc4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: [eaptls verify] = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Done initial handshake
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: [eaptls process] = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Session established.
Decoding tunneled attributes
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: PEAP state WAITING FOR
INNER IDENTITY
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Identity - host/
test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Got inner identity 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Setting default EAP type
for tunneled EAP session
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Got tunneled request
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: EAP-Message =
0x02ea001b01686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Setting User-Name to host/
test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Sending tunneled request
to inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: EAP-Message =
0x02ea001b01686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: FreeRADIUS-Proxied-To =
127.0.0.1
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: User-Name = "host/
test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (72) Virtual server inner-tunnel received
request
Wed Dec 13 16:39:52 2017 : Debug: (72) EAP-Message =
0x02ea001b01686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (72) FreeRADIUS-Proxied-To = 127.0.0.1
Wed Dec 13 16:39:52 2017 : Debug: (72) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : WARNING: (72) Outer and inner identities are the
same. User privacy is compromised.
Wed Dec 13 16:39:52 2017 : Debug: (72) server inner-tunnel {
Wed Dec 13 16:39:52 2017 : Debug: (72) session-state: No State attribute
Wed Dec 13 16:39:52 2017 : Debug: (72) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (72) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (72) policy filter_username {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ / /) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ / /) ->
FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~
/@[^@]*@/ ) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~
/@[^@]*@/ ) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ /\.\./ )
{
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ /\.\./
) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) if ((&User-Name =~ /@/) &&
(&User-Name !~ /(a)(.+)\.(.+)$/)) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if ((&User-Name =~ /@/) &&
(&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ /\.$/) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ /\.$/)
-> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ /(a)\./) {
Wed Dec 13 16:39:52 2017 : Debug: (72) if (&User-Name =~ /(a)\./)
-> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (72) } # if (&User-Name) =
notfound
Wed Dec 13 16:39:52 2017 : Debug: (72) } # policy filter_username =
notfound
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
chap (rlm_chap)
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from chap (rlm_chap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [chap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (72) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (72) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (72) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (72) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) update control {
Wed Dec 13 16:39:52 2017 : Debug: (72) &Proxy-To-Realm := LOCAL
Wed Dec 13 16:39:52 2017 : Debug: (72) } # update control = noop
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Peer sent EAP Response (code 2)
ID 234 length 27
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: EAP-Identity reply, returning
'ok' so we can short-circuit the rest of authorize
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (72) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (72) # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (72) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authenticate]:
calling eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Peer sent packet with method
EAP Identity (1)
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Calling submodule eap_mschapv2
to process data
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_mschapv2: Issuing Challenge
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Sending EAP Request (code 1) ID
235 length 34
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: EAP session adding &reply:State
= 0x3ca0b9d33c4ba3ba
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (72) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (72) } # server inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (72) Virtual server sending reply
Wed Dec 13 16:39:52 2017 : Debug: (72) EAP-Message =
0x01eb00221a01eb001d1052a3468f574dc93d234f72b77c6b138742434d312d414141
Wed Dec 13 16:39:52 2017 : Debug: (72) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (72) State =
0x3ca0b9d33c4ba3ba9fc0b7509ba338f8
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Got tunneled reply code 11
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: EAP-Message =
0x01eb00221a01eb001d1052a3468f574dc93d234f72b77c6b138742434d312d414141
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: State =
0x3ca0b9d33c4ba3ba9fc0b7509ba338f8
Wed Dec 13 16:39:52 2017 : Debug: (72) eap_peap: Got tunneled
Access-Challenge
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: Sending EAP Request (code 1) ID
235 length 75
Wed Dec 13 16:39:52 2017 : Debug: (72) eap: EAP session adding &reply:State
= 0xb2f1dd18b41ac4f8
Wed Dec 13 16:39:52 2017 : Debug: (72) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (72) [eap] = handled
Wed Dec 13 16:39:52 2017 : Debug: (72) } # authenticate = handled
Wed Dec 13 16:39:52 2017 : Debug: (72) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:52 2017 : Debug: (72) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:52 2017 : Debug: (72) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (72) session-state: Nothing to cache
Wed Dec 13 16:39:52 2017 : Debug: (72) Sent Access-Challenge Id 252 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:52 2017 : Debug: (72) EAP-Message =
0x01eb004b190017030100406acf1842608e54febcaf1c28c2339d3f5a8cefa941e6b09e8008ef1e1bb7e4d0e36236d2d0cf0d67af1cce5cb411976a832ae019c26b7400d63e2a01da3cfca4
Wed Dec 13 16:39:52 2017 : Debug: (72) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:52 2017 : Debug: (72) State =
0xb2f1dd18b41ac4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (72) Finished request
Wed Dec 13 16:39:52 2017 : Debug: Thread 3 waiting to be assigned a request
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:52 2017 : Debug: Thread 2 got semaphore
Wed Dec 13 16:39:52 2017 : Debug: Thread 2 handling request 73, (15 handled
so far)
Wed Dec 13 16:39:52 2017 : Debug: (73) Received Access-Request Id 253 from
10.100.100.114:1645 to 192.168.10.13:1812 length 296
Wed Dec 13 16:39:52 2017 : Debug: (73) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (73) Service-Type = Framed-User
Wed Dec 13 16:39:52 2017 : Debug: (73) Framed-MTU = 1500
Wed Dec 13 16:39:52 2017 : Debug: (73) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:52 2017 : Debug: (73) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (73) EAP-Message =
0x02eb007b1900170301007024943779732cbeccdd8a64918bca94bb276c68b7b533d798f3eb3c2d3c9d8c344de4bf9c16e8072b7b673448e07427a8f291765dc0cc5713db3f8d1a4dfb5395c77f2a8d1868a61111ec694643d1f36dc94977dfe6b0ae5848e082fddf9c85dbd0f04c699536605a573fff57
Wed Dec 13 16:39:52 2017 : Debug: (73) Message-Authenticator =
0x5f483d7b99ab18d1e0b8abce47b0d2e7
Wed Dec 13 16:39:52 2017 : Debug: (73) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:52 2017 : Debug: (73) NAS-Port = 50003
Wed Dec 13 16:39:52 2017 : Debug: (73) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:52 2017 : Debug: (73) State =
0xb2f1dd18b41ac4f89bc17b18e7fb770d
Wed Dec 13 16:39:52 2017 : Debug: (73) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:52 2017 : Debug: (73) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (73) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (73) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:52 2017 : Debug: (73) [preprocess] = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (73) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (73) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:52 2017 : Debug: (73) update request {
Wed Dec 13 16:39:52 2017 : Debug: (73) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:52 2017 : Debug: (73) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (73) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:52 2017 : Debug: (73) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:52 2017 : Debug: (73) } # update request = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:52 2017 : Debug: (73) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (73) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (73) EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (73) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (73) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (73) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (73) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:52 2017 : Debug: (73) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (73) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:52 2017 : Debug: (73) --> 1
Wed Dec 13 16:39:52 2017 : Debug: (73) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (73) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:52 2017 : Debug: (73) [ok] = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:52 2017 : Debug: (73) if (!EAP-Message) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) else {
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Peer sent EAP Response (code 2)
ID 235 length 123
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Continuing tunnel setup
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (73) [eap] = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) } # else = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (73) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (73) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (73) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (73) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (73) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (73) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (73) } # authorize = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (73) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:52 2017 : Debug: (73) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Expiring EAP session with state
0x3ca0b9d33c4ba3ba
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Finished EAP session with state
0xb2f1dd18b41ac4f8
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Previous EAP request found for
state 0xb2f1dd18b41ac4f8, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: [eaptls verify] = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Done initial handshake
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: [eaptls process] = ok
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Session established.
