Freeradius-Users
Threads by month
- ----- 2026 -----
- July
- June
- May
- April
- March
- February
- January
- ----- 2025 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
September 2020
- 43 participants
- 45 discussions
Dear Colleagues,
Please forgive this question, but can the debugging service be ran while the radius service is running (given that the sites-enabled/default ports will be testing outside of 1812 and 1813)?
Thanks.
5
5
22 Sep '20
Hi everyone
I wonder if I can access the configuration attributes of a request in
the module configuration.
I.e. in the code a configuration attribute is set like this:
pair_make_config("Custom-My-Attrib", "Some value, T_OP_ADD);
It would be nice if i could access this in a configuration file, so it
can be expanded in a string:
my_module {
some_param = "foobar-%{???:Custom-My-Attrib}"
}
Is something like this possible?
Cheers
T
2
3
22 Sep '20
Greetings, I'm a Freeradius newbie and I apologize if I make mistakes with
some concepts or get my point across (english is not my first language).
Anyway, I'm setting up freeradius in Ubuntu server 18.04 to authenticate
users (teachers, students) through their google accounts (we have a couple
of domains for each one), so I was adviced to use the PAM-IMAP module. When
trying to authenticate however, it fails going through the eap-peap
authentication. I read the output and checked that authentication is
invalid in the pam module however I do not know how to fix it.
This is the output:
(0) Received Access-Request Id 11 from 192.168.128.34:39957 to
146.83.124.26:1812 length 401
(0) User-Name = "wifi(a)ucn.cl"
(0) NAS-IP-Address = 192.168.128.34
(0) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(0) NAS-Port-Type = Wireless-802.11
(0) Service-Type = Framed-User
(0) NAS-Port = 1
(0) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(0) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1"
(0) Acct-Session-Id = "B51015A162BFE948"
(0) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(0) WLAN-Pairwise-Cipher = 1027076
(0) WLAN-Group-Cipher = 1027074
(0) WLAN-AKM-Suite = 1027073
(0) WLAN-Group-Mgmt-Cipher = 1027078
(0) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(0) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(0) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(0) Meraki-Device-Name = "AP-V1-Soporte"
(0) Framed-MTU = 1400
(0) EAP-Message = 0x0273001001776966694075636e2e636c
(0) Message-Authenticator = 0xae977006014c0b9d5e053dcf6096b593
(0) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /(a)\./) {
(0) if (&User-Name =~ /(a)\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(0) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(0) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(0) auth_log: EXPAND %t
(0) auth_log: --> Fri Aug 28 18:49:24 2020
(0) [auth_log] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(0) suffix: Found realm "ucn.cl"
(0) suffix: Adding Stripped-User-Name = "wifi"
(0) suffix: Adding Realm = "ucn.cl"
(0) suffix: Authentication realm is LOCAL
(0) [suffix] = ok
(0) eap: Peer sent EAP Response (code 2) ID 115 length 16
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_peap to process data
(0) eap_peap: Initiating new EAP-TLS session
(0) eap_peap: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 116 length 6
(0) eap: EAP session adding &reply:State = 0x21dd954121a98c3d
(0) [eap] = handled
(0) } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 11 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(0) EAP-Message = 0x017400061920
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0x21dd954121a98c3dcbc41c49c2b781e8
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 12 from 192.168.128.34:39957 to
146.83.124.26:1812 length 569
(1) User-Name = "wifi(a)ucn.cl"
(1) NAS-IP-Address = 192.168.128.34
(1) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(1) NAS-Port-Type = Wireless-802.11
(1) Service-Type = Framed-User
(1) NAS-Port = 1
(1) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(1) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 58 / Channel: 1"
(1) Acct-Session-Id = "B51015A162BFE948"
(1) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(1) WLAN-Pairwise-Cipher = 1027076
(1) WLAN-Group-Cipher = 1027074
(1) WLAN-AKM-Suite = 1027073
(1) WLAN-Group-Mgmt-Cipher = 1027078
(1) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(1) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(1) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(1) Meraki-Device-Name = "AP-V1-Soporte"
(1) Framed-MTU = 1400
(1) EAP-Message =
0x027400a619800000009c16030300970100009303035f4989f5fe7058f0113f2253369f4f35c5566c645792b9886416adff683207c000002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d
(1) State = 0x21dd954121a98c3dcbc41c49c2b781e8
(1) Message-Authenticator = 0xe979fd0de253104acb886c6a7bb04df5
(1) session-state: No cached attributes
(1) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(1) authorize {
(1) policy filter_username {
(1) if (&User-Name) {
(1) if (&User-Name) -> TRUE
(1) if (&User-Name) {
(1) if (&User-Name =~ / /) {
(1) if (&User-Name =~ / /) -> FALSE
(1) if (&User-Name =~ /@[^@]*@/ ) {
(1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(1) if (&User-Name =~ /\.\./ ) {
(1) if (&User-Name =~ /\.\./ ) -> FALSE
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(1) if (&User-Name =~ /\.$/) {
(1) if (&User-Name =~ /\.$/) -> FALSE
(1) if (&User-Name =~ /(a)\./) {
(1) if (&User-Name =~ /(a)\./) -> FALSE
(1) } # if (&User-Name) = notfound
(1) } # policy filter_username = notfound
(1) [preprocess] = ok
(1) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(1) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(1) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(1) auth_log: EXPAND %t
(1) auth_log: --> Fri Aug 28 18:49:24 2020
(1) [auth_log] = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(1) suffix: Found realm "ucn.cl"
(1) suffix: Adding Stripped-User-Name = "wifi"
(1) suffix: Adding Realm = "ucn.cl"
(1) suffix: Authentication realm is LOCAL
(1) [suffix] = ok
(1) eap: Peer sent EAP Response (code 2) ID 116 length 166
(1) eap: Continuing tunnel setup
(1) [eap] = ok
(1) } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1) authenticate {
(1) eap: Expiring EAP session with state 0x21dd954121a98c3d
(1) eap: Finished EAP session with state 0x21dd954121a98c3d
(1) eap: Previous EAP request found for state 0x21dd954121a98c3d, released
from the list
(1) eap: Peer sent packet with method EAP PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Continuing EAP-TLS
(1) eap_peap: Peer indicated complete TLS record size will be 156 bytes
(1) eap_peap: Got complete TLS record (156 bytes)
(1) eap_peap: [eaptls verify] = length included
(1) eap_peap: (other): before SSL initialization
(1) eap_peap: TLS_accept: before SSL initialization
(1) eap_peap: TLS_accept: before SSL initialization
(1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0097]
(1) eap_peap: TLS_accept: SSLv3/TLS read client hello
(1) eap_peap: >>> send TLS 1.2 [length 003d]
(1) eap_peap: TLS_accept: SSLv3/TLS write server hello
(1) eap_peap: >>> send TLS 1.2 [length 0d45]
(1) eap_peap: TLS_accept: SSLv3/TLS write certificate
(1) eap_peap: >>> send TLS 1.2 [length 024d]
(1) eap_peap: TLS_accept: SSLv3/TLS write key exchange
(1) eap_peap: >>> send TLS 1.2 [length 0004]
(1) eap_peap: TLS_accept: SSLv3/TLS write server done
(1) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server
done
(1) eap_peap: In SSL Handshake Phase
(1) eap_peap: In SSL Accept mode
(1) eap_peap: [eaptls process] = handled
(1) eap: Sending EAP Request (code 1) ID 117 length 1004
(1) eap: EAP session adding &reply:State = 0x21dd954120a88c3d
(1) [eap] = handled
(1) } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1) Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 12 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(1) EAP-Message =
0x017503ec19c000000fe7160303003d020000390303e6bb468a26622401d34769af834e6eb662e6224e5c0e8d88cacb79590bae22cd00c030000011ff01000100000b000403000102001700001603030d450b000d41000d3e000601308205fd308203e5a003020102020101300d06092a864886f70d0101
(1) Message-Authenticator = 0x00000000000000000000000000000000
(1) State = 0x21dd954120a88c3dcbc41c49c2b781e8
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 13 from 192.168.128.34:39957 to
146.83.124.26:1812 length 409
(2) User-Name = "wifi(a)ucn.cl"
(2) NAS-IP-Address = 192.168.128.34
(2) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(2) NAS-Port-Type = Wireless-802.11
(2) Service-Type = Framed-User
(2) NAS-Port = 1
(2) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(2) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 59 / Channel: 1"
(2) Acct-Session-Id = "B51015A162BFE948"
(2) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(2) WLAN-Pairwise-Cipher = 1027076
(2) WLAN-Group-Cipher = 1027074
(2) WLAN-AKM-Suite = 1027073
(2) WLAN-Group-Mgmt-Cipher = 1027078
(2) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(2) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(2) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(2) Meraki-Device-Name = "AP-V1-Soporte"
(2) Framed-MTU = 1400
(2) EAP-Message = 0x027500061900
(2) State = 0x21dd954120a88c3dcbc41c49c2b781e8
(2) Message-Authenticator = 0x34512dbcef44c467f7a9576c277cb9de
(2) session-state: No cached attributes
(2) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(2) authorize {
(2) policy filter_username {
(2) if (&User-Name) {
(2) if (&User-Name) -> TRUE
(2) if (&User-Name) {
(2) if (&User-Name =~ / /) {
(2) if (&User-Name =~ / /) -> FALSE
(2) if (&User-Name =~ /@[^@]*@/ ) {
(2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(2) if (&User-Name =~ /\.\./ ) {
(2) if (&User-Name =~ /\.\./ ) -> FALSE
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(2) if (&User-Name =~ /\.$/) {
(2) if (&User-Name =~ /\.$/) -> FALSE
(2) if (&User-Name =~ /(a)\./) {
(2) if (&User-Name =~ /(a)\./) -> FALSE
(2) } # if (&User-Name) = notfound
(2) } # policy filter_username = notfound
(2) [preprocess] = ok
(2) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(2) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(2) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(2) auth_log: EXPAND %t
(2) auth_log: --> Fri Aug 28 18:49:24 2020
(2) [auth_log] = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(2) suffix: Found realm "ucn.cl"
(2) suffix: Adding Stripped-User-Name = "wifi"
(2) suffix: Adding Realm = "ucn.cl"
(2) suffix: Authentication realm is LOCAL
(2) [suffix] = ok
(2) eap: Peer sent EAP Response (code 2) ID 117 length 6
(2) eap: Continuing tunnel setup
(2) [eap] = ok
(2) } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) authenticate {
(2) eap: Expiring EAP session with state 0x21dd954120a88c3d
(2) eap: Finished EAP session with state 0x21dd954120a88c3d
(2) eap: Previous EAP request found for state 0x21dd954120a88c3d, released
from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: Continuing EAP-TLS
(2) eap_peap: Peer ACKed our handshake fragment
(2) eap_peap: [eaptls verify] = request
(2) eap_peap: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 118 length 1000
(2) eap: EAP session adding &reply:State = 0x21dd954123ab8c3d
(2) [eap] = handled