Decoding tunneled attributes
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: PEAP state phase2
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: EAP method MSCHAPv2 (26)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Got tunneled request
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: EAP-Message =
0x02eb00511a02eb004c31f906c233e692c49eeecb392c3e6f33cc0000000000000000ebe1377d01d09cbe0bfda9256149732ec2b94b30d4cbc32700686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Setting User-Name to host/
test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: Sending tunneled request
to inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: EAP-Message =
0x02eb00511a02eb004c31f906c233e692c49eeecb392c3e6f33cc0000000000000000ebe1377d01d09cbe0bfda9256149732ec2b94b30d4cbc32700686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: FreeRADIUS-Proxied-To =
127.0.0.1
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: User-Name = "host/
test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_peap: State =
0x3ca0b9d33c4ba3ba9fc0b7509ba338f8
Wed Dec 13 16:39:52 2017 : Debug: (73) Virtual server inner-tunnel received
request
Wed Dec 13 16:39:52 2017 : Debug: (73) EAP-Message =
0x02eb00511a02eb004c31f906c233e692c49eeecb392c3e6f33cc0000000000000000ebe1377d01d09cbe0bfda9256149732ec2b94b30d4cbc32700686f73742f6473696231303930322e62636d2e696e74
Wed Dec 13 16:39:52 2017 : Debug: (73) FreeRADIUS-Proxied-To = 127.0.0.1
Wed Dec 13 16:39:52 2017 : Debug: (73) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:52 2017 : Debug: (73) State =
0x3ca0b9d33c4ba3ba9fc0b7509ba338f8
Wed Dec 13 16:39:52 2017 : WARNING: (73) Outer and inner identities are the
same. User privacy is compromised.
Wed Dec 13 16:39:52 2017 : Debug: (73) server inner-tunnel {
Wed Dec 13 16:39:52 2017 : Debug: (73) session-state: No cached attributes
Wed Dec 13 16:39:52 2017 : Debug: (73) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (73) authorize {
Wed Dec 13 16:39:52 2017 : Debug: (73) policy filter_username {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name) -> TRUE
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ / /) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ / /) ->
FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~
/@[^@]*@/ ) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~
/@[^@]*@/ ) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ /\.\./ )
{
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ /\.\./
) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) if ((&User-Name =~ /@/) &&
(&User-Name !~ /(a)(.+)\.(.+)$/)) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if ((&User-Name =~ /@/) &&
(&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ /\.$/) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ /\.$/)
-> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ /(a)\./) {
Wed Dec 13 16:39:52 2017 : Debug: (73) if (&User-Name =~ /(a)\./)
-> FALSE
Wed Dec 13 16:39:52 2017 : Debug: (73) } # if (&User-Name) =
notfound
Wed Dec 13 16:39:52 2017 : Debug: (73) } # policy filter_username =
notfound
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
chap (rlm_chap)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from chap (rlm_chap)
Wed Dec 13 16:39:52 2017 : Debug: (73) [chap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (73) [mschap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (73) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:52 2017 : Debug: (73) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:52 2017 : Debug: (73) suffix: No such realm "NULL"
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:52 2017 : Debug: (73) [suffix] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) update control {
Wed Dec 13 16:39:52 2017 : Debug: (73) &Proxy-To-Realm := LOCAL
Wed Dec 13 16:39:52 2017 : Debug: (73) } # update control = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Peer sent EAP Response (code 2)
ID 235 length 81
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: No EAP Start, assuming it's an
on-going EAP conversation
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (73) [eap] = updated
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
files (rlm_files)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from files (rlm_files)
Wed Dec 13 16:39:52 2017 : Debug: (73) [files] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:52 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: ... falling-through to group
processing
Wed Dec 13 16:39:52 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:52 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:52 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: User not found in any groups
Wed Dec 13 16:39:52 2017 : Debug: (73) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:52 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:52 2017 : Debug: (73) [sql] = notfound
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
expiration (rlm_expiration)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from expiration (rlm_expiration)
Wed Dec 13 16:39:52 2017 : Debug: (73) [expiration] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
logintime (rlm_logintime)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from logintime (rlm_logintime)
Wed Dec 13 16:39:52 2017 : Debug: (73) [logintime] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: calling
pap (rlm_pap)
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authorize]: returned
from pap (rlm_pap)
Wed Dec 13 16:39:52 2017 : Debug: (73) [pap] = noop
Wed Dec 13 16:39:52 2017 : Debug: (73) } # authorize = updated
Wed Dec 13 16:39:52 2017 : Debug: (73) Found Auth-Type = eap
Wed Dec 13 16:39:52 2017 : Debug: (73) # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (73) authenticate {
Wed Dec 13 16:39:52 2017 : Debug: (73) modsingle[authenticate]:
calling eap (rlm_eap)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Expiring EAP session with state
0x3ca0b9d33c4ba3ba
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Finished EAP session with state
0x3ca0b9d33c4ba3ba
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Previous EAP request found for
state 0x3ca0b9d33c4ba3ba, released from the list
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Peer sent packet with method
EAP MSCHAPv2 (26)
Wed Dec 13 16:39:52 2017 : Debug: (73) eap: Calling submodule eap_mschapv2
to process data
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_mschapv2: # Executing group from
file /usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_mschapv2: Auth-Type MS-CHAP {
Wed Dec 13 16:39:52 2017 : Debug: (73) eap_mschapv2:
modsingle[authenticate]: calling mschap (rlm_mschap)
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: Creating challenge hash with
username: host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: Client is using MS-CHAPv2
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: Executing:
/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-00}
--domain=%{mschap:NT-Domain} --challenge=%{%{mschap:Challenge}:-00}
--nt-response=%{%{mschap:NT-Response}:-00} :
Wed Dec 13 16:39:52 2017 : Debug: --username=%{%{mschap:User-Name}:-00}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> --username=
Wed Dec 13 16:39:52 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:52 2017 : Debug: xlat --> mschap
Wed Dec 13 16:39:52 2017 : Debug: {
Wed Dec 13 16:39:52 2017 : Debug: literal --> User-Name
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:52 2017 : Debug: literal --> 00
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: EXPAND
--username=%{%{mschap:User-Name}:-00}
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: --> --username=test0LAB$
Wed Dec 13 16:39:52 2017 : Debug: --domain=%{mschap:NT-Domain}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> --domain=
Wed Dec 13 16:39:52 2017 : Debug: xlat --> mschap
Wed Dec 13 16:39:52 2017 : Debug: {
Wed Dec 13 16:39:52 2017 : Debug: literal --> NT-Domain
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: EXPAND
--domain=%{mschap:NT-Domain}
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: --> --domain=bcm
Wed Dec 13 16:39:52 2017 : Debug: --challenge=%{%{mschap:Challenge}:-00}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> --challenge=
Wed Dec 13 16:39:52 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:52 2017 : Debug: xlat --> mschap
Wed Dec 13 16:39:52 2017 : Debug: {
Wed Dec 13 16:39:52 2017 : Debug: literal --> Challenge
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:52 2017 : Debug: literal --> 00
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: Creating challenge hash with
username: host/test0LAB.ar0s.is
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: EXPAND
--challenge=%{%{mschap:Challenge}:-00}
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: -->
--challenge=63e591e3006dd7d0
Wed Dec 13 16:39:52 2017 : Debug: --nt-response=%{%{mschap:NT-Response}:-00}
Wed Dec 13 16:39:52 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:52 2017 : Debug: literal --> --nt-response=
Wed Dec 13 16:39:52 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:52 2017 : Debug: xlat --> mschap
Wed Dec 13 16:39:52 2017 : Debug: {
Wed Dec 13 16:39:52 2017 : Debug: literal --> NT-Response
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:52 2017 : Debug: literal --> 00
Wed Dec 13 16:39:52 2017 : Debug: }
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: EXPAND
--nt-response=%{%{mschap:NT-Response}:-00}
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: -->
--nt-response=ebe1377d01d09cbe0bfda9256149732ec2b94b30d4cbc327
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.4 seconds.
Wed Dec 13 16:39:53 2017 : Debug: Waking up in 0.7 seconds.
Wed Dec 13 16:39:53 2017 : Debug: Waking up in 1.1 seconds.
Wed Dec 13 16:39:54 2017 : Debug: (73) mschap: Program returned code (0)
and output 'NT_KEY: 584702B9B75800AE1371683946584AFD'
Wed Dec 13 16:39:54 2017 : Debug: (73) mschap: Adding MS-CHAPv2 MPPE keys
Wed Dec 13 16:39:54 2017 : Debug: (73) modsingle[authenticate]:
returned from mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (73) [mschap] = ok
Wed Dec 13 16:39:54 2017 : Debug: (73) } # Auth-Type MS-CHAP = ok
Wed Dec 13 16:39:54 2017 : Debug: (73) MSCHAP Success
Wed Dec 13 16:39:54 2017 : Debug: (73) eap: Sending EAP Request (code 1) ID
236 length 51
Wed Dec 13 16:39:54 2017 : Debug: (73) eap: EAP session adding &reply:State
= 0x3ca0b9d33d4ca3ba
Wed Dec 13 16:39:54 2017 : Debug: (73) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (73) [eap] = handled
Wed Dec 13 16:39:54 2017 : Debug: (73) } # authenticate = handled
Wed Dec 13 16:39:54 2017 : Debug: (73) } # server inner-tunnel
Wed Dec 13 16:39:54 2017 : Debug: (73) Virtual server sending reply
Wed Dec 13 16:39:54 2017 : Debug: (73) EAP-Message =
0x01ec00331a03eb002e533d34334334373134324538463945383132394130334642334630343834463744463442334434443741
Wed Dec 13 16:39:54 2017 : Debug: (73) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (73) State =
0x3ca0b9d33d4ca3ba9fc0b7509ba338f8
Wed Dec 13 16:39:54 2017 : Debug: (73) eap_peap: Got tunneled reply code 11
Wed Dec 13 16:39:54 2017 : Debug: (73) eap_peap: EAP-Message =
0x01ec00331a03eb002e533d34334334373134324538463945383132394130334642334630343834463744463442334434443741
Wed Dec 13 16:39:54 2017 : Debug: (73) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (73) eap_peap: State =
0x3ca0b9d33d4ca3ba9fc0b7509ba338f8
Wed Dec 13 16:39:54 2017 : Debug: (73) eap_peap: Got tunneled
Access-Challenge
Wed Dec 13 16:39:54 2017 : Debug: (73) eap: Sending EAP Request (code 1) ID
236 length 91
Wed Dec 13 16:39:54 2017 : Debug: (73) eap: EAP session adding &reply:State
= 0xb2f1dd18b51dc4f8
Wed Dec 13 16:39:54 2017 : Debug: (73) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (73) [eap] = handled
Wed Dec 13 16:39:54 2017 : Debug: (73) } # authenticate = handled
Wed Dec 13 16:39:54 2017 : Debug: (73) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:54 2017 : Debug: (73) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:54 2017 : Debug: (73) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (73) session-state: Nothing to cache
Wed Dec 13 16:39:54 2017 : Debug: (73) Sent Access-Challenge Id 253 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:54 2017 : Debug: (73) EAP-Message =
0x01ec005b19001703010050ec0d00019ade8da0742a0d81bb3c3e31564132c3ed189a52b0b2faecc6f34ecab77828ae9cc6c5d72c3d27d53308e21105347667f8a2d36a6ada60f2ff085720b46eac17213a3d5b3e62c9f1c34b84fb
Wed Dec 13 16:39:54 2017 : Debug: (73) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (73) State =
0xb2f1dd18b51dc4f89bc17b18e7fb770d
Wed Dec 13 16:39:54 2017 : Debug: (73) Finished request
Wed Dec 13 16:39:54 2017 : Debug: Thread 2 waiting to be assigned a request
Wed Dec 13 16:39:54 2017 : Debug: Waking up in 0.3 seconds.
Wed Dec 13 16:39:54 2017 : Debug: Thread 1 got semaphore
Wed Dec 13 16:39:54 2017 : Debug: Thread 1 handling request 74, (15 handled
so far)
Wed Dec 13 16:39:54 2017 : Debug: (74) Received Access-Request Id 254 from
10.100.100.114:1645 to 192.168.10.13:1812 length 216
Wed Dec 13 16:39:54 2017 : Debug: (74) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (74) Service-Type = Framed-User
Wed Dec 13 16:39:54 2017 : Debug: (74) Framed-MTU = 1500
Wed Dec 13 16:39:54 2017 : Debug: (74) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:54 2017 : Debug: (74) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:54 2017 : Debug: (74) EAP-Message =
0x02ec002b1900170301002035bcea1c20157015f360ebbf7e0ab18d057df2669d46a249b81807f87274acd6
Wed Dec 13 16:39:54 2017 : Debug: (74) Message-Authenticator =
0xa22e7fc4c1ea4bac087829bba98ffe67
Wed Dec 13 16:39:54 2017 : Debug: (74) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:54 2017 : Debug: (74) NAS-Port = 50003
Wed Dec 13 16:39:54 2017 : Debug: (74) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:54 2017 : Debug: (74) State =
0xb2f1dd18b51dc4f89bc17b18e7fb770d
Wed Dec 13 16:39:54 2017 : Debug: (74) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:54 2017 : Debug: (74) session-state: No cached attributes
Wed Dec 13 16:39:54 2017 : Debug: (74) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (74) authorize {
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:54 2017 : Debug: (74) [preprocess] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:54 2017 : Debug: (74) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:54 2017 : Debug: (74) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:54 2017 : Debug: (74) update request {
Wed Dec 13 16:39:54 2017 : Debug: (74) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:54 2017 : Debug: (74) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:54 2017 : Debug: (74) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:54 2017 : Debug: (74) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:54 2017 : Debug: (74) } # update request = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:54 2017 : Debug: (74) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:54 2017 : Debug: (74) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (74) EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (74) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (74) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:54 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (74) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (74) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (74) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:54 2017 : Info: Need 1 more connections to reach min
connections (3)
Wed Dec 13 16:39:54 2017 : Info: rlm_sql (sql): Opening additional
connection (23), 1 of 30 pending slots used
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql_mysql: Starting connect to MySQL
server
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql_mysql: Connected to database
'radius' on Localhost via UNIX socket, server version
10.1.23-MariaDB-9+deb9u1, protocol version 10
Wed Dec 13 16:39:54 2017 : Debug: (74) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:54 2017 : Debug: (74) --> 1
Wed Dec 13 16:39:54 2017 : Debug: (74) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:54 2017 : Debug: (74) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (74) [ok] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:54 2017 : Debug: (74) if (!EAP-Message) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) else {
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Peer sent EAP Response (code 2)
ID 236 length 43
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Continuing tunnel setup
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [eap] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) } # else = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [mschap] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (74) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:54 2017 : Debug: (74) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:54 2017 : Debug: (74) suffix: No such realm "NULL"
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (74) [suffix] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:54 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: ... falling-through to group
processing
Wed Dec 13 16:39:54 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: User not found in any groups
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: (74) [sql] = notfound
Wed Dec 13 16:39:54 2017 : Debug: (74) } # authorize = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) Found Auth-Type = eap
Wed Dec 13 16:39:54 2017 : Debug: (74) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (74) authenticate {
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Expiring EAP session with state
0x3ca0b9d33d4ca3ba
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Finished EAP session with state
0xb2f1dd18b51dc4f8
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Previous EAP request found for
state 0xb2f1dd18b51dc4f8, released from the list
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: [eaptls verify] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Done initial handshake
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: [eaptls process] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Session established.