(2) } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 13 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(2) EAP-Message =
0x017603e81940209dba66581b0203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010b050003820201005e
(2) Message-Authenticator = 0x00000000000000000000000000000000
(2) State = 0x21dd954123ab8c3dcbc41c49c2b781e8
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 14 from 192.168.128.34:39957 to
146.83.124.26:1812 length 409
(3) User-Name = "wifi(a)ucn.cl"
(3) NAS-IP-Address = 192.168.128.34
(3) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(3) NAS-Port-Type = Wireless-802.11
(3) Service-Type = Framed-User
(3) NAS-Port = 1
(3) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(3) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 60 / Channel: 1"
(3) Acct-Session-Id = "B51015A162BFE948"
(3) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(3) WLAN-Pairwise-Cipher = 1027076
(3) WLAN-Group-Cipher = 1027074
(3) WLAN-AKM-Suite = 1027073
(3) WLAN-Group-Mgmt-Cipher = 1027078
(3) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(3) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(3) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(3) Meraki-Device-Name = "AP-V1-Soporte"
(3) Framed-MTU = 1400
(3) EAP-Message = 0x027600061900
(3) State = 0x21dd954123ab8c3dcbc41c49c2b781e8
(3) Message-Authenticator = 0xdf7908d357b2fcfc9280a77d13deeb86
(3) session-state: No cached attributes
(3) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(3) authorize {
(3) policy filter_username {
(3) if (&User-Name) {
(3) if (&User-Name) -> TRUE
(3) if (&User-Name) {
(3) if (&User-Name =~ / /) {
(3) if (&User-Name =~ / /) -> FALSE
(3) if (&User-Name =~ /@[^@]*@/ ) {
(3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(3) if (&User-Name =~ /\.\./ ) {
(3) if (&User-Name =~ /\.\./ ) -> FALSE
(3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(3) if (&User-Name =~ /\.$/) {
(3) if (&User-Name =~ /\.$/) -> FALSE
(3) if (&User-Name =~ /(a)\./) {
(3) if (&User-Name =~ /(a)\./) -> FALSE
(3) } # if (&User-Name) = notfound
(3) } # policy filter_username = notfound
(3) [preprocess] = ok
(3) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(3) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(3) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(3) auth_log: EXPAND %t
(3) auth_log: --> Fri Aug 28 18:49:24 2020
(3) [auth_log] = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(3) suffix: Found realm "ucn.cl"
(3) suffix: Adding Stripped-User-Name = "wifi"
(3) suffix: Adding Realm = "ucn.cl"
(3) suffix: Authentication realm is LOCAL
(3) [suffix] = ok
(3) eap: Peer sent EAP Response (code 2) ID 118 length 6
(3) eap: Continuing tunnel setup
(3) [eap] = ok
(3) } # authorize = ok
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3) authenticate {
(3) eap: Expiring EAP session with state 0x21dd954123ab8c3d
(3) eap: Finished EAP session with state 0x21dd954123ab8c3d
(3) eap: Previous EAP request found for state 0x21dd954123ab8c3d, released
from the list
(3) eap: Peer sent packet with method EAP PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: Continuing EAP-TLS
(3) eap_peap: Peer ACKed our handshake fragment
(3) eap_peap: [eaptls verify] = request
(3) eap_peap: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 119 length 1000
(3) eap: EAP session adding &reply:State = 0x21dd954122aa8c3d
(3) [eap] = handled
(3) } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3) Challenge { ... } # empty sub-section is ignored
(3) Sent Access-Challenge Id 14 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(3) EAP-Message =
0x017703e81940303140616c756d6e6f732e75636e2e636c3122302006035504030c19456e746964616420636572746966696361646f72612055434e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bac4e13cd8c7fa57371bce6d41f22a26bcad2ffba6e97df5048e2d
(3) Message-Authenticator = 0x00000000000000000000000000000000
(3) State = 0x21dd954122aa8c3dcbc41c49c2b781e8
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 15 from 192.168.128.34:39957 to
146.83.124.26:1812 length 409
(4) User-Name = "wifi(a)ucn.cl"
(4) NAS-IP-Address = 192.168.128.34
(4) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(4) NAS-Port-Type = Wireless-802.11
(4) Service-Type = Framed-User
(4) NAS-Port = 1
(4) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(4) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 57 / Channel: 1"
(4) Acct-Session-Id = "B51015A162BFE948"
(4) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(4) WLAN-Pairwise-Cipher = 1027076
(4) WLAN-Group-Cipher = 1027074
(4) WLAN-AKM-Suite = 1027073
(4) WLAN-Group-Mgmt-Cipher = 1027078
(4) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(4) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(4) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(4) Meraki-Device-Name = "AP-V1-Soporte"
(4) Framed-MTU = 1400
(4) EAP-Message = 0x027700061900
(4) State = 0x21dd954122aa8c3dcbc41c49c2b781e8
(4) Message-Authenticator = 0x7747c72fb1b5d7e944b19d7fe7e11405
(4) session-state: No cached attributes
(4) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(4) authorize {
(4) policy filter_username {
(4) if (&User-Name) {
(4) if (&User-Name) -> TRUE
(4) if (&User-Name) {
(4) if (&User-Name =~ / /) {
(4) if (&User-Name =~ / /) -> FALSE
(4) if (&User-Name =~ /@[^@]*@/ ) {
(4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(4) if (&User-Name =~ /\.\./ ) {
(4) if (&User-Name =~ /\.\./ ) -> FALSE
(4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(4) if (&User-Name =~ /\.$/) {
(4) if (&User-Name =~ /\.$/) -> FALSE
(4) if (&User-Name =~ /(a)\./) {
(4) if (&User-Name =~ /(a)\./) -> FALSE
(4) } # if (&User-Name) = notfound
(4) } # policy filter_username = notfound
(4) [preprocess] = ok
(4) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(4) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(4) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(4) auth_log: EXPAND %t
(4) auth_log: --> Fri Aug 28 18:49:25 2020
(4) [auth_log] = ok
(4) [chap] = noop
(4) [mschap] = noop
(4) [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(4) suffix: Found realm "ucn.cl"
(4) suffix: Adding Stripped-User-Name = "wifi"
(4) suffix: Adding Realm = "ucn.cl"
(4) suffix: Authentication realm is LOCAL
(4) [suffix] = ok
(4) eap: Peer sent EAP Response (code 2) ID 119 length 6
(4) eap: Continuing tunnel setup
(4) [eap] = ok
(4) } # authorize = ok
(4) Found Auth-Type = eap
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4) authenticate {
(4) eap: Expiring EAP session with state 0x21dd954122aa8c3d
(4) eap: Finished EAP session with state 0x21dd954122aa8c3d
(4) eap: Previous EAP request found for state 0x21dd954122aa8c3d, released
from the list
(4) eap: Peer sent packet with method EAP PEAP (25)
(4) eap: Calling submodule eap_peap to process data
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: Peer ACKed our handshake fragment
(4) eap_peap: [eaptls verify] = request
(4) eap_peap: [eaptls process] = handled
(4) eap: Sending EAP Request (code 1) ID 120 length 1000
(4) eap: EAP session adding &reply:State = 0x21dd954125a58c3d
(4) [eap] = handled
(4) } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4) Challenge { ... } # empty sub-section is ignored
(4) Sent Access-Challenge Id 15 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(4) EAP-Message =
0x017803e81940c77251950fa0fe126a12332e02a8771ae735a0577b0809945f2151bb00b8f395f3f54573f94c87a0ad1afb624ea621c50e5cd9581e9bd0b5cc20a6f0c9bdbbbe326850002220a5b201f4bee09362a04c3dea95c4263c7c8ae9852a2a4c882975dc2cf44699206592149806fb22a1c9d191
(4) Message-Authenticator = 0x00000000000000000000000000000000
(4) State = 0x21dd954125a58c3dcbc41c49c2b781e8
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 16 from 192.168.128.34:39957 to
146.83.124.26:1812 length 409
(5) User-Name = "wifi(a)ucn.cl"
(5) NAS-IP-Address = 192.168.128.34
(5) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(5) NAS-Port-Type = Wireless-802.11
(5) Service-Type = Framed-User
(5) NAS-Port = 1
(5) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(5) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1"
(5) Acct-Session-Id = "B51015A162BFE948"
(5) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(5) WLAN-Pairwise-Cipher = 1027076
(5) WLAN-Group-Cipher = 1027074
(5) WLAN-AKM-Suite = 1027073
(5) WLAN-Group-Mgmt-Cipher = 1027078
(5) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(5) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(5) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(5) Meraki-Device-Name = "AP-V1-Soporte"
(5) Framed-MTU = 1400
(5) EAP-Message = 0x027800061900
(5) State = 0x21dd954125a58c3dcbc41c49c2b781e8
(5) Message-Authenticator = 0x14679f103d269b881a86323b6d1e8549
(5) session-state: No cached attributes
(5) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(5) authorize {
(5) policy filter_username {
(5) if (&User-Name) {
(5) if (&User-Name) -> TRUE
(5) if (&User-Name) {
(5) if (&User-Name =~ / /) {
(5) if (&User-Name =~ / /) -> FALSE
(5) if (&User-Name =~ /@[^@]*@/ ) {
(5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(5) if (&User-Name =~ /\.\./ ) {
(5) if (&User-Name =~ /\.\./ ) -> FALSE
(5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(5) if (&User-Name =~ /\.$/) {
(5) if (&User-Name =~ /\.$/) -> FALSE
(5) if (&User-Name =~ /(a)\./) {
(5) if (&User-Name =~ /(a)\./) -> FALSE
(5) } # if (&User-Name) = notfound
(5) } # policy filter_username = notfound
(5) [preprocess] = ok
(5) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(5) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(5) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(5) auth_log: EXPAND %t
(5) auth_log: --> Fri Aug 28 18:49:25 2020
(5) [auth_log] = ok
(5) [chap] = noop
(5) [mschap] = noop
(5) [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(5) suffix: Found realm "ucn.cl"
(5) suffix: Adding Stripped-User-Name = "wifi"
(5) suffix: Adding Realm = "ucn.cl"
(5) suffix: Authentication realm is LOCAL
(5) [suffix] = ok
(5) eap: Peer sent EAP Response (code 2) ID 120 length 6
(5) eap: Continuing tunnel setup
(5) [eap] = ok
(5) } # authorize = ok
(5) Found Auth-Type = eap
(5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(5) authenticate {
(5) eap: Expiring EAP session with state 0x21dd954125a58c3d
(5) eap: Finished EAP session with state 0x21dd954125a58c3d
(5) eap: Previous EAP request found for state 0x21dd954125a58c3d, released
from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: Continuing EAP-TLS
(5) eap_peap: Peer ACKed our handshake fragment
(5) eap_peap: [eaptls verify] = request
(5) eap_peap: [eaptls process] = handled
(5) eap: Sending EAP Request (code 1) ID 121 length 101
(5) eap: EAP session adding &reply:State = 0x21dd954124a48c3d
(5) [eap] = handled
(5) } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(5) Challenge { ... } # empty sub-section is ignored
(5) Sent Access-Challenge Id 16 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(5) EAP-Message =
0x017900651900b69a44dd3c02289e1d59e3c9942f182daeeaf01b0f7a2e2ad802551c3563754923a576bf26f9b0e0c6f3af501b6adccd04f8dd1d542c997d9ddce0870cb079731b1d26fde666eb374bdbbfb958b1467d9eb84423ac0816030300040e000000
(5) Message-Authenticator = 0x00000000000000000000000000000000
(5) State = 0x21dd954124a48c3dcbc41c49c2b781e8
(5) Finished request
Waking up in 4.8 seconds.