Decoding tunneled attributes
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: PEAP state phase2
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: EAP method MSCHAPv2 (26)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Got tunneled request
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: EAP-Message =
0x02ec00061a03
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Setting User-Name to host/
test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Sending tunneled request
to inner-tunnel
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: EAP-Message =
0x02ec00061a03
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: FreeRADIUS-Proxied-To =
127.0.0.1
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: User-Name = "host/
test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: State =
0x3ca0b9d33d4ca3ba9fc0b7509ba338f8
Wed Dec 13 16:39:54 2017 : Debug: (74) Virtual server inner-tunnel received
request
Wed Dec 13 16:39:54 2017 : Debug: (74) EAP-Message = 0x02ec00061a03
Wed Dec 13 16:39:54 2017 : Debug: (74) FreeRADIUS-Proxied-To = 127.0.0.1
Wed Dec 13 16:39:54 2017 : Debug: (74) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (74) State =
0x3ca0b9d33d4ca3ba9fc0b7509ba338f8
Wed Dec 13 16:39:54 2017 : WARNING: (74) Outer and inner identities are the
same. User privacy is compromised.
Wed Dec 13 16:39:54 2017 : Debug: (74) server inner-tunnel {
Wed Dec 13 16:39:54 2017 : Debug: (74) session-state: No cached attributes
Wed Dec 13 16:39:54 2017 : Debug: (74) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:54 2017 : Debug: (74) authorize {
Wed Dec 13 16:39:54 2017 : Debug: (74) policy filter_username {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name) -> TRUE
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ / /) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ / /) ->
FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~
/@[^@]*@/ ) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~
/@[^@]*@/ ) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ /\.\./ )
{
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ /\.\./
) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) if ((&User-Name =~ /@/) &&
(&User-Name !~ /(a)(.+)\.(.+)$/)) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if ((&User-Name =~ /@/) &&
(&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ /\.$/) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ /\.$/)
-> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ /(a)\./) {
Wed Dec 13 16:39:54 2017 : Debug: (74) if (&User-Name =~ /(a)\./)
-> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (74) } # if (&User-Name) =
notfound
Wed Dec 13 16:39:54 2017 : Debug: (74) } # policy filter_username =
notfound
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
chap (rlm_chap)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from chap (rlm_chap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [chap] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [mschap] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (74) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:54 2017 : Debug: (74) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:54 2017 : Debug: (74) suffix: No such realm "NULL"
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (74) [suffix] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) update control {
Wed Dec 13 16:39:54 2017 : Debug: (74) &Proxy-To-Realm := LOCAL
Wed Dec 13 16:39:54 2017 : Debug: (74) } # update control = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Peer sent EAP Response (code 2)
ID 236 length 6
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: No EAP Start, assuming it's an
on-going EAP conversation
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [eap] = updated
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
files (rlm_files)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from files (rlm_files)
Wed Dec 13 16:39:54 2017 : Debug: (74) [files] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:54 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: ... falling-through to group
processing
Wed Dec 13 16:39:54 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: User not found in any groups
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: (74) [sql] = notfound
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
expiration (rlm_expiration)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from expiration (rlm_expiration)
Wed Dec 13 16:39:54 2017 : Debug: (74) [expiration] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
logintime (rlm_logintime)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from logintime (rlm_logintime)
Wed Dec 13 16:39:54 2017 : Debug: (74) [logintime] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: calling
pap (rlm_pap)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authorize]: returned
from pap (rlm_pap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [pap] = noop
Wed Dec 13 16:39:54 2017 : Debug: (74) } # authorize = updated
Wed Dec 13 16:39:54 2017 : Debug: (74) Found Auth-Type = eap
Wed Dec 13 16:39:54 2017 : Debug: (74) # Executing group from file
/usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:54 2017 : Debug: (74) authenticate {
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authenticate]:
calling eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Expiring EAP session with state
0x3ca0b9d33d4ca3ba
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Finished EAP session with state
0x3ca0b9d33d4ca3ba
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Previous EAP request found for
state 0x3ca0b9d33d4ca3ba, released from the list
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Peer sent packet with method
EAP MSCHAPv2 (26)
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Calling submodule eap_mschapv2
to process data
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Sending EAP Success (code 3) ID
236 length 4
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Freeing handler
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [eap] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) } # authenticate = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) # Executing section post-auth from
file /usr/local/etc/raddb/sites-enabled/inner-tunnel
Wed Dec 13 16:39:54 2017 : Debug: (74) post-auth {
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[post-auth]: calling
sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: .query
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> .query
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND .query
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> .query
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: Using query template 'query'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (23)
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: INSERT INTO radpostauth (username, pass,
reply, authdate) VALUES ( '%{SQL-User-Name}',
'%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES ( '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ', '
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Password
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> CHAP-Password
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> ', '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Packet-Type
Wed Dec 13 16:39:54 2017 : Debug: literal --> ', '
Wed Dec 13 16:39:54 2017 : Debug: percent --> S
Wed Dec 13 16:39:54 2017 : Debug: literal --> ')
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}',
'%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: --> INSERT INTO radpostauth
(username, pass, reply, authdate) VALUES ( 'host/test0LAB.ar0s.is', '',
'Access-Accept', '2017-12-13 16:39:54')
Wed Dec 13 16:39:54 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: Executing query: INSERT INTO
radpostauth (username, pass, reply, authdate) VALUES ( 'host/
test0LAB.ar0s.is', '', 'Access-Accept', '2017-12-13 16:39:54')
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: SQL query returned: success
Wed Dec 13 16:39:54 2017 : Debug: (74) sql: 1 record(s) updated
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (23)
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[post-auth]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: (74) [sql] = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) } # post-auth = ok
Wed Dec 13 16:39:54 2017 : Debug: (74) } # server inner-tunnel
Wed Dec 13 16:39:54 2017 : Debug: (74) Virtual server sending reply
Wed Dec 13 16:39:54 2017 : Debug: (74) MS-MPPE-Encryption-Policy =
Encryption-Required
Wed Dec 13 16:39:54 2017 : Debug: (74) MS-MPPE-Encryption-Types = 4
Wed Dec 13 16:39:54 2017 : Debug: (74) MS-MPPE-Send-Key =
0x0bbbbcb711397d7d94139ac68e30f327
Wed Dec 13 16:39:54 2017 : Debug: (74) MS-MPPE-Recv-Key =
0xd29604f012f5e1bc9243a10fb015a25f
Wed Dec 13 16:39:54 2017 : Debug: (74) EAP-Message = 0x03ec0004
Wed Dec 13 16:39:54 2017 : Debug: (74) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (74) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Got tunneled reply code 2
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap:
MS-MPPE-Encryption-Policy = Encryption-Required
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: MS-MPPE-Encryption-Types
= 4
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: MS-MPPE-Send-Key =
0x0bbbbcb711397d7d94139ac68e30f327
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: MS-MPPE-Recv-Key =
0xd29604f012f5e1bc9243a10fb015a25f
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: EAP-Message = 0x03ec0004
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: User-Name = "host/
test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Tunneled authentication
was successful
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: SUCCESS
Wed Dec 13 16:39:54 2017 : Debug: (74) eap_peap: Saving tunneled attributes
for later
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: Sending EAP Request (code 1) ID
237 length 43
Wed Dec 13 16:39:54 2017 : Debug: (74) eap: EAP session adding &reply:State
= 0xb2f1dd18ba1cc4f8
Wed Dec 13 16:39:54 2017 : Debug: (74) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (74) [eap] = handled
Wed Dec 13 16:39:54 2017 : Debug: (74) } # authenticate = handled
Wed Dec 13 16:39:54 2017 : Debug: (74) Using Post-Auth-Type Challenge
Wed Dec 13 16:39:54 2017 : Debug: (74) Post-Auth-Type sub-section not
found. Ignoring.