(6) Received Access-Request Id 17 from 192.168.128.34:39957 to
146.83.124.26:1812 length 539
(6) User-Name = "wifi(a)ucn.cl"
(6) NAS-IP-Address = 192.168.128.34
(6) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(6) NAS-Port-Type = Wireless-802.11
(6) Service-Type = Framed-User
(6) NAS-Port = 1
(6) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(6) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 58 / Channel: 1"
(6) Acct-Session-Id = "B51015A162BFE948"
(6) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(6) WLAN-Pairwise-Cipher = 1027076
(6) WLAN-Group-Cipher = 1027074
(6) WLAN-AKM-Suite = 1027073
(6) WLAN-Group-Mgmt-Cipher = 1027078
(6) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(6) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(6) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(6) Meraki-Device-Name = "AP-V1-Soporte"
(6) Framed-MTU = 1400
(6) EAP-Message =
0x0279008819800000007e16030300461000004241046788806fbe757cf78d6a08d389fa7e8e550a21e4f195bff23a790c07e11ad380d541a0611f622fa4eb278e6a47fc06503e47e7d0675dfc89ef1975734a5f8cb614030300010116030300280000000000000000b8bf847857e145f1074457e48f47b4
(6) State = 0x21dd954124a48c3dcbc41c49c2b781e8
(6) Message-Authenticator = 0x756e5b4622e8707f399a8f35de7abb61
(6) session-state: No cached attributes
(6) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(6) authorize {
(6) policy filter_username {
(6) if (&User-Name) {
(6) if (&User-Name) -> TRUE
(6) if (&User-Name) {
(6) if (&User-Name =~ / /) {
(6) if (&User-Name =~ / /) -> FALSE
(6) if (&User-Name =~ /@[^@]*@/ ) {
(6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(6) if (&User-Name =~ /\.\./ ) {
(6) if (&User-Name =~ /\.\./ ) -> FALSE
(6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(6) if (&User-Name =~ /\.$/) {
(6) if (&User-Name =~ /\.$/) -> FALSE
(6) if (&User-Name =~ /(a)\./) {
(6) if (&User-Name =~ /(a)\./) -> FALSE
(6) } # if (&User-Name) = notfound
(6) } # policy filter_username = notfound
(6) [preprocess] = ok
(6) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(6) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(6) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(6) auth_log: EXPAND %t
(6) auth_log: --> Fri Aug 28 18:49:25 2020
(6) [auth_log] = ok
(6) [chap] = noop
(6) [mschap] = noop
(6) [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(6) suffix: Found realm "ucn.cl"
(6) suffix: Adding Stripped-User-Name = "wifi"
(6) suffix: Adding Realm = "ucn.cl"
(6) suffix: Authentication realm is LOCAL
(6) [suffix] = ok
(6) eap: Peer sent EAP Response (code 2) ID 121 length 136
(6) eap: Continuing tunnel setup
(6) [eap] = ok
(6) } # authorize = ok
(6) Found Auth-Type = eap
(6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(6) authenticate {
(6) eap: Expiring EAP session with state 0x21dd954124a48c3d
(6) eap: Finished EAP session with state 0x21dd954124a48c3d
(6) eap: Previous EAP request found for state 0x21dd954124a48c3d, released
from the list
(6) eap: Peer sent packet with method EAP PEAP (25)
(6) eap: Calling submodule eap_peap to process data
(6) eap_peap: Continuing EAP-TLS
(6) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(6) eap_peap: Got complete TLS record (126 bytes)
(6) eap_peap: [eaptls verify] = length included
(6) eap_peap: TLS_accept: SSLv3/TLS write server done
(6) eap_peap: <<< recv TLS 1.2 [length 0046]
(6) eap_peap: TLS_accept: SSLv3/TLS read client key exchange
(6) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec
(6) eap_peap: <<< recv TLS 1.2 [length 0010]
(6) eap_peap: TLS_accept: SSLv3/TLS read finished
(6) eap_peap: >>> send TLS 1.2 [length 0001]
(6) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec
(6) eap_peap: >>> send TLS 1.2 [length 0010]
(6) eap_peap: TLS_accept: SSLv3/TLS write finished
(6) eap_peap: (other): SSL negotiation finished successfully
(6) eap_peap: SSL Connection Established
(6) eap_peap: [eaptls process] = handled
(6) eap: Sending EAP Request (code 1) ID 122 length 57
(6) eap: EAP session adding &reply:State = 0x21dd954127a78c3d
(6) [eap] = handled
(6) } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(6) Challenge { ... } # empty sub-section is ignored
(6) Sent Access-Challenge Id 17 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(6) EAP-Message =
0x017a0039190014030300010116030300282fa7d91ce14448b5632cba41946bad19f391306bae4b4b64a1293149cc0357f01a76329107706008
(6) Message-Authenticator = 0x00000000000000000000000000000000
(6) State = 0x21dd954127a78c3dcbc41c49c2b781e8
(6) Finished request
Waking up in 4.8 seconds.
(7) Received Access-Request Id 18 from 192.168.128.34:39957 to
146.83.124.26:1812 length 409
(7) User-Name = "wifi(a)ucn.cl"
(7) NAS-IP-Address = 192.168.128.34
(7) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(7) NAS-Port-Type = Wireless-802.11
(7) Service-Type = Framed-User
(7) NAS-Port = 1
(7) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(7) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1"
(7) Acct-Session-Id = "B51015A162BFE948"
(7) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(7) WLAN-Pairwise-Cipher = 1027076
(7) WLAN-Group-Cipher = 1027074
(7) WLAN-AKM-Suite = 1027073
(7) WLAN-Group-Mgmt-Cipher = 1027078
(7) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(7) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(7) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(7) Meraki-Device-Name = "AP-V1-Soporte"
(7) Framed-MTU = 1400
(7) EAP-Message = 0x027a00061900
(7) State = 0x21dd954127a78c3dcbc41c49c2b781e8
(7) Message-Authenticator = 0xa6eabb00fc3dbb9f8a77e3e189c08f82
(7) session-state: No cached attributes
(7) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(7) authorize {
(7) policy filter_username {
(7) if (&User-Name) {
(7) if (&User-Name) -> TRUE
(7) if (&User-Name) {
(7) if (&User-Name =~ / /) {
(7) if (&User-Name =~ / /) -> FALSE
(7) if (&User-Name =~ /@[^@]*@/ ) {
(7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(7) if (&User-Name =~ /\.\./ ) {
(7) if (&User-Name =~ /\.\./ ) -> FALSE
(7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(7) if (&User-Name =~ /\.$/) {
(7) if (&User-Name =~ /\.$/) -> FALSE
(7) if (&User-Name =~ /(a)\./) {
(7) if (&User-Name =~ /(a)\./) -> FALSE
(7) } # if (&User-Name) = notfound
(7) } # policy filter_username = notfound
(7) [preprocess] = ok
(7) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(7) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(7) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(7) auth_log: EXPAND %t
(7) auth_log: --> Fri Aug 28 18:49:27 2020
(7) [auth_log] = ok
(7) [chap] = noop
(7) [mschap] = noop
(7) [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(7) suffix: Found realm "ucn.cl"
(7) suffix: Adding Stripped-User-Name = "wifi"
(7) suffix: Adding Realm = "ucn.cl"
(7) suffix: Authentication realm is LOCAL
(7) [suffix] = ok
(7) eap: Peer sent EAP Response (code 2) ID 122 length 6
(7) eap: Continuing tunnel setup
(7) [eap] = ok
(7) } # authorize = ok
(7) Found Auth-Type = eap
(7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(7) authenticate {
(7) eap: Expiring EAP session with state 0x21dd954127a78c3d
(7) eap: Finished EAP session with state 0x21dd954127a78c3d
(7) eap: Previous EAP request found for state 0x21dd954127a78c3d, released
from the list
(7) eap: Peer sent packet with method EAP PEAP (25)
(7) eap: Calling submodule eap_peap to process data
(7) eap_peap: Continuing EAP-TLS
(7) eap_peap: Peer ACKed our handshake fragment. handshake is finished
(7) eap_peap: [eaptls verify] = success
(7) eap_peap: [eaptls process] = success
(7) eap_peap: Session established. Decoding tunneled attributes
(7) eap_peap: PEAP state TUNNEL ESTABLISHED
(7) eap: Sending EAP Request (code 1) ID 123 length 40
(7) eap: EAP session adding &reply:State = 0x21dd954126a68c3d
(7) [eap] = handled
(7) } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(7) Challenge { ... } # empty sub-section is ignored
(7) Sent Access-Challenge Id 18 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(7) EAP-Message =
0x017b00281900170303001d2fa7d91ce14448b6c26c44cc6ab809edad31b8e6e88a368d132b76190a
(7) Message-Authenticator = 0x00000000000000000000000000000000
(7) State = 0x21dd954126a68c3dcbc41c49c2b781e8
(7) Finished request
Waking up in 2.6 seconds.
(8) Received Access-Request Id 19 from 192.168.128.34:39957 to
146.83.124.26:1812 length 450
(8) User-Name = "wifi(a)ucn.cl"
(8) NAS-IP-Address = 192.168.128.34
(8) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(8) NAS-Port-Type = Wireless-802.11
(8) Service-Type = Framed-User
(8) NAS-Port = 1
(8) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(8) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 59 / Channel: 1"
(8) Acct-Session-Id = "B51015A162BFE948"
(8) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(8) WLAN-Pairwise-Cipher = 1027076
(8) WLAN-Group-Cipher = 1027074
(8) WLAN-AKM-Suite = 1027073
(8) WLAN-Group-Mgmt-Cipher = 1027078
(8) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(8) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(8) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(8) Meraki-Device-Name = "AP-V1-Soporte"
(8) Framed-MTU = 1400
(8) EAP-Message =
0x027b002f19001703030024000000000000000160600c8649acac0a4995596f57083fda3fb934048eec7b2d68991701
(8) State = 0x21dd954126a68c3dcbc41c49c2b781e8
(8) Message-Authenticator = 0xb6ce80dae8ccb6105cd97cfbcd9fe078
(8) session-state: No cached attributes
(8) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(8) authorize {
(8) policy filter_username {
(8) if (&User-Name) {
(8) if (&User-Name) -> TRUE
(8) if (&User-Name) {
(8) if (&User-Name =~ / /) {
(8) if (&User-Name =~ / /) -> FALSE
(8) if (&User-Name =~ /@[^@]*@/ ) {
(8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(8) if (&User-Name =~ /\.\./ ) {
(8) if (&User-Name =~ /\.\./ ) -> FALSE
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(8) if (&User-Name =~ /\.$/) {
(8) if (&User-Name =~ /\.$/) -> FALSE
(8) if (&User-Name =~ /(a)\./) {
(8) if (&User-Name =~ /(a)\./) -> FALSE
(8) } # if (&User-Name) = notfound
(8) } # policy filter_username = notfound
(8) [preprocess] = ok
(8) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(8) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(8) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(8) auth_log: EXPAND %t
(8) auth_log: --> Fri Aug 28 18:49:27 2020
(8) [auth_log] = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(8) suffix: Found realm "ucn.cl"
(8) suffix: Adding Stripped-User-Name = "wifi"
(8) suffix: Adding Realm = "ucn.cl"
(8) suffix: Authentication realm is LOCAL
(8) [suffix] = ok
(8) eap: Peer sent EAP Response (code 2) ID 123 length 47
(8) eap: Continuing tunnel setup
(8) [eap] = ok
(8) } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(8) authenticate {
(8) eap: Expiring EAP session with state 0x21dd954126a68c3d
(8) eap: Finished EAP session with state 0x21dd954126a68c3d
(8) eap: Previous EAP request found for state 0x21dd954126a68c3d, released
from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: Continuing EAP-TLS
(8) eap_peap: [eaptls verify] = ok
(8) eap_peap: Done initial handshake
(8) eap_peap: [eaptls process] = ok
(8) eap_peap: Session established. Decoding tunneled attributes
(8) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(8) eap_peap: Identity - wifi(a)ucn.cl
(8) eap_peap: Got inner identity 'wifi(a)ucn.cl'
(8) eap_peap: Setting default EAP type for tunneled EAP session
(8) eap_peap: Got tunneled request
(8) eap_peap: EAP-Message = 0x027b001001776966694075636e2e636c
(8) eap_peap: Setting User-Name to wifi(a)ucn.cl
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap: EAP-Message = 0x027b001001776966694075636e2e636c
(8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap: User-Name = "wifi(a)ucn.cl"
(8) Virtual server inner-tunnel received request
(8) EAP-Message = 0x027b001001776966694075636e2e636c
(8) FreeRADIUS-Proxied-To = 127.0.0.1
(8) User-Name = "wifi(a)ucn.cl"
(8) WARNING: Outer and inner identities are the same. User privacy is
compromised.
(8) server inner-tunnel {
(8) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8) authorize {
(8) policy filter_username {
(8) if (&User-Name) {
(8) if (&User-Name) -> TRUE
(8) if (&User-Name) {
(8) if (&User-Name =~ / /) {
(8) if (&User-Name =~ / /) -> FALSE
(8) if (&User-Name =~ /@[^@]*@/ ) {
(8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(8) if (&User-Name =~ /\.\./ ) {
(8) if (&User-Name =~ /\.\./ ) -> FALSE
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/))
-> FALSE
(8) if (&User-Name =~ /\.$/) {
(8) if (&User-Name =~ /\.$/) -> FALSE
(8) if (&User-Name =~ /(a)\./) {
(8) if (&User-Name =~ /(a)\./) -> FALSE
(8) } # if (&User-Name) = notfound
(8) } # policy filter_username = notfound
(8) [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(8) suffix: Found realm "ucn.cl"
(8) suffix: Adding Stripped-User-Name = "wifi"
(8) suffix: Adding Realm = "ucn.cl"
(8) suffix: Authentication realm is LOCAL
(8) [suffix] = ok
(8) update control {
(8) &Proxy-To-Realm := LOCAL
(8) } # update control = noop
(8) eap: Peer sent EAP Response (code 2) ID 123 length 16
(8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(8) [eap] = ok
(8) } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8) authenticate {
(8) eap: Peer sent packet with method EAP Identity (1)
(8) eap: Calling submodule eap_mschapv2 to process data
(8) eap_mschapv2: Issuing Challenge
(8) eap: Sending EAP Request (code 1) ID 124 length 43
(8) eap: EAP session adding &reply:State = 0xc56f897cc5139321
(8) [eap] = handled
(8) } # authenticate = handled
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8) EAP-Message =
0x017c002b1a017c002610ef5df80f43a08b0517f2eebd51c95820667265657261646975732d332e302e3136
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0xc56f897cc5139321a7b06bef2a6a6d11
(8) eap_peap: Got tunneled reply code 11
(8) eap_peap: EAP-Message =
0x017c002b1a017c002610ef5df80f43a08b0517f2eebd51c95820667265657261646975732d332e302e3136
(8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: State = 0xc56f897cc5139321a7b06bef2a6a6d11
(8) eap_peap: Got tunneled reply RADIUS code 11
(8) eap_peap: EAP-Message =
0x017c002b1a017c002610ef5df80f43a08b0517f2eebd51c95820667265657261646975732d332e302e3136
(8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: State = 0xc56f897cc5139321a7b06bef2a6a6d11
(8) eap_peap: Got tunneled Access-Challenge
(8) eap: Sending EAP Request (code 1) ID 124 length 74
(8) eap: EAP session adding &reply:State = 0x21dd954129a18c3d
(8) [eap] = handled
(8) } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(8) Challenge { ... } # empty sub-section is ignored
(8) Sent Access-Challenge Id 19 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(8) EAP-Message =
0x017c004a1900170303003f2fa7d91ce14448b7e5c0c32388ddc8194a591f34dc604c741d5fdbf79a47dce0e95eacb441f26d50b86e8204cf425c95a8be1d58c1239799c5c6e254b47166
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0x21dd954129a18c3dcbc41c49c2b781e8
(8) Finished request
Waking up in 2.6 seconds.
(9) Received Access-Request Id 20 from 192.168.128.34:39957 to
146.83.124.26:1812 length 504
(9) User-Name = "wifi(a)ucn.cl"
(9) NAS-IP-Address = 192.168.128.34
(9) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(9) NAS-Port-Type = Wireless-802.11
(9) Service-Type = Framed-User
(9) NAS-Port = 1
(9) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(9) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 59 / Channel: 1"
(9) Acct-Session-Id = "B51015A162BFE948"
(9) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(9) WLAN-Pairwise-Cipher = 1027076
(9) WLAN-Group-Cipher = 1027074
(9) WLAN-AKM-Suite = 1027073
(9) WLAN-Group-Mgmt-Cipher = 1027078
(9) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(9) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(9) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(9) Meraki-Device-Name = "AP-V1-Soporte"
(9) Framed-MTU = 1400
(9) EAP-Message =
0x027c00651900170303005a00000000000000024a9bc269a4199bdc550260ada1d90a510ef9fbf7753f11ec5fe5be876f6eeb2e234a0365719abde087d2a48deb5cf395ca9706c7efe83b694fcfaa80a0a1d145c0357c0bf7ff504d9b9ac35051cf54949111
(9) State = 0x21dd954129a18c3dcbc41c49c2b781e8
(9) Message-Authenticator = 0xc9f8565bd068d6ad35c63cd3ec5e16d2
(9) session-state: No cached attributes
(9) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]*@/ ) {
(9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(9) if (&User-Name =~ /\.\./ ) {
(9) if (&User-Name =~ /\.\./ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(9) if (&User-Name =~ /\.$/) {
(9) if (&User-Name =~ /\.$/) -> FALSE
(9) if (&User-Name =~ /(a)\./) {
(9) if (&User-Name =~ /(a)\./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [preprocess] = ok
(9) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(9) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(9) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(9) auth_log: EXPAND %t
(9) auth_log: --> Fri Aug 28 18:49:27 2020
(9) [auth_log] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(9) suffix: Found realm "ucn.cl"
(9) suffix: Adding Stripped-User-Name = "wifi"
(9) suffix: Adding Realm = "ucn.cl"
(9) suffix: Authentication realm is LOCAL
(9) [suffix] = ok
(9) eap: Peer sent EAP Response (code 2) ID 124 length 101
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0xc56f897cc5139321
(9) eap: Finished EAP session with state 0x21dd954129a18c3d
(9) eap: Previous EAP request found for state 0x21dd954129a18c3d, released
from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: [eaptls verify] = ok
(9) eap_peap: Done initial handshake
(9) eap_peap: [eaptls process] = ok
(9) eap_peap: Session established. Decoding tunneled attributes
(9) eap_peap: PEAP state phase2
(9) eap_peap: EAP method MSCHAPv2 (26)
(9) eap_peap: Got tunneled request
(9) eap_peap: EAP-Message =
0x027c00461a027c00413112edf048489e741053571c93c8bcbb060000000000000000ef518244cd55d743a477d7e0528409c7d7373fb0f1a54f1200776966694075636e2e636c
(9) eap_peap: Setting User-Name to wifi(a)ucn.cl
(9) eap_peap: Sending tunneled request to inner-tunnel
(9) eap_peap: EAP-Message =
0x027c00461a027c00413112edf048489e741053571c93c8bcbb060000000000000000ef518244cd55d743a477d7e0528409c7d7373fb0f1a54f1200776966694075636e2e636c
(9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(9) eap_peap: User-Name = "wifi(a)ucn.cl"
(9) eap_peap: State = 0xc56f897cc5139321a7b06bef2a6a6d11
(9) Virtual server inner-tunnel received request
(9) EAP-Message =
0x027c00461a027c00413112edf048489e741053571c93c8bcbb060000000000000000ef518244cd55d743a477d7e0528409c7d7373fb0f1a54f1200776966694075636e2e636c
(9) FreeRADIUS-Proxied-To = 127.0.0.1
(9) User-Name = "wifi(a)ucn.cl"
(9) State = 0xc56f897cc5139321a7b06bef2a6a6d11
(9) WARNING: Outer and inner identities are the same. User privacy is
compromised.
(9) server inner-tunnel {
(9) session-state: No cached attributes
(9) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]*@/ ) {
(9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(9) if (&User-Name =~ /\.\./ ) {
(9) if (&User-Name =~ /\.\./ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/))
-> FALSE
(9) if (&User-Name =~ /\.$/) {
(9) if (&User-Name =~ /\.$/) -> FALSE
(9) if (&User-Name =~ /(a)\./) {
(9) if (&User-Name =~ /(a)\./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [mschap] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(9) suffix: Found realm "ucn.cl"
(9) suffix: Adding Stripped-User-Name = "wifi"
(9) suffix: Adding Realm = "ucn.cl"
(9) suffix: Authentication realm is LOCAL
(9) [suffix] = ok
(9) update control {
(9) &Proxy-To-Realm := LOCAL
(9) } # update control = noop
(9) eap: Peer sent EAP Response (code 2) ID 124 length 70
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9) [eap] = updated
(9) if (Realm == 'ucn.cl') {
(9) if (Realm == 'ucn.cl') -> TRUE
(9) if (Realm == 'ucn.cl') {
(9) first_files: EXPAND %{Virtual-Server}
(9) first_files: --> inner-tunnel
(9) first_files: users: Matched entry DEFAULT at line 93
(9) [first_files] = ok
(9) } # if (Realm == 'ucn.cl') = ok
(9) if (Realm == 'alumnos.ucn.cl') {
(9) if (Realm == 'alumnos.ucn.cl') -> FALSE
(9) files: EXPAND %{Virtual-Server}
(9) files: --> inner-tunnel
(9) files: users: Matched entry DEFAULT at line 95
(9) [files] = ok
(9) first_files: EXPAND %{Virtual-Server}
(9) first_files: --> inner-tunnel
(9) first_files: users: Matched entry DEFAULT at line 93
(9) [first_files] = ok
(9) second_files: EXPAND %{Virtual-Server}
(9) second_files: --> inner-tunnel
(9) second_files: users: Matched entry DEFAULT at line 93
(9) [second_files] = ok
(9) [expiration] = noop
(9) [logintime] = noop
(9) [pap] = noop
(9) } # authorize = updated
(9) Found Auth-Type = pam
(9) # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9) authenticate {
(9) pam: Attribute "User-Password" is required for authentication
(9) [pam] = invalid
(9) } # authenticate = invalid
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject
(9) # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9) Post-Auth-Type REJECT {
(9) reply_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
(9) reply_log: --> /var/log/freeradius/radacct/
192.168.128.34/reply-detail-20200828
(9) reply_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/reply-detail-20200828
(9) reply_log: WARNING: Skipping empty packet
(9) [reply_log] = ok
(9) attr_filter.access_reject: EXPAND %{User-Name}
(9) attr_filter.access_reject: --> wifi(a)ucn.cl
(9) attr_filter.access_reject: Matched entry DEFAULT at line 11
(9) [attr_filter.access_reject] = updated
(9) update outer.session-state {
(9) No attributes updated
(9) } # update outer.session-state = noop
(9) } # Post-Auth-Type REJECT = updated
(9) } # server inner-tunnel
(9) Virtual server sending reply
(9) eap_peap: Got tunneled reply code 3
(9) eap_peap: Got tunneled reply RADIUS code 3
(9) eap_peap: Tunneled authentication was rejected
(9) eap_peap: FAILURE
(9) eap: Sending EAP Request (code 1) ID 125 length 46
(9) eap: EAP session adding &reply:State = 0x21dd954128a08c3d
(9) [eap] = handled
(9) } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(9) Challenge { ... } # empty sub-section is ignored
(9) Sent Access-Challenge Id 20 from 146.83.124.26:1812 to
192.168.128.34:39957 length 0
(9) EAP-Message =
0x017d002e190017030300232fa7d91ce14448b8ddd68976e03c329bec9e1fd5f358bc7cec4fd90c62fe6eab52678f
(9) Message-Authenticator = 0x00000000000000000000000000000000
(9) State = 0x21dd954128a08c3dcbc41c49c2b781e8
(9) Finished request
Waking up in 2.6 seconds.
(10) Received Access-Request Id 21 from 192.168.128.34:39957 to
146.83.124.26:1812 length 449
(10) User-Name = "wifi(a)ucn.cl"
(10) NAS-IP-Address = 192.168.128.34
(10) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius"
(10) NAS-Port-Type = Wireless-802.11
(10) Service-Type = Framed-User
(10) NAS-Port = 1
(10) Calling-Station-Id = "E4-6F-13-2C-A4-C3"
(10) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1"
(10) Acct-Session-Id = "B51015A162BFE948"
(10) Acct-Multi-Session-Id = "8F5640A8CB689CCA"
(10) WLAN-Pairwise-Cipher = 1027076
(10) WLAN-Group-Cipher = 1027074
(10) WLAN-AKM-Suite = 1027073
(10) WLAN-Group-Mgmt-Cipher = 1027078
(10) Attr-26.29671.2 =
0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373
(10) Attr-26.29671.3 = 0x41502d56312d536f706f727465
(10) Attr-26.29671.4 =
0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649
(10) Meraki-Device-Name = "AP-V1-Soporte"
(10) Framed-MTU = 1400
(10) EAP-Message =
0x027d002e19001703030023000000000000000376d2d8397dd47c5aa4c12397dc5d81bd6492de176eb0693ea9966a
(10) State = 0x21dd954128a08c3dcbc41c49c2b781e8
(10) Message-Authenticator = 0x1cc95b6ddafcd8b2fa3b088b64b138db
(10) session-state: No cached attributes
(10) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(10) authorize {
(10) policy filter_username {
(10) if (&User-Name) {
(10) if (&User-Name) -> TRUE
(10) if (&User-Name) {
(10) if (&User-Name =~ / /) {
(10) if (&User-Name =~ / /) -> FALSE
(10) if (&User-Name =~ /@[^@]*@/ ) {
(10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(10) if (&User-Name =~ /\.\./ ) {
(10) if (&User-Name =~ /\.\./ ) -> FALSE
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/))
-> FALSE
(10) if (&User-Name =~ /\.$/) {
(10) if (&User-Name =~ /\.$/) -> FALSE
(10) if (&User-Name =~ /(a)\./) {
(10) if (&User-Name =~ /(a)\./) -> FALSE
(10) } # if (&User-Name) = notfound
(10) } # policy filter_username = notfound
(10) [preprocess] = ok
(10) auth_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(10) auth_log: --> /var/log/freeradius/radacct/
192.168.128.34/auth-detail-20200828
(10) auth_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828
(10) auth_log: EXPAND %t
(10) auth_log: --> Fri Aug 28 18:49:27 2020
(10) [auth_log] = ok
(10) [chap] = noop
(10) [mschap] = noop
(10) [digest] = noop
(10) suffix: Checking for suffix after "@"
(10) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl"
(10) suffix: Found realm "ucn.cl"
(10) suffix: Adding Stripped-User-Name = "wifi"
(10) suffix: Adding Realm = "ucn.cl"
(10) suffix: Authentication realm is LOCAL
(10) [suffix] = ok
(10) eap: Peer sent EAP Response (code 2) ID 125 length 46
(10) eap: Continuing tunnel setup
(10) [eap] = ok
(10) } # authorize = ok
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(10) authenticate {
(10) eap: Expiring EAP session with state 0xc56f897cc5139321
(10) eap: Finished EAP session with state 0x21dd954128a08c3d
(10) eap: Previous EAP request found for state 0x21dd954128a08c3d, released
from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: Continuing EAP-TLS
(10) eap_peap: [eaptls verify] = ok
(10) eap_peap: Done initial handshake
(10) eap_peap: [eaptls process] = ok
(10) eap_peap: Session established. Decoding tunneled attributes
(10) eap_peap: PEAP state send tlv failure
(10) eap_peap: Received EAP-TLV response
(10) eap_peap: ERROR: The users session was previously rejected:
returning reject (again.)