Wed Dec 13 16:39:54 2017 : Debug: (74) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (74) session-state: Nothing to cache
Wed Dec 13 16:39:54 2017 : Debug: (74) Sent Access-Challenge Id 254 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:54 2017 : Debug: (74) EAP-Message =
0x01ed002b19001703010020a333bff49a369b991e3c207ffcdcd4bee4f75d063a4eae7d320066a6b81b2996
Wed Dec 13 16:39:54 2017 : Debug: (74) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (74) State =
0xb2f1dd18ba1cc4f89bc17b18e7fb770d
Wed Dec 13 16:39:54 2017 : Debug: (74) Finished request
Wed Dec 13 16:39:54 2017 : Debug: Thread 1 waiting to be assigned a request
Wed Dec 13 16:39:54 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:54 2017 : Debug: Thread 5 got semaphore
Wed Dec 13 16:39:54 2017 : Debug: Thread 5 handling request 75, (16 handled
so far)
Wed Dec 13 16:39:54 2017 : Debug: (75) Received Access-Request Id 255 from
10.100.100.114:1645 to 192.168.10.13:1812 length 216
Wed Dec 13 16:39:54 2017 : Debug: (75) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (75) Service-Type = Framed-User
Wed Dec 13 16:39:54 2017 : Debug: (75) Framed-MTU = 1500
Wed Dec 13 16:39:54 2017 : Debug: (75) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:54 2017 : Debug: (75) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:54 2017 : Debug: (75) EAP-Message =
0x02ed002b19001703010020d602362d206fc7a360005419706fbaa69f2e4afd12d32893f4e89f7412bf6609
Wed Dec 13 16:39:54 2017 : Debug: (75) Message-Authenticator =
0x7765ff294336d01528246a5ccffad687
Wed Dec 13 16:39:54 2017 : Debug: (75) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:54 2017 : Debug: (75) NAS-Port = 50003
Wed Dec 13 16:39:54 2017 : Debug: (75) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:54 2017 : Debug: (75) State =
0xb2f1dd18ba1cc4f89bc17b18e7fb770d
Wed Dec 13 16:39:54 2017 : Debug: (75) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:54 2017 : Debug: (75) session-state: No cached attributes
Wed Dec 13 16:39:54 2017 : Debug: (75) # Executing section authorize from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (75) authorize {
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:54 2017 : Debug: (75) [preprocess] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) policy
rewrite_calling_station_id {
Wed Dec 13 16:39:54 2017 : Debug: (75) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:54 2017 : Debug: (75) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
-> TRUE
Wed Dec 13 16:39:54 2017 : Debug: (75) if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
{
Wed Dec 13 16:39:54 2017 : Debug: (75) update request {
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND
%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}
Wed Dec 13 16:39:54 2017 : Debug: (75) --> A4-04-19-10-D2-2F
Wed Dec 13 16:39:54 2017 : Debug: (75) Calling-Station-Id :=
A4-04-19-10-D2-2F
Wed Dec 13 16:39:54 2017 : Debug: (75) Overwriting value
"A4-04-19-10-D2-2F" with "A4-04-19-10-D2-2F"
Wed Dec 13 16:39:54 2017 : Debug: (75) } # update request = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) } # if (Calling-Station-Id =~
/([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i)
= noop
Wed Dec 13 16:39:54 2017 : Debug: (75) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:54 2017 : Debug: (75) } # policy
rewrite_calling_station_id = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (75) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (75) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:54 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (75) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (75) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:54 2017 : Debug: (75) --> 1
Wed Dec 13 16:39:54 2017 : Debug: (75) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:54 2017 : Debug: (75) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: calling
ok (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: returned
from ok (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (75) [ok] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:54 2017 : Debug: (75) if (!EAP-Message) {
Wed Dec 13 16:39:54 2017 : Debug: (75) if (!EAP-Message) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (75) else {
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: calling
eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Peer sent EAP Response (code 2)
ID 237 length 43
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Continuing tunnel setup
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: returned
from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (75) [eap] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) } # else = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: calling
mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: returned
from mschap (rlm_mschap)
Wed Dec 13 16:39:54 2017 : Debug: (75) [mschap] = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (75) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:54 2017 : Debug: (75) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:54 2017 : Debug: (75) suffix: No such realm "NULL"
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (75) [suffix] = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: calling
sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (21)
Wed Dec 13 16:39:54 2017 : Debug: SELECT id, username, attribute, value, op
FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: EXPAND SELECT id, username,
attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}'
ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: --> SELECT id, username,
attribute, value, op FROM radcheck WHERE username = 'host/test0LAB.ar0s.is'
ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: Executing select query: SELECT
id, username, attribute, value, op FROM radcheck WHERE username = 'host/
test0LAB.ar0s.is' ORDER BY id
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: ... falling-through to group
processing
Wed Dec 13 16:39:54 2017 : Debug: SELECT groupname FROM radusergroup WHERE
username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> SELECT groupname FROM
radusergroup WHERE username = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> SQL-User-Name
Wed Dec 13 16:39:54 2017 : Debug: literal --> ' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: EXPAND SELECT groupname FROM
radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: --> SELECT groupname FROM
radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER BY priority
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: Executing select query: SELECT
groupname FROM radusergroup WHERE username = 'host/test0LAB.ar0s.is' ORDER
BY priority
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: User not found in any groups
Wed Dec 13 16:39:54 2017 : Debug: (75) sql: ... falling-through to profile
processing
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (21)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authorize]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: (75) [sql] = notfound
Wed Dec 13 16:39:54 2017 : Debug: (75) } # authorize = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) Found Auth-Type = eap
Wed Dec 13 16:39:54 2017 : Debug: (75) # Executing group from file
/usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (75) authenticate {
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authenticate]: calling
eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Expiring EAP session with state
0xb2f1dd18ba1cc4f8
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Finished EAP session with state
0xb2f1dd18ba1cc4f8
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Previous EAP request found for
state 0xb2f1dd18ba1cc4f8, released from the list
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Peer sent packet with method
EAP PEAP (25)
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Calling submodule eap_peap to
process data
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Continuing EAP-TLS
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Peer sent flags ---
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: [eaptls verify] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Done initial handshake
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: [eaptls process] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Session established.
Decoding tunneled attributes
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: PEAP state send tlv success
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Received EAP-TLV response
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Success
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Using saved attributes
from the original Access-Accept
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: User-Name = "host/
test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: caching User-Name =
"host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (75) eap_peap: Failed to find
'persist_dir' in TLS configuration. Session will not be cached on disk.