(10) eap_peap: This means you need to read the PREVIOUS messages in the
debug output
(10) eap_peap: to find out the reason why the user was rejected
(10) eap_peap: Look for "reject" or "fail". Those earlier messages will
tell you
(10) eap_peap: what went wrong, and how to fix the problem
(10) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module
failed
(10) eap: Sending EAP Failure (code 4) ID 125 length 4
(10) eap: Failed in EAP select
(10) [eap] = invalid
(10) } # authenticate = invalid
(10) Failed to authenticate the user
(10) Using Post-Auth-Type Reject
(10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(10) Post-Auth-Type REJECT {
(10) attr_filter.access_reject: EXPAND %{User-Name}
(10) attr_filter.access_reject: --> wifi(a)ucn.cl
(10) attr_filter.access_reject: Matched entry DEFAULT at line 11
(10) [attr_filter.access_reject] = updated
(10) [eap] = noop
(10) reply_log: EXPAND
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
(10) reply_log: --> /var/log/freeradius/radacct/
192.168.128.34/reply-detail-20200828
(10) reply_log:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.128.34/reply-detail-20200828
(10) reply_log: EXPAND %t
(10) reply_log: --> Fri Aug 28 18:49:27 2020
(10) [reply_log] = ok
(10) policy remove_reply_message_if_eap {
(10) if (&reply:EAP-Message && &reply:Reply-Message) {
(10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(10) else {
(10) [noop] = noop
(10) } # else = noop
(10) } # policy remove_reply_message_if_eap = noop
(10) } # Post-Auth-Type REJECT = updated
(10) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(10) Sending delayed response
(10) Sent Access-Reject Id 21 from 146.83.124.26:1812 to
192.168.128.34:39957 length 44
(10) EAP-Message = 0x047d0004
(10) Message-Authenticator = 0x00000000000000000000000000000000
Thanks in advance.
Bárbara.
2
12
Dear Colleagues,
I have been unable to resolve the following error in debug mode:
Invalid packet code 1 sent to a accounting port from client localhost port 21474 : IGNORED
Ready to process requests
The only answer I have found online suggests a port conflict but no other port other than 1813 would respond to accounting requests. Note: accounting point is set to 0 in sites-enabled/default
Thank you for any help.
2
3
Hi,
I’ve never needed to post here but this one has really stifled me. I have an end user with a Samsung S20+ and the September 2020 security patch attempting to connect to eduroam, everything looks fine client side (PEAP/MSCHAPv2) which has been verified by myself but Freeradius keeps throwing EAP-GTC errors. All other devices hitting Freeradius are connecting normally without issue.
eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed
I’ve no idea why its touching EAP-GTC at all… The client is set for MSCHAPv2 so I’m inclined to say that the client is bad and to wait for the next update but it’s difficult to articulate that to end users who have purchased the latest Samsung. Any ideas?
Debug as per below.
Cheers
Shaun
Copyright (C) 1999-2015 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/local/share/freeradius/dictionary
including dictionary file /usr/local/share/freeradius/dictionary.dhcp
including dictionary file /usr/local/share/freeradius/dictionary.vqp
including dictionary file /usr/local/etc/raddb/dictionary
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/proxy.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/mods-enabled/
including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
including configuration file /usr/local/etc/raddb/mods-enabled/realm
including configuration file /usr/local/etc/raddb/mods-enabled/eap
including configuration file /usr/local/etc/raddb/mods-enabled/exec
including configuration file /usr/local/etc/raddb/mods-enabled/dhcp
including configuration file /usr/local/etc/raddb/mods-enabled/logintime
including configuration file /usr/local/etc/raddb/mods-enabled/server_log
including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
including configuration file /usr/local/etc/raddb/mods-enabled/chap
including configuration file /usr/local/etc/raddb/mods-enabled/extended_logging
including configuration file /usr/local/etc/raddb/mods-enabled/always
including configuration file /usr/local/etc/raddb/mods-enabled/replicate
including configuration file /usr/local/etc/raddb/mods-enabled/soh
including configuration file /usr/local/etc/raddb/mods-enabled/files
including configuration file /usr/local/etc/raddb/mods-enabled/passwd
including configuration file /usr/local/etc/raddb/mods-enabled/detail
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
including configuration file /usr/local/etc/raddb/mods-enabled/echo
including configuration file /usr/local/etc/raddb/mods-enabled/expiration
including configuration file /usr/local/etc/raddb/mods-enabled/unpack
including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
including configuration file /usr/local/etc/raddb/mods-enabled/unix
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
including configuration file /usr/local/etc/raddb/mods-enabled/digest
including configuration file /usr/local/etc/raddb/mods-enabled/expr
including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
including configuration file /usr/local/etc/raddb/mods-enabled/pap
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
including files in directory /usr/local/etc/raddb/policy.d/
including configuration file /usr/local/etc/raddb/policy.d/eap
including configuration file /usr/local/etc/raddb/policy.d/dhcp
including configuration file /usr/local/etc/raddb/policy.d/canonicalization
including configuration file /usr/local/etc/raddb/policy.d/accounting
including configuration file /usr/local/etc/raddb/policy.d/filter
including configuration file /usr/local/etc/raddb/policy.d/control
including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
including configuration file /usr/local/etc/raddb/policy.d/debug
including configuration file /usr/local/etc/raddb/policy.d/operator-name
including configuration file /usr/local/etc/raddb/policy.d/cui
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/status
including configuration file /usr/local/etc/raddb/sites-enabled/eduroam
main {
security {
allow_core_dumps = no
}
}
main {
name = "radiusd"
prefix = "/usr/local"
localstatedir = "/usr/local/var"
sbindir = "/usr/local/sbin"
logdir = "/usr/local/var/log/radius"
run_dir = "/usr/local/var/run/radiusd"
libdir = "/usr/local/lib"
radacctdir = "/usr/local/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
checkrad = "/usr/local/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
allow_vulnerable_openssl = "yes"
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server eduroam0 {
ipaddr = roaming0.ja.net IPv4 address [194.82.174.185]
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server eduroam1 {
ipaddr = roaming1.ja.net IPv4 address [194.83.56.233]
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server eduroam2 {
ipaddr = roaming2.ja.net IPv4 address [194.83.56.249]
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server nps0 {
ipaddr = 10.0.38.3
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "none"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 20.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 120
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
realm harper-adams.ac.uk {
}
realm live.harper.ac.uk {
}
realm hkvets.ac.uk {
}
realm students.hkvets.ac.uk {
}
home_server_pool eduroam {
type = client-port-balance
home_server = eduroam0
home_server = eduroam1
home_server = eduroam2
}
realm eduroam {
auth_pool = eduroam
nostrip
}
home_server_pool nps {
type = client-port-balance
home_server = nps0
}
realm nps {
auth_pool = nps
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client 10.0.71.71/24 {
ipaddr = 10.0.71.71
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.30.120 {
ipaddr = 192.168.30.120
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.30.121 {
ipaddr = 192.168.30.121
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client roaming0.ja.net {
ipaddr = roaming0.ja.net IPv4 address [194.82.174.185]
require_message_authenticator = no
secret = <<< secret >>>
shortname = "roaming0.ja.net"
virtual_server = "eduroam"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client roaming1.ja.net {
ipaddr = roaming1.ja.net IPv4 address [194.83.56.233]
require_message_authenticator = no
secret = <<< secret >>>
shortname = "roaming1.ja.net"
virtual_server = "eduroam"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client roaming2.ja.net {
ipaddr = roaming2.ja.net IPv4 address [194.83.56.249]
require_message_authenticator = no
secret = <<< secret >>>
shortname = "roaming2.ja.net"
virtual_server = "eduroam"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.10.1 {
ipaddr = 192.168.10.1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client nps {
ipaddr = 10.0.38.3
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Debugger not attached
# Creating Auth-Type = digest
# Creating Autz-Type = Status-Server
radiusd: #### Instantiating modules ####
instantiate {
}
modules {
# Loaded module rlm_mschap
# Instantiating module "keele" from file /usr/local/etc/raddb/radiusd.conf
mschap keele {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=mercia.keele.ac.uk --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
passchange {
}
allow_retry = yes
}
rlm_mschap (keele): authenticating by calling 'ntlm_auth'
# Loaded module rlm_cache
# Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
cache cache_eap {
driver = "rlm_cache_rbtree"
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
ttl = 15
max_entries = 0
epoch = 0
add_stats = no
}
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
# Loaded module rlm_realm
# Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
# Loaded module rlm_eap
# Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
mod_accounting_username_bug = no
max_sessions = 1024
}
# Linked to sub-module rlm_eap_md5
# Linked to sub-module rlm_eap_leap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
}
tls-config tls-common {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
ca_path = "/usr/local/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/usr/local/etc/raddb/certs/server.pem"
certificate_file = "/usr/local/etc/raddb/certs/server.pem"
ca_file = "/usr/local/etc/raddb/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/usr/local/etc/raddb/certs/dh"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
ecdh_curve = "prime256v1"
cache {
enable = yes
lifetime = 24
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = yes
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_method = "mschapv2"
copy_request_to_tunnel = yes
use_tunneled_reply = yes
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Loaded module rlm_exec
# Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loaded module rlm_dhcp
# Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp
# Loaded module rlm_logintime
# Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_linelog
# Instantiating module "default_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog default_server_log {
filename = "/usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "default_server_log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "eduroam_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog eduroam_server_log {
filename = "/usr/local/var/log/radius/radacct/eduroam_server_log/eduroam_server_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "eduroam_server_log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "inner_tunnel_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog inner_tunnel_server_log {
filename = "/usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "accounting_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog accounting_server_log {
filename = "/usr/local/var/log/radius/radacct/accounting_server_log/accounting_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "%S#%{User-Name}#%{Framed-IP-Address}#%{Calling-Station-Id}#"
}
# Loaded module rlm_dynamic_clients
# Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
# Loaded module rlm_detail
# Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail auth_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
# Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail reply_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail pre_proxy_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail post_proxy_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_chap
# Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
# Instantiating module "on-site-internal-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog on-site-internal-accept-log {
filename = "/usr/local/var/log/radius/radacct/on-site-internal-accept-log/on-site-internal-accept-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "on-site-internal-accept-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "on-site-external-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog on-site-external-accept-log {
filename = "/usr/local/var/log/radius/radacct/on-site-external-accept-log/on-site-external-accept-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "on-site-external-accept-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "on-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog on-site-reject-log {
filename = "/usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "on-site-reject-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "off-site-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog off-site-accept-log {
filename = "/usr/local/var/log/radius/radacct/off-site-accept-log/off-site-accept-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "off-site-accept-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "off-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog off-site-reject-log {
filename = "/usr/local/var/log/radius/radacct/off-site-reject-log/off-site-reject-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "off-site-reject-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "off-site-eduroam-support-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog off-site-eduroam-support-reject-log {
filename = "/usr/local/var/log/radius/radacct/off-site-eduroam-support-reject-log/off-site-eduroam-support-reject-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "off-site-eduroam-support-reject-log.%{%{reply:Packet-Type}:-format}"
}
# Loaded module rlm_always
# Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
always reject {
rcode = "reject"
simulcount = 0
mpp = no
}
# Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
always invalid {
rcode = "invalid"
simulcount = 0
mpp = no
}
# Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
always notfound {
rcode = "notfound"
simulcount = 0
mpp = no
}
# Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_replicate
# Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
# Loaded module rlm_soh
# Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
soh {
dhcp = yes
}
# Loaded module rlm_files
# Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
files {
filename = "/usr/local/etc/raddb/mods-config/files/authorize"
acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
compat = "cistron"
}
reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
[/usr/local/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry username(a)harper-adams.ac.uk ...