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Sending EAP Success (code 3) ID
237 length 4
Wed Dec 13 16:39:54 2017 : Debug: (75) eap: Freeing handler
Wed Dec 13 16:39:54 2017 : Debug: tls: Freeing cached session VPs
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[authenticate]:
returned from eap (rlm_eap)
Wed Dec 13 16:39:54 2017 : Debug: (75) [eap] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) } # authenticate = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) # Executing section post-auth from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (75) post-auth {
Wed Dec 13 16:39:54 2017 : Debug: (75) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0){
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (75) --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (75) SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (23)
Wed Dec 13 16:39:54 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (75) -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (75) Executing select query: SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='A4-04-19-10-D2-2F'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (23)
Wed Dec 13 16:39:54 2017 : Debug: (75) EXPAND %{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}
Wed Dec 13 16:39:54 2017 : Debug: (75) --> 1
Wed Dec 13 16:39:54 2017 : Debug: (75) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) -> TRUE
Wed Dec 13 16:39:54 2017 : Debug: (75) if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) {
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[post-auth]: calling
ok (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[post-auth]: returned
from ok (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (75) [ok] = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) } # if ("%{sql:SELECT
COUNT(macaddress) FROM radmac WHERE macaddress ='%{Calling-Station-Id}'}" >
0) = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) ... skipping else: Preceding
"if" was taken
Wed Dec 13 16:39:54 2017 : Debug: (75) update {
Wed Dec 13 16:39:54 2017 : Debug: (75) No attributes updated
Wed Dec 13 16:39:54 2017 : Debug: (75) } # update = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[post-auth]: calling
exec (rlm_exec)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[post-auth]: returned
from exec (rlm_exec)
Wed Dec 13 16:39:54 2017 : Debug: (75) [exec] = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) policy
remove_reply_message_if_eap {
Wed Dec 13 16:39:54 2017 : Debug: (75) if (&reply:EAP-Message &&
&reply:Reply-Message) {
Wed Dec 13 16:39:54 2017 : Debug: (75) if (&reply:EAP-Message &&
&reply:Reply-Message) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (75) else {
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[post-auth]:
calling noop (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (75) modsingle[post-auth]:
returned from noop (rlm_always)
Wed Dec 13 16:39:54 2017 : Debug: (75) [noop] = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) } # else = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) } # policy
remove_reply_message_if_eap = noop
Wed Dec 13 16:39:54 2017 : Debug: (75) } # post-auth = ok
Wed Dec 13 16:39:54 2017 : Debug: (75) Sent Access-Accept Id 255 from
192.168.10.13:1812 to 10.100.100.114:1645 length 0
Wed Dec 13 16:39:54 2017 : Debug: (75) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (75) MS-MPPE-Recv-Key =
0x486fb959688d8e906b557ec62c85361250d02c1d6fc453b68af967fcda89a2b6
Wed Dec 13 16:39:54 2017 : Debug: (75) MS-MPPE-Send-Key =
0xe3def073214fa616aa59e9f3d67826d872b2872340cc925164c2fb01f4f575b8
Wed Dec 13 16:39:54 2017 : Debug: (75) EAP-Message = 0x03ed0004
Wed Dec 13 16:39:54 2017 : Debug: (75) Message-Authenticator =
0x00000000000000000000000000000000
Wed Dec 13 16:39:54 2017 : Debug: (75) Finished request
Wed Dec 13 16:39:54 2017 : Debug: Thread 5 waiting to be assigned a request
Wed Dec 13 16:39:54 2017 : Debug: Waking up in 0.2 seconds.
Wed Dec 13 16:39:54 2017 : Debug: Thread 4 got semaphore
Wed Dec 13 16:39:54 2017 : Debug: Thread 4 handling request 76, (16 handled
so far)
Wed Dec 13 16:39:54 2017 : Debug: (76) Received Accounting-Request Id 89
from 10.100.100.114:1646 to 192.168.10.13:1813 length 276
Wed Dec 13 16:39:54 2017 : Debug: (76) Called-Station-Id =
"00-19-55-9F-DA-03"
Wed Dec 13 16:39:54 2017 : Debug: (76) Calling-Station-Id =
"A4-04-19-10-D2-2F"
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Session-Id = "0.0.0.0 host/
test0LAB.ar0s.is 06/15/93 19:39:08 00F30000"
Wed Dec 13 16:39:54 2017 : Debug: (76) Framed-IP-Address = 1.133.138.32
Wed Dec 13 16:39:54 2017 : Debug: (76) Cisco-AVPair =
"connect-progress=Auth Open"
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Session-Time = 31683
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Input-Octets = 494380646
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Output-Octets = 818956336
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Input-Packets = 659213
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Output-Packets = 1746529
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Authentic = RADIUS
Wed Dec 13 16:39:54 2017 : Debug: (76) User-Name = "host/test0LAB.ar0s.is"
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Status-Type = Interim-Update
Wed Dec 13 16:39:54 2017 : Debug: (76) Cisco-NAS-Port = "FastEthernet0/3"
Wed Dec 13 16:39:54 2017 : Debug: (76) NAS-Port = 50003
Wed Dec 13 16:39:54 2017 : Debug: (76) NAS-Port-Type = Ethernet
Wed Dec 13 16:39:54 2017 : Debug: (76) Service-Type = Framed-User
Wed Dec 13 16:39:54 2017 : Debug: (76) NAS-IP-Address = 10.100.100.114
Wed Dec 13 16:39:54 2017 : Debug: (76) Acct-Delay-Time = 0
Wed Dec 13 16:39:54 2017 : Debug: (76) # Executing section preacct from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (76) preacct {
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[preacct]: calling
preprocess (rlm_preprocess)
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[preacct]: returned
from preprocess (rlm_preprocess)
Wed Dec 13 16:39:54 2017 : Debug: (76) [preprocess] = ok
Wed Dec 13 16:39:54 2017 : Debug: (76) policy acct_unique {
Wed Dec 13 16:39:54 2017 : Debug: (76) if ("%{string:Class}" =~
/ai:([0-9a-f]{32})/i) {
Wed Dec 13 16:39:54 2017 : Debug: (76) EXPAND %{string:Class}
Wed Dec 13 16:39:54 2017 : Debug: (76) -->
Wed Dec 13 16:39:54 2017 : Debug: (76) if ("%{string:Class}" =~
/ai:([0-9a-f]{32})/i) -> FALSE
Wed Dec 13 16:39:54 2017 : Debug: (76) else {
Wed Dec 13 16:39:54 2017 : Debug: (76) update request {
Wed Dec 13 16:39:54 2017 : Debug: (76) EXPAND
%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
Wed Dec 13 16:39:54 2017 : Debug: (76) -->
b801a6e08d003be6367ecacee87e40d5
Wed Dec 13 16:39:54 2017 : Debug: (76) &Acct-Unique-Session-Id :=
b801a6e08d003be6367ecacee87e40d5
Wed Dec 13 16:39:54 2017 : Debug: (76) } # update request = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) } # else = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) } # policy acct_unique = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[preacct]: calling
suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (76) suffix: Checking for suffix after "@"
Wed Dec 13 16:39:54 2017 : Debug: (76) suffix: No '@' in User-Name = "host/
test0LAB.ar0s.is", looking up realm NULL
Wed Dec 13 16:39:54 2017 : Debug: (76) suffix: No such realm "NULL"
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[preacct]: returned
from suffix (rlm_realm)
Wed Dec 13 16:39:54 2017 : Debug: (76) [suffix] = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[preacct]: calling
files (rlm_files)
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[preacct]: returned
from files (rlm_files)
Wed Dec 13 16:39:54 2017 : Debug: (76) [files] = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) } # preacct = ok
Wed Dec 13 16:39:54 2017 : Debug: (76) # Executing section accounting from
file /usr/local/etc/raddb/sites-enabled/default
Wed Dec 13 16:39:54 2017 : Debug: (76) accounting {
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: calling
detail (rlm_detail)
Wed Dec 13 16:39:54 2017 : Debug:
/mnt/DATA/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> /mnt/DATA/radius/radacct/
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Packet-Src-IP-Address
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Packet-Src-IPv6-Address
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> /detail-
Wed Dec 13 16:39:54 2017 : Debug: percent --> Y
Wed Dec 13 16:39:54 2017 : Debug: percent --> m
Wed Dec 13 16:39:54 2017 : Debug: percent --> d
Wed Dec 13 16:39:54 2017 : Debug: (76) detail: EXPAND
/mnt/DATA/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
Wed Dec 13 16:39:54 2017 : Debug: (76) detail: -->
/mnt/DATA/radius/radacct/10.100.100.114/detail-20171213
Wed Dec 13 16:39:54 2017 : Debug: (76) detail:
/mnt/DATA/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
expands to /mnt/DATA/radius/radacct/10.100.100.114/detail-20171213
Wed Dec 13 16:39:54 2017 : Debug: %t
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: percent --> t
Wed Dec 13 16:39:54 2017 : Debug: (76) detail: EXPAND %t
Wed Dec 13 16:39:54 2017 : Debug: (76) detail: --> Wed Dec 13 16:39:54
2017
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: returned
from detail (rlm_detail)
Wed Dec 13 16:39:54 2017 : Debug: (76) [detail] = ok
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: calling
unix (rlm_unix)
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: returned
from unix (rlm_unix)
Wed Dec 13 16:39:54 2017 : Debug: (76) [unix] = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: calling
sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: %{tolower:type.%{Acct-Status-Type}.query}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: xlat --> tolower
Wed Dec 13 16:39:54 2017 : Debug: {
Wed Dec 13 16:39:54 2017 : Debug: literal --> type.
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Status-Type
Wed Dec 13 16:39:54 2017 : Debug: literal --> .query
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: EXPAND
%{tolower:type.%{Acct-Status-Type}.query}
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: --> type.interim-update.query
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: Using query template 'query'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Reserved connection (22)
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: --> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: SQL-User-Name set to 'host/
test0LAB.ar0s.is'
Wed Dec 13 16:39:54 2017 : Debug: UPDATE radacct SET acctupdatetime =
%{%{integer:Event-Timestamp}:-date('now')}, acctinterval = 0,
framedipaddress = '%{Framed-IP-Address}', acctsessiontime =
%{%{Acct-Session-Time}:-NULL}, acctinputoctets =
%{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0},
acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 |
%{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> UPDATE radacct SET
acctupdatetime =
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: xlat --> integer
Wed Dec 13 16:39:54 2017 : Debug: {
Wed Dec 13 16:39:54 2017 : Debug: literal --> Event-Timestamp
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: literal --> date('now')
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> , acctinterval = 0,
framedipaddress = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Framed-IP-Address
Wed Dec 13 16:39:54 2017 : Debug: literal --> ', acctsessiontime =
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Session-Time
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: literal --> NULL
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> , acctinputoctets =
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Input-Gigawords
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: literal --> 0
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> << 32 |
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Input-Octets
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: literal --> 0
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> , acctoutputoctets =
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Output-Gigawords
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: literal --> 0
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> << 32 |
Wed Dec 13 16:39:54 2017 : Debug: XLAT-IF {
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Output-Octets
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: XLAT-ELSE {
Wed Dec 13 16:39:54 2017 : Debug: literal --> 0
Wed Dec 13 16:39:54 2017 : Debug: }
Wed Dec 13 16:39:54 2017 : Debug: literal --> WHERE AcctUniqueId = '
Wed Dec 13 16:39:54 2017 : Debug: attribute --> Acct-Unique-Session-Id
Wed Dec 13 16:39:54 2017 : Debug: literal --> '
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: EXPAND UPDATE radacct SET
acctupdatetime = %{%{integer:Event-Timestamp}:-date('now')},
acctinterval = 0, framedipaddress = '%{Framed-IP-Address}',
acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets =
%{%{Acct-Input-Gigawords}:-0} << 32 | %{%{Acct-Input-Octets}:-0},
acctoutputoctets = %{%{Acct-Output-Gigawords}:-0} << 32 |
%{%{Acct-Output-Octets}:-0} WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: --> UPDATE radacct SET
acctupdatetime = 1513172394, acctinterval = 0, framedipaddress =
'1.133.138.32', acctsessiontime = 31683, acctinputoctets = 0 << 32 |
494380646, acctoutputoctets = 0 << 32 | 818956336 WHERE AcctUniqueId =
'b801a6e08d003be6367ecacee87e40d5'
Wed Dec 13 16:39:54 2017 : Debug: /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: literal --> /mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: EXPAND
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: -->
/mnt/DATA/radius/sqllog.sql
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: Executing query: UPDATE radacct
SET acctupdatetime = 1513172394, acctinterval = 0, framedipaddress =
'1.133.138.32', acctsessiontime = 31683, acctinputoctets = 0 << 32 |
494380646, acctoutputoctets = 0 << 32 | 818956336 WHERE AcctUniqueId =
'b801a6e08d003be6367ecacee87e40d5'
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql_mysql: Rows matched: 1 Changed:
1 Warnings: 1
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: SQL query returned: success
Wed Dec 13 16:39:54 2017 : Debug: (76) sql: 1 record(s) updated
Wed Dec 13 16:39:54 2017 : Debug: rlm_sql (sql): Released connection (22)
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: returned
from sql (rlm_sql)
Wed Dec 13 16:39:54 2017 : Debug: (76) [sql] = ok
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: calling
exec (rlm_exec)
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: returned
from exec (rlm_exec)
Wed Dec 13 16:39:54 2017 : Debug: (76) [exec] = noop
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: calling
attr_filter.accounting_response (rlm_attr_filter)
Wed Dec 13 16:39:54 2017 : Debug: %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: Parsed xlat tree:
Wed Dec 13 16:39:54 2017 : Debug: attribute --> User-Name
Wed Dec 13 16:39:54 2017 : Debug: (76) attr_filter.accounting_response:
EXPAND %{User-Name}
Wed Dec 13 16:39:54 2017 : Debug: (76) attr_filter.accounting_response:
--> host/test0LAB.ar0s.is
Wed Dec 13 16:39:54 2017 : Debug: (76) attr_filter.accounting_response:
Matched entry DEFAULT at line 12
Wed Dec 13 16:39:54 2017 : Debug: (76) modsingle[accounting]: returned
from attr_filter.accounting_response (rlm_attr_filter)
Wed Dec 13 16:39:54 2017 : Debug: (76)
[attr_filter.accounting_response] = updated
Wed Dec 13 16:39:54 2017 : Debug: (76) } # accounting = updated
Wed Dec 13 16:39:54 2017 : Debug: (76) Sent Accounting-Response Id 89 from
192.168.10.13:1813 to 10.100.100.114:1646 length 0
Wed Dec 13 16:39:54 2017 : Debug: (76) Finished request
Wed Dec 13 16:39:54 2017 : Debug: Thread 4 waiting to be assigned a request
Wed Dec 13 16:39:54 2017 : Debug: (76) Cleaning up request packet ID 89
with timestamp +2018
Wed Dec 13 16:39:54 2017 : Debug: Waking up in 0.5 seconds.
Wed Dec 13 16:39:55 2017 : Debug: Waking up in 2.2 seconds.
Wed Dec 13 16:39:57 2017 : Debug: (66) Cleaning up request packet ID 246
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: (67) Cleaning up request packet ID 247
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: (68) Cleaning up request packet ID 248
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: (69) Cleaning up request packet ID 249
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: (70) Cleaning up request packet ID 250
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: (71) Cleaning up request packet ID 251
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: (72) Cleaning up request packet ID 252
with timestamp +2016
Wed Dec 13 16:39:57 2017 : Debug: Waking up in 1.7 seconds.
Wed Dec 13 16:39:59 2017 : Debug: (73) Cleaning up request packet ID 253
with timestamp +2016
Wed Dec 13 16:39:59 2017 : Debug: (74) Cleaning up request packet ID 254
with timestamp +2018
Wed Dec 13 16:39:59 2017 : Debug: (75) Cleaning up request packet ID 255
with timestamp +2018
Wed Dec 13 16:39:59 2017 : Info: Ready to process requests
Regards
2
1
Dear list,
First, I must say that FreeRadius is in my humble opinion, the best open
source project out there: top dev team, well documented, proactive mailing
list, and above all, you can find it anywhere inside the security vendors
solutions ... and that's a few of the advantages. I had to get that out of
my chest before anything ... so Thank you for all the devs out there, for
the idea and for making such a beautiful, stable and strong product ! I
really hope that I would be able to contribute one day, even if its for the
documentation since I m not good at coding :)
Here come worries: I have setup inside 4 different companies a 802.1X
solution (of course based on FreeRadius) and everything is working like a
charm, (FreeRADIUS v 3.0.14) but in one of the secondary server (the main
and the backup is linked through UCARP VRRP) which is currently serving
around 400 supplicants, it is dropping the clients (randomly) after a
timeout. below the setup (simple enough):
FreeRADIUS authenticates the client (supplicants) to the AD, then verifies
if its MAC address is authorized to connect or not.