[/usr/local/etc/raddb/mods-config/files/authorize]:184 Cistron compatibility checks for entry DEFAULT ...
[/usr/local/etc/raddb/mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ...
[/usr/local/etc/raddb/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ...
reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
# Loaded module rlm_passwd
# Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
passwd etc_passwd {
filename = "/etc/passwd"
format = "*User-Name:Crypt-Password:"
delimiter = ":"
ignore_nislike = no
ignore_empty = yes
allow_multiple_keys = no
hash_size = 100
}
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
# Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
detail {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-harper-adams.ac.uk} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
passchange {
}
allow_retry = yes
}
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
# Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loaded module rlm_expiration
# Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
# Loaded module rlm_unpack
# Instantiating module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
# Loaded module rlm_preprocess
# Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
# Loaded module rlm_radutmp
# Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/usr/local/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_attr_filter
# Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
# Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
# Loaded module rlm_unix
# Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
unix {
radwtmp = "/usr/local/var/log/radius/radwtmp"
}
# Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
radutmp sradutmp {
filename = "/usr/local/var/log/radius/sradutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 420
caller_id = no
}
# Loaded module rlm_digest
# Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
# Loaded module rlm_expr
# Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
expr {
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
}
# Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
shell_escape = yes
}
# Loaded module rlm_pap
# Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_utf8
# Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
# Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
linelog {
filename = "/usr/local/var/log/radius/linelog"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "This is a log message for %{User-Name}"
reference = "messages.%{%{Packet-Type}:-default}"
}
# Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
linelog log_accounting {
filename = "/usr/local/var/log/radius/linelog-accounting"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
}
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /usr/local/etc/raddb/radiusd.conf
} # server
server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
# Loading authenticate {...}
# Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
Ignoring "ldap" (see raddb/mods-available/README.rst)
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server inner-tunnel
server default { # from file /usr/local/etc/raddb/sites-enabled/default
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server default
server status { # from file /usr/local/etc/raddb/sites-enabled/status
# Loading authorize {...}
} # server status
server eduroam { # from file /usr/local/etc/raddb/sites-enabled/eduroam
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server eduroam
/usr/local/etc/raddb/sites-enabled/default[705] Please change %{Realm}} to &Realm}
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
listen {
type = "auth"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "auth"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "status"
ipaddr = 127.0.0.1
port = 18121
client admin {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
}
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on status address 127.0.0.1 port 18121 bound to server status
Opening new proxy socket 'proxy address * port 0'
Listening on proxy address * port 54558
Ready to process requests
(0) Received Access-Request Id 66 from 192.168.30.121:59063 to 192.168.10.211:1812 length 228
(0) User-Name = '00703070(a)harper-adams.ac.uk'
(0) NAS-IP-Address = 192.168.30.121
(0) NAS-Port = 0
(0) NAS-Identifier = '192.168.30.121'
(0) NAS-Port-Type = Wireless-802.11
(0) Calling-Station-Id = '96006F089222'
(0) Called-Station-Id = '001A1E01CF58'
(0) Service-Type = Framed-User
(0) Framed-MTU = 1100
(0) EAP-Message = 0x02010020013030373033303730406861727065722d6164616d732e61632e756b
(0) Aruba-Essid-Name = 'eduroam'
(0) Aruba-Location-Id = 'CETLfoyer_AP01'
(0) Aruba-AP-Group = 'apg-comp'
(0) Message-Authenticator = 0xeea556b9e161ae9c916574dcf448efa7
(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(0) authorize {
(0) policy eduroam_filter {
(0) if (User-Name !~ /@/) {
(0) if (User-Name !~ /@/) -> FALSE
(0) if ("%{User-Name}" =~ /@$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070(a)harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /@$/) -> FALSE
(0) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070(a)harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(0) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070(a)harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(0) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070(a)harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(0) } # policy eduroam_filter = notfound
(0) [preprocess] = ok
(0) policy operator-name.authorize {
(0) if ("%{client:Operator-Name}") {
(0) EXPAND %{client:Operator-Name}
(0) --> 1harper-adams.ac.uk
(0) if ("%{client:Operator-Name}") -> TRUE
(0) if ("%{client:Operator-Name}") {
(0) update request {
(0) EXPAND %{client:Operator-Name}
(0) --> 1harper-adams.ac.uk
(0) &Operator-Name = 1harper-adams.ac.uk
(0) } # update request = noop
(0) } # if ("%{client:Operator-Name}") = noop
(0) } # policy operator-name.authorize = noop
(0) policy cui.authorize {
(0) if ("%{client:add_cui}" == 'yes') {
(0) EXPAND %{client:add_cui}
(0) --> yes
(0) if ("%{client:add_cui}" == 'yes') -> TRUE
(0) if ("%{client:add_cui}" == 'yes') {
(0) update request {
(0) &Chargeable-User-Identity := 0x00
(0) } # update request = noop
(0) } # if ("%{client:add_cui}" == 'yes') = noop
(0) } # policy cui.authorize = noop
(0) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070(a)harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(0) else {
(0) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(0) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(0) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(0) auth_log: EXPAND %t
(0) auth_log: --> Mon Sep 7 19:55:28 2020
(0) [auth_log] = ok
(0) } # else = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(0) suffix: Found realm "harper-adams.ac.uk"
(0) suffix: Adding Stripped-User-Name = "00703070"
(0) suffix: Adding Realm = "harper-adams.ac.uk"
(0) suffix: Authentication realm is LOCAL
(0) [suffix] = ok
(0) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070(a)harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(0) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(0) [noop] = noop
(0) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(0) ... skipping elsif for request 0: Preceding "if" was taken
(0) ... skipping elsif for request 0: Preceding "if" was taken
(0) ... skipping elsif for request 0: Preceding "if" was taken
(0) ... skipping else for request 0: Preceding "if" was taken
(0) eap: Peer sent code Response (2) ID 1 length 32
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) authenticate {
(0) eap: Peer sent method Identity (1)
(0) eap: Calling eap_peap to process EAP data
(0) eap_peap: Flushing SSL sessions (of #0)
(0) eap_peap: Initiate
(0) eap_peap: Start returned 1
(0) eap: EAP session adding &reply:State = 0x5d232d885d2134dd
(0) [eap] = handled
(0) } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found. Ignoring.
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) Sent Access-Challenge Id 66 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(0) EAP-Message = 0x010200061920
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0x5d232d885d2134dd60443f4cd8d35175
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 36 from 192.168.30.121:59063 to 192.168.10.211:1812 length 365
(1) User-Name = '00703070(a)harper-adams.ac.uk'
(1) NAS-IP-Address = 192.168.30.121
(1) NAS-Port = 0
(1) NAS-Identifier = '192.168.30.121'
(1) NAS-Port-Type = Wireless-802.11
(1) Calling-Station-Id = '96006F089222'
(1) Called-Station-Id = '001A1E01CF58'
(1) Service-Type = Framed-User
(1) Framed-MTU = 1100
(1) EAP-Message = 0x0202009719800000008d16030100880100008403033d6bb98ca56f708bfefc5724df297400c611b45f02b6135a065b604a87f97e4d000028c02bc02fc02cc030cca9cca8c009c013c00ac014c007c011009c009d002f003c0035003d0005000a0100003300170000ff01000100000a00080006001d0017
(1) State = 0x5d232d885d2134dd60443f4cd8d35175
(1) Aruba-Essid-Name = 'eduroam'
(1) Aruba-Location-Id = 'CETLfoyer_AP01'
(1) Aruba-AP-Group = 'apg-comp'
(1) Message-Authenticator = 0x221852c8ef612ff7a655f72f18256d56
(1) session-state: No cached attributes
(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(1) authorize {
(1) policy eduroam_filter {
(1) if (User-Name !~ /@/) {
(1) if (User-Name !~ /@/) -> FALSE
(1) if ("%{User-Name}" =~ /@$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070(a)harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /@$/) -> FALSE
(1) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070(a)harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(1) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070(a)harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(1) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070(a)harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(1) } # policy eduroam_filter = notfound
(1) [preprocess] = ok
(1) policy operator-name.authorize {
(1) if ("%{client:Operator-Name}") {
(1) EXPAND %{client:Operator-Name}
(1) --> 1harper-adams.ac.uk
(1) if ("%{client:Operator-Name}") -> TRUE
(1) if ("%{client:Operator-Name}") {
(1) update request {
(1) EXPAND %{client:Operator-Name}
(1) --> 1harper-adams.ac.uk
(1) &Operator-Name = 1harper-adams.ac.uk
(1) } # update request = noop
(1) } # if ("%{client:Operator-Name}") = noop
(1) } # policy operator-name.authorize = noop
(1) policy cui.authorize {
(1) if ("%{client:add_cui}" == 'yes') {
(1) EXPAND %{client:add_cui}
(1) --> yes
(1) if ("%{client:add_cui}" == 'yes') -> TRUE
(1) if ("%{client:add_cui}" == 'yes') {
(1) update request {
(1) &Chargeable-User-Identity := 0x00
(1) } # update request = noop
(1) } # if ("%{client:add_cui}" == 'yes') = noop
(1) } # policy cui.authorize = noop
(1) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070(a)harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(1) else {
(1) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(1) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(1) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(1) auth_log: EXPAND %t
(1) auth_log: --> Mon Sep 7 19:55:28 2020
(1) [auth_log] = ok
(1) } # else = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(1) suffix: Found realm "harper-adams.ac.uk"
(1) suffix: Adding Stripped-User-Name = "00703070"
(1) suffix: Adding Realm = "harper-adams.ac.uk"
(1) suffix: Authentication realm is LOCAL
(1) [suffix] = ok
(1) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070(a)harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(1) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(1) [noop] = noop
(1) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(1) ... skipping elsif for request 1: Preceding "if" was taken
(1) ... skipping elsif for request 1: Preceding "if" was taken
(1) ... skipping elsif for request 1: Preceding "if" was taken
(1) ... skipping else for request 1: Preceding "if" was taken
(1) eap: Peer sent code Response (2) ID 2 length 151
(1) eap: Continuing tunnel setup
(1) [eap] = ok
(1) } # authorize = ok
(1) Found Auth-Type = EAP
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) authenticate {
(1) eap: Expiring EAP session with state 0x5d232d885d2134dd
(1) eap: Finished EAP session with state 0x5d232d885d2134dd
(1) eap: Previous EAP request found for state 0x5d232d885d2134dd, released from the list
(1) eap: Peer sent method PEAP (25)
(1) eap: EAP PEAP (25)
(1) eap: Calling eap_peap to process EAP data
(1) eap_peap: processing EAP-TLS
(1) eap_peap: TLS Length 141
(1) eap_peap: Length Included
(1) eap_peap: eaptls_verify returned 11
(1) eap_peap: (other): before/accept initialization
(1) eap_peap: TLS_accept: before/accept initialization
(1) eap_peap: <<< TLS 1.2 [length 0088]
(1) eap_peap: TLS_accept: SSLv3 read client hello A
(1) eap_peap: >>> TLS 1.2 [length 0059]
(1) eap_peap: TLS_accept: SSLv3 write server hello A
(1) eap_peap: >>> TLS 1.2 [length 098e]
(1) eap_peap: TLS_accept: SSLv3 write certificate A
(1) eap_peap: >>> TLS 1.2 [length 014d]
(1) eap_peap: TLS_accept: SSLv3 write key exchange A
(1) eap_peap: >>> TLS 1.2 [length 0004]
(1) eap_peap: TLS_accept: SSLv3 write server done A
(1) eap_peap: TLS_accept: SSLv3 flush data
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
(1) eap_peap: eaptls_process returned 13
(1) eap_peap: FR_TLS_HANDLED
(1) eap: EAP session adding &reply:State = 0x5d232d885c2034dd
(1) [eap] = handled
(1) } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found. Ignoring.