I suspect that is related to the following:
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: EXPAND
--nt-response=%{%{mschap:NT-Response}:-00}
Wed Dec 13 16:39:52 2017 : Debug: (73) mschap: -->
--nt-response=ebe1377d01d09cbe0bfda9256149732ec2b94b30d4cbc327
Wed Dec 13 16:39:52 2017 : Debug: Waking up in 0.4 seconds.
Wed Dec 13 16:39:53 2017 : Debug: Waking up in 0.7 seconds.
Wed Dec 13 16:39:53 2017 : Debug: Waking up in 1.1 seconds.
But I am not sure. If the above is however correct, does it mean that it is
waiting for the AD to reply or is it just misbehaving ? Please find
enclosed the full log for your reference.
Regards
1
0
i dont have other ldap, if i change the port or the ip of the AD i see it in debug, but no take this options..i dont known
________________________________
De: Freeradius-Users <freeradius-users-bounces+cgermanb=live.com.ar(a)lists.freeradius.org> en nombre de Alan DeKok <aland(a)deployingradius.com>
Enviado: martes, 12 de diciembre de 2017 02:30 p.m.
Para: FreeRadius users mailing list
Asunto: Re: winbindd_priv dont exist
On Dec 12, 2017, at 12:27 PM, Carlos Bordon <cgermanb(a)live.com.ar> wrote:
> They are uncomment this options but nothing happend , try restarting too
You need to restart the server after that configuration change.
If you still see the same error, then you're editing one file, and the server is reading another one.
Read the debug output to see which file is used for the LDAP module. Then, edit that file.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Support & Services<http://www.freeradius.org/list/users.html>
www.freeradius.org
The world's leading RADIUS server. The project includes a GPL AAA server, BSD licensed client and PAM and Apache modules. Full support is available from NetworkRADIUS.
3
13
> *What, exactly do you need to do? Write that down, first. e.g.*
I need to identify the group the user is in once they are authenticated,
and then pass the users's group to the Dynamic RSSO group on the Fortigate
using the Class attribute I believe.
A picture is worth 1000 words...or something like that:
[image: Inline image 2]
The user names are being passed from freeradius, but the user's are not
there.
To pass the user's LDAP group, I believe I need to identify which group
they are a part of in freeradius, and put that in CLASS.
> * If they're a member of LDAP group X, send class Y.*
>etc.
Yes, this is what I need to do. If member of student, send Class=students,
If member of admins send class=admins, if member of staff, send class=staff.
Would I have to identify some of this in the LDAP module, or is free radius
Version 3, smart enough to identity what group the user is a part of in
LDAP? If it is, I imagine I can just move to implementing in unlang. If
not...can you provide me with some guidance where I would start identifying
or how I would identify what gorup the user was a part of in free radius,
and what file that would go in?
>*Then... implement that in unlang.*
What conf file and area would be the best place to put the unlang if
statements, IE:
if User-Name is a member of students
then
Class = students
if User-Name is a member staff
then
Class = Staff
etc.
>*And upgrade to v3. It will be infinitely easier to do this (and debug
it), than in 2.1.1.*
I will be upgrading to version 3 today, and getting this all going on the
newest server.
>Alan DeKok.
--
______________________________________________________________________________
*Matthew Stavert* - CIPS I.S.P, ITSM, ITIL Certified, Google APPS
Certified, MCE - Microsoft Certified Educator, MTA Certified - Microsoft
Technology Associate
Information Systems Analyst - Systems Integration Specialist
Northern Lights School Division No. 69
CIPS: Canada's Only Legally Recognized Professional Designation
http://www.cips.ca
Office: 780-826-3145
Cell : 780-207-1146
2
1
Do I understand the following correctly?
I should get valid ssl certificate from (Verisign or other CA) and use
it in `certificate_file` and `private_key_file`. This is tells radius
server clients, what server is valid. Also this will be enough to
enable eap-ttls.
The `ca_file` options should point to my self-generated/self-signed CA
certificate. And eap-tls clients certificate should be signed by this
CA.
---
Also I have question not related to freeradius server, but maybe
someone have an answer.
I can generate client certificate for eap-tls auth method with very
long lifetime, like 10 years, and provision clients devices with it
only once. But if certificates have short lifetime, I will have to
update it periodically. How to do it with minimal user interaction?
--
Vladimir
4
7
Hello. My FreeRadius version on SLES is 2.1.1-7.18.1 My FreeRadius setup
is using eDirectory LDAP and integrates with the LDAP module on
FreeRadius. Recently, I decided it was a good idea to send my radius
authentication accounting data to my Fortigate using RSSO. I have this all
working, and my usernames from my chosen radius server are showing up on my
Fortigate now. I have one small hurdle now. When the usernames show up,
they are not associated with any groups. On the Fortigate I can associate
or make an RSSO group, that will look at a class attribute (I think), on
the FreeRadius server, and using that attribute the RSSO group will match
the usernames to that group, and match the group name with the username on
the Fortigate (I hope I'm explaining this well). I have found
documentation for MS NPS radius servers, but I am unsure of how to perform
the equivalent process on the FreeRadius server. I am hoping someone can
provide me with an example or point me in the right direction on how I can
perform this on FreeRadius since I am using Rreeradius server. It seems
like there might be a way to do this with the CLASS attribute, but I would
need help with this. I am open to any ideas, and or solutions with
FreeRadius that would accomplish this.
Thank-you in advance.
2
1
Hi,
I was wondering why the bootstrap script and the Makefile do not include the generation of the inner-server.pem certificate.
It's optional of course, but I believe it is recommended to generate one.
It's quite easy to do it manually. I just edited the Makefile, created an inner-server.cnf file, and ran "make inner-server.pem".
I'd just like to know if it wouldn't be too much of a hassle to include it in the next release (for convenience).
Thanks,
Vieri
5
10
EAP-AKA' is now available in FreeRADIUS v4.0.x HEAD. All optional components are supported except fast re-authentication which'll be added soon.
In addition to EAP-AKA' FreeRADIUS can now perform the duties of an AuC, generating AKA quintuplets and SIM triplets using a subscriber key (Ki) and a derived operator code (OPc).
The AuC SIM algorithms available for EAP-SIM are:
- COMP128v1
- COMP128v2
- COMP128v3
- COMP128v4 (Milenage)
The AuC SIM algorithms available for EAP-AKA are:
- Milenage
In most cases this functionality should only be used for testing, and the rlm_sigtran module, rlm_rest module or a diameter proxy should be used to acquire triplets or quintuplets.
If anyone knows of any other extensions to EAP-SIM, EAP-AKA or EAP-AKA['], or additional SIM algorithms they'd like implemented, let me know and i'll see if I can add them in.
-Arran
Arran Cudbard-Bell <a.cudbardb(a)freeradius.org>
FreeRADIUS Development Team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
1
1
Hi,
I'm a bit confused as how I should configure an SQL unixodbc/freetds instance to do some custom queries. I do NOT require to set up the full radius schema. My goal is quite simple. Instead of looking up a MAC address in a plain text file, I'd like to look it up in a database.
Currently, I'm using a "usersfile" with a list of MAC addresses. I check it in the "authorize" section.
How do I do the same, but with a DB lookup?
I'd like to use something like: if ("%{sql:SELECT count(*) FROM MACTABLE WHERE MAC = '%{1}'}" > 0) {...
I also extract the host name from some messages, and do similar lookups such as:
if ("%{sql:SELECT count(*) FROM HOSTTABLE WHERE HOST = '%{1}' AND DOMAN = '%{2}'}" > 0) {...
I don't know if I need to configure mods-available/sql and how.
I found this in my system:
/usr/lib64/rlm_sql_unixodbc.so
Guides such as the one at http://wiki.freeradius.org/guide/SQL-HOWTO-for-freeradius-3.x-on-Debian-Ubu… seem to be overkill in my case. I don't need to load a full radius schema. I just need to do a simple DB lookup.
Also, I haven't found a unixODBC example yet.
Thanks,
Vieri
3
5