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) Sent Access-Challenge Id 36 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(1) EAP-Message = 0x010303ec19c000000b4c16030300590200005503035f5682202fb7a02869ff5572887e4559c92fea1887530f7a4ce236db46270e3e205c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08cc02f00000dff01000100000b000403000102160303098e0b00098a000987000430
(1) Message-Authenticator = 0x00000000000000000000000000000000
(1) State = 0x5d232d885c2034dd60443f4cd8d35175
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 101 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(2) User-Name = '00703070(a)harper-adams.ac.uk'
(2) NAS-IP-Address = 192.168.30.121
(2) NAS-Port = 0
(2) NAS-Identifier = '192.168.30.121'
(2) NAS-Port-Type = Wireless-802.11
(2) Calling-Station-Id = '96006F089222'
(2) Called-Station-Id = '001A1E01CF58'
(2) Service-Type = Framed-User
(2) Framed-MTU = 1100
(2) EAP-Message = 0x020300061900
(2) State = 0x5d232d885c2034dd60443f4cd8d35175
(2) Aruba-Essid-Name = 'eduroam'
(2) Aruba-Location-Id = 'CETLfoyer_AP01'
(2) Aruba-AP-Group = 'apg-comp'
(2) Message-Authenticator = 0x4a33f9c19d7d272caf3b88dd8235def4
(2) session-state: No cached attributes
(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(2) authorize {
(2) policy eduroam_filter {
(2) if (User-Name !~ /@/) {
(2) if (User-Name !~ /@/) -> FALSE
(2) if ("%{User-Name}" =~ /@$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070(a)harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /@$/) -> FALSE
(2) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070(a)harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(2) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070(a)harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(2) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070(a)harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(2) } # policy eduroam_filter = notfound
(2) [preprocess] = ok
(2) policy operator-name.authorize {
(2) if ("%{client:Operator-Name}") {
(2) EXPAND %{client:Operator-Name}
(2) --> 1harper-adams.ac.uk
(2) if ("%{client:Operator-Name}") -> TRUE
(2) if ("%{client:Operator-Name}") {
(2) update request {
(2) EXPAND %{client:Operator-Name}
(2) --> 1harper-adams.ac.uk
(2) &Operator-Name = 1harper-adams.ac.uk
(2) } # update request = noop
(2) } # if ("%{client:Operator-Name}") = noop
(2) } # policy operator-name.authorize = noop
(2) policy cui.authorize {
(2) if ("%{client:add_cui}" == 'yes') {
(2) EXPAND %{client:add_cui}
(2) --> yes
(2) if ("%{client:add_cui}" == 'yes') -> TRUE
(2) if ("%{client:add_cui}" == 'yes') {
(2) update request {
(2) &Chargeable-User-Identity := 0x00
(2) } # update request = noop
(2) } # if ("%{client:add_cui}" == 'yes') = noop
(2) } # policy cui.authorize = noop
(2) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070(a)harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(2) else {
(2) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(2) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(2) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(2) auth_log: EXPAND %t
(2) auth_log: --> Mon Sep 7 19:55:28 2020
(2) [auth_log] = ok
(2) } # else = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(2) suffix: Found realm "harper-adams.ac.uk"
(2) suffix: Adding Stripped-User-Name = "00703070"
(2) suffix: Adding Realm = "harper-adams.ac.uk"
(2) suffix: Authentication realm is LOCAL
(2) [suffix] = ok
(2) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070(a)harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(2) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(2) [noop] = noop
(2) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(2) ... skipping elsif for request 2: Preceding "if" was taken
(2) ... skipping elsif for request 2: Preceding "if" was taken
(2) ... skipping elsif for request 2: Preceding "if" was taken
(2) ... skipping else for request 2: Preceding "if" was taken
(2) eap: Peer sent code Response (2) ID 3 length 6
(2) eap: Continuing tunnel setup
(2) [eap] = ok
(2) } # authorize = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) authenticate {
(2) eap: Expiring EAP session with state 0x5d232d885c2034dd
(2) eap: Finished EAP session with state 0x5d232d885c2034dd
(2) eap: Previous EAP request found for state 0x5d232d885c2034dd, released from the list
(2) eap: Peer sent method PEAP (25)
(2) eap: EAP PEAP (25)
(2) eap: Calling eap_peap to process EAP data
(2) eap_peap: processing EAP-TLS
(2) eap_peap: Received TLS ACK
(2) eap_peap: Received TLS ACK
(2) eap_peap: ACK handshake fragment handler
(2) eap_peap: eaptls_verify returned 1
(2) eap_peap: eaptls_process returned 13
(2) eap_peap: FR_TLS_HANDLED
(2) eap: EAP session adding &reply:State = 0x5d232d885f2734dd
(2) [eap] = handled
(2) } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) Post-Auth-Type sub-section not found. Ignoring.
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) Sent Access-Challenge Id 101 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(2) EAP-Message = 0x010403e81940c62d385a960250f6b378ff612d4e0358d9e5148a4625e6eb2f327082ccac93595352448e797948d8e21b0e9ce3a327425387a40fd951a553641188a18a0043138afb9919c64efc9d62007450b116f5a314ea1febd84785af8dd231b48cbd10608dfaf8ba002ab346f2a6298790750a64a3
(2) Message-Authenticator = 0x00000000000000000000000000000000
(2) State = 0x5d232d885f2734dd60443f4cd8d35175
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 246 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(3) User-Name = '00703070(a)harper-adams.ac.uk'
(3) NAS-IP-Address = 192.168.30.121
(3) NAS-Port = 0
(3) NAS-Identifier = '192.168.30.121'
(3) NAS-Port-Type = Wireless-802.11
(3) Calling-Station-Id = '96006F089222'
(3) Called-Station-Id = '001A1E01CF58'
(3) Service-Type = Framed-User
(3) Framed-MTU = 1100
(3) EAP-Message = 0x020400061900
(3) State = 0x5d232d885f2734dd60443f4cd8d35175
(3) Aruba-Essid-Name = 'eduroam'
(3) Aruba-Location-Id = 'CETLfoyer_AP01'
(3) Aruba-AP-Group = 'apg-comp'
(3) Message-Authenticator = 0xf2cc65af35bb01ad9e3dad5a7462c71d
(3) session-state: No cached attributes
(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(3) authorize {
(3) policy eduroam_filter {
(3) if (User-Name !~ /@/) {
(3) if (User-Name !~ /@/) -> FALSE
(3) if ("%{User-Name}" =~ /@$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070(a)harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /@$/) -> FALSE
(3) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070(a)harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(3) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070(a)harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(3) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070(a)harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(3) } # policy eduroam_filter = notfound
(3) [preprocess] = ok
(3) policy operator-name.authorize {
(3) if ("%{client:Operator-Name}") {
(3) EXPAND %{client:Operator-Name}
(3) --> 1harper-adams.ac.uk
(3) if ("%{client:Operator-Name}") -> TRUE
(3) if ("%{client:Operator-Name}") {
(3) update request {
(3) EXPAND %{client:Operator-Name}
(3) --> 1harper-adams.ac.uk
(3) &Operator-Name = 1harper-adams.ac.uk
(3) } # update request = noop
(3) } # if ("%{client:Operator-Name}") = noop
(3) } # policy operator-name.authorize = noop
(3) policy cui.authorize {
(3) if ("%{client:add_cui}" == 'yes') {
(3) EXPAND %{client:add_cui}
(3) --> yes
(3) if ("%{client:add_cui}" == 'yes') -> TRUE
(3) if ("%{client:add_cui}" == 'yes') {
(3) update request {
(3) &Chargeable-User-Identity := 0x00
(3) } # update request = noop
(3) } # if ("%{client:add_cui}" == 'yes') = noop
(3) } # policy cui.authorize = noop
(3) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070(a)harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(3) else {
(3) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(3) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(3) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(3) auth_log: EXPAND %t
(3) auth_log: --> Mon Sep 7 19:55:28 2020
(3) [auth_log] = ok
(3) } # else = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(3) suffix: Found realm "harper-adams.ac.uk"
(3) suffix: Adding Stripped-User-Name = "00703070"
(3) suffix: Adding Realm = "harper-adams.ac.uk"
(3) suffix: Authentication realm is LOCAL
(3) [suffix] = ok
(3) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070(a)harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(3) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(3) [noop] = noop
(3) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(3) ... skipping elsif for request 3: Preceding "if" was taken
(3) ... skipping elsif for request 3: Preceding "if" was taken
(3) ... skipping elsif for request 3: Preceding "if" was taken
(3) ... skipping else for request 3: Preceding "if" was taken
(3) eap: Peer sent code Response (2) ID 4 length 6
(3) eap: Continuing tunnel setup
(3) [eap] = ok
(3) } # authorize = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) authenticate {
(3) eap: Expiring EAP session with state 0x5d232d885f2734dd
(3) eap: Finished EAP session with state 0x5d232d885f2734dd
(3) eap: Previous EAP request found for state 0x5d232d885f2734dd, released from the list
(3) eap: Peer sent method PEAP (25)
(3) eap: EAP PEAP (25)
(3) eap: Calling eap_peap to process EAP data
(3) eap_peap: processing EAP-TLS
(3) eap_peap: Received TLS ACK
(3) eap_peap: Received TLS ACK
(3) eap_peap: ACK handshake fragment handler
(3) eap_peap: eaptls_verify returned 1
(3) eap_peap: eaptls_process returned 13
(3) eap_peap: FR_TLS_HANDLED
(3) eap: EAP session adding &reply:State = 0x5d232d885e2634dd
(3) [eap] = handled
(3) } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) Post-Auth-Type sub-section not found. Ignoring.
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) Sent Access-Challenge Id 246 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(3) EAP-Message = 0x0105038e1900f6e330ad8b0cf435a181bda481ba3081b7310b3009060355040613024742311330110603550408130a5368726f7073686972653110300e060355040713074e6577706f72743120301e060355040a1317486172706572204164616d7320556e69766572736974793130302e06092a864886
(3) Message-Authenticator = 0x00000000000000000000000000000000
(3) State = 0x5d232d885e2634dd60443f4cd8d35175
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 93 from 192.168.30.121:59063 to 192.168.10.211:1812 length 350
(4) User-Name = '00703070(a)harper-adams.ac.uk'
(4) NAS-IP-Address = 192.168.30.121
(4) NAS-Port = 0
(4) NAS-Identifier = '192.168.30.121'
(4) NAS-Port-Type = Wireless-802.11
(4) Calling-Station-Id = '96006F089222'
(4) Called-Station-Id = '001A1E01CF58'
(4) Service-Type = Framed-User
(4) Framed-MTU = 1100
(4) EAP-Message = 0x0205008819800000007e1603030046100000424104ea56d436078e56e2ae2b44a72fce084ff89022001433c236008ea69f4edb350f1ca370aa1f2747dde6eca44f4c0da3dc9a19cacbdb7a2dd9dd517c8db718015114030300010116030300280000000000000000710ce2eedf52a18519e02d3291cf76
(4) State = 0x5d232d885e2634dd60443f4cd8d35175
(4) Aruba-Essid-Name = 'eduroam'
(4) Aruba-Location-Id = 'CETLfoyer_AP01'
(4) Aruba-AP-Group = 'apg-comp'
(4) Message-Authenticator = 0x3910c0df262016725b161488467b1bde
(4) session-state: No cached attributes
(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(4) authorize {
(4) policy eduroam_filter {
(4) if (User-Name !~ /@/) {
(4) if (User-Name !~ /@/) -> FALSE
(4) if ("%{User-Name}" =~ /@$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070(a)harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /@$/) -> FALSE
(4) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070(a)harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(4) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070(a)harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(4) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070(a)harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(4) } # policy eduroam_filter = notfound
(4) [preprocess] = ok
(4) policy operator-name.authorize {
(4) if ("%{client:Operator-Name}") {
(4) EXPAND %{client:Operator-Name}
(4) --> 1harper-adams.ac.uk
(4) if ("%{client:Operator-Name}") -> TRUE
(4) if ("%{client:Operator-Name}") {
(4) update request {
(4) EXPAND %{client:Operator-Name}
(4) --> 1harper-adams.ac.uk
(4) &Operator-Name = 1harper-adams.ac.uk
(4) } # update request = noop
(4) } # if ("%{client:Operator-Name}") = noop
(4) } # policy operator-name.authorize = noop
(4) policy cui.authorize {
(4) if ("%{client:add_cui}" == 'yes') {
(4) EXPAND %{client:add_cui}
(4) --> yes
(4) if ("%{client:add_cui}" == 'yes') -> TRUE
(4) if ("%{client:add_cui}" == 'yes') {
(4) update request {
(4) &Chargeable-User-Identity := 0x00
(4) } # update request = noop
(4) } # if ("%{client:add_cui}" == 'yes') = noop
(4) } # policy cui.authorize = noop
(4) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070(a)harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(4) else {
(4) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(4) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(4) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(4) auth_log: EXPAND %t
(4) auth_log: --> Mon Sep 7 19:55:28 2020
(4) [auth_log] = ok
(4) } # else = ok
(4) [chap] = noop
(4) [mschap] = noop
(4) [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(4) suffix: Found realm "harper-adams.ac.uk"
(4) suffix: Adding Stripped-User-Name = "00703070"
(4) suffix: Adding Realm = "harper-adams.ac.uk"
(4) suffix: Authentication realm is LOCAL
(4) [suffix] = ok
(4) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070(a)harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(4) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(4) [noop] = noop
(4) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(4) ... skipping elsif for request 4: Preceding "if" was taken
(4) ... skipping elsif for request 4: Preceding "if" was taken
(4) ... skipping elsif for request 4: Preceding "if" was taken
(4) ... skipping else for request 4: Preceding "if" was taken
(4) eap: Peer sent code Response (2) ID 5 length 136
(4) eap: Continuing tunnel setup
(4) [eap] = ok
(4) } # authorize = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) authenticate {
(4) eap: Expiring EAP session with state 0x5d232d885e2634dd
(4) eap: Finished EAP session with state 0x5d232d885e2634dd
(4) eap: Previous EAP request found for state 0x5d232d885e2634dd, released from the list
(4) eap: Peer sent method PEAP (25)
(4) eap: EAP PEAP (25)
(4) eap: Calling eap_peap to process EAP data
(4) eap_peap: processing EAP-TLS
(4) eap_peap: TLS Length 126
(4) eap_peap: Length Included
(4) eap_peap: eaptls_verify returned 11
(4) eap_peap: <<< TLS 1.2 [length 0046]
(4) eap_peap: TLS_accept: SSLv3 read client key exchange A
(4) eap_peap: <<< TLS 1.2 [length 0001]
(4) eap_peap: <<< TLS 1.2 [length 0010]
(4) eap_peap: TLS_accept: SSLv3 read finished A
(4) eap_peap: >>> TLS 1.2 [length 0001]
(4) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(4) eap_peap: >>> TLS 1.2 [length 0010]
(4) eap_peap: TLS_accept: SSLv3 write finished A
(4) eap_peap: TLS_accept: SSLv3 flush data
TLS: adding session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c to cache
(4) eap_peap: (other): SSL negotiation finished successfully
SSL Connection Established
(4) eap_peap: eaptls_process returned 13
(4) eap_peap: FR_TLS_HANDLED
(4) eap: EAP session adding &reply:State = 0x5d232d88592534dd
(4) [eap] = handled
(4) } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) Post-Auth-Type sub-section not found. Ignoring.
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) Sent Access-Challenge Id 93 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(4) EAP-Message = 0x0106003919001403030001011603030028dbf9a5fe6b58c9af4878bf5aad50c37591306f56a34e452abe46d4816656f7c59a7d672a722fba90
(4) Message-Authenticator = 0x00000000000000000000000000000000
(4) State = 0x5d232d88592534dd60443f4cd8d35175
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 254 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(5) User-Name = '00703070(a)harper-adams.ac.uk'
(5) NAS-IP-Address = 192.168.30.121
(5) NAS-Port = 0
(5) NAS-Identifier = '192.168.30.121'
(5) NAS-Port-Type = Wireless-802.11
(5) Calling-Station-Id = '96006F089222'
(5) Called-Station-Id = '001A1E01CF58'
(5) Service-Type = Framed-User
(5) Framed-MTU = 1100
(5) EAP-Message = 0x020600061900
(5) State = 0x5d232d88592534dd60443f4cd8d35175
(5) Aruba-Essid-Name = 'eduroam'
(5) Aruba-Location-Id = 'CETLfoyer_AP01'
(5) Aruba-AP-Group = 'apg-comp'
(5) Message-Authenticator = 0xc6d5fb9e7db34af2acf0e6c12d84368a
(5) session-state: No cached attributes
(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(5) authorize {
(5) policy eduroam_filter {
(5) if (User-Name !~ /@/) {
(5) if (User-Name !~ /@/) -> FALSE
(5) if ("%{User-Name}" =~ /@$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070(a)harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /@$/) -> FALSE
(5) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070(a)harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(5) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070(a)harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(5) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070(a)harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(5) } # policy eduroam_filter = notfound
(5) [preprocess] = ok
(5) policy operator-name.authorize {
(5) if ("%{client:Operator-Name}") {
(5) EXPAND %{client:Operator-Name}
(5) --> 1harper-adams.ac.uk
(5) if ("%{client:Operator-Name}") -> TRUE
(5) if ("%{client:Operator-Name}") {
(5) update request {
(5) EXPAND %{client:Operator-Name}
(5) --> 1harper-adams.ac.uk
(5) &Operator-Name = 1harper-adams.ac.uk
(5) } # update request = noop
(5) } # if ("%{client:Operator-Name}") = noop
(5) } # policy operator-name.authorize = noop
(5) policy cui.authorize {
(5) if ("%{client:add_cui}" == 'yes') {
(5) EXPAND %{client:add_cui}
(5) --> yes
(5) if ("%{client:add_cui}" == 'yes') -> TRUE
(5) if ("%{client:add_cui}" == 'yes') {
(5) update request {
(5) &Chargeable-User-Identity := 0x00
(5) } # update request = noop
(5) } # if ("%{client:add_cui}" == 'yes') = noop
(5) } # policy cui.authorize = noop
(5) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070(a)harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(5) else {
(5) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(5) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(5) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(5) auth_log: EXPAND %t
(5) auth_log: --> Mon Sep 7 19:55:28 2020
(5) [auth_log] = ok
(5) } # else = ok
(5) [chap] = noop
(5) [mschap] = noop
(5) [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(5) suffix: Found realm "harper-adams.ac.uk"
(5) suffix: Adding Stripped-User-Name = "00703070"
(5) suffix: Adding Realm = "harper-adams.ac.uk"
(5) suffix: Authentication realm is LOCAL
(5) [suffix] = ok
(5) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070(a)harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(5) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(5) [noop] = noop
(5) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(5) ... skipping elsif for request 5: Preceding "if" was taken
(5) ... skipping elsif for request 5: Preceding "if" was taken
(5) ... skipping elsif for request 5: Preceding "if" was taken
(5) ... skipping else for request 5: Preceding "if" was taken
(5) eap: Peer sent code Response (2) ID 6 length 6
(5) eap: Continuing tunnel setup
(5) [eap] = ok
(5) } # authorize = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) authenticate {
(5) eap: Expiring EAP session with state 0x5d232d88592534dd
(5) eap: Finished EAP session with state 0x5d232d88592534dd
(5) eap: Previous EAP request found for state 0x5d232d88592534dd, released from the list
(5) eap: Peer sent method PEAP (25)
(5) eap: EAP PEAP (25)
(5) eap: Calling eap_peap to process EAP data
(5) eap_peap: processing EAP-TLS
(5) eap_peap: Received TLS ACK
(5) eap_peap: Received TLS ACK
(5) eap_peap: ACK handshake is finished
(5) eap_peap: eaptls_verify returned 3
(5) eap_peap: eaptls_process returned 3
(5) eap_peap: FR_TLS_SUCCESS
(5) eap_peap: Session established. Decoding tunneled attributes
(5) eap_peap: PEAP state TUNNEL ESTABLISHED
(5) eap: EAP session adding &reply:State = 0x5d232d88582434dd
(5) [eap] = handled
(5) } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found. Ignoring.
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) Sent Access-Challenge Id 254 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(5) EAP-Message = 0x010700281900170303001ddbf9a5fe6b58c9b06dc36a69e0eb76f60129709c828fc278149f06d1b9
(5) Message-Authenticator = 0x00000000000000000000000000000000
(5) State = 0x5d232d88582434dd60443f4cd8d35175
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 236 from 192.168.30.121:59063 to 192.168.10.211:1812 length 277
(6) User-Name = '00703070(a)harper-adams.ac.uk'
(6) NAS-IP-Address = 192.168.30.121
(6) NAS-Port = 0
(6) NAS-Identifier = '192.168.30.121'
(6) NAS-Port-Type = Wireless-802.11
(6) Calling-Station-Id = '96006F089222'
(6) Called-Station-Id = '001A1E01CF58'
(6) Service-Type = Framed-User
(6) Framed-MTU = 1100
(6) EAP-Message = 0x0207003f190017030300340000000000000001f7d1c2bc51c0f6614a1bc2831a5e10b3a0532248f7cde8cd0675872eafaf1768f108ad5c3b6a73038f8c63bf
(6) State = 0x5d232d88582434dd60443f4cd8d35175
(6) Aruba-Essid-Name = 'eduroam'
(6) Aruba-Location-Id = 'CETLfoyer_AP01'
(6) Aruba-AP-Group = 'apg-comp'
(6) Message-Authenticator = 0x8a17b53039a0230e8b09c960ea038aea
(6) session-state: No cached attributes
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(6) authorize {
(6) policy eduroam_filter {
(6) if (User-Name !~ /@/) {
(6) if (User-Name !~ /@/) -> FALSE
(6) if ("%{User-Name}" =~ /@$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070(a)harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /@$/) -> FALSE
(6) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070(a)harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(6) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070(a)harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(6) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070(a)harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(6) } # policy eduroam_filter = notfound
(6) [preprocess] = ok
(6) policy operator-name.authorize {
(6) if ("%{client:Operator-Name}") {
(6) EXPAND %{client:Operator-Name}
(6) --> 1harper-adams.ac.uk
(6) if ("%{client:Operator-Name}") -> TRUE
(6) if ("%{client:Operator-Name}") {
(6) update request {
(6) EXPAND %{client:Operator-Name}
(6) --> 1harper-adams.ac.uk
(6) &Operator-Name = 1harper-adams.ac.uk
(6) } # update request = noop
(6) } # if ("%{client:Operator-Name}") = noop
(6) } # policy operator-name.authorize = noop
(6) policy cui.authorize {
(6) if ("%{client:add_cui}" == 'yes') {
(6) EXPAND %{client:add_cui}
(6) --> yes
(6) if ("%{client:add_cui}" == 'yes') -> TRUE
(6) if ("%{client:add_cui}" == 'yes') {
(6) update request {
(6) &Chargeable-User-Identity := 0x00
(6) } # update request = noop
(6) } # if ("%{client:add_cui}" == 'yes') = noop
(6) } # policy cui.authorize = noop
(6) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070(a)harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(6) else {
(6) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(6) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(6) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(6) auth_log: EXPAND %t
(6) auth_log: --> Mon Sep 7 19:55:28 2020
(6) [auth_log] = ok
(6) } # else = ok
(6) [chap] = noop
(6) [mschap] = noop
(6) [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(6) suffix: Found realm "harper-adams.ac.uk"
(6) suffix: Adding Stripped-User-Name = "00703070"
(6) suffix: Adding Realm = "harper-adams.ac.uk"
(6) suffix: Authentication realm is LOCAL
(6) [suffix] = ok
(6) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070(a)harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(6) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(6) [noop] = noop
(6) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(6) ... skipping elsif for request 6: Preceding "if" was taken
(6) ... skipping elsif for request 6: Preceding "if" was taken
(6) ... skipping elsif for request 6: Preceding "if" was taken
(6) ... skipping else for request 6: Preceding "if" was taken
(6) eap: Peer sent code Response (2) ID 7 length 63
(6) eap: Continuing tunnel setup
(6) [eap] = ok
(6) } # authorize = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) authenticate {
(6) eap: Expiring EAP session with state 0x5d232d88582434dd
(6) eap: Finished EAP session with state 0x5d232d88582434dd
(6) eap: Previous EAP request found for state 0x5d232d88582434dd, released from the list
(6) eap: Peer sent method PEAP (25)
(6) eap: EAP PEAP (25)
(6) eap: Calling eap_peap to process EAP data
(6) eap_peap: processing EAP-TLS
(6) eap_peap: eaptls_verify returned 7
(6) eap_peap: Done initial handshake
(6) eap_peap: eaptls_process returned 7
(6) eap_peap: FR_TLS_OK
(6) eap_peap: Session established. Decoding tunneled attributes
(6) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(6) eap_peap: Identity - 00703070(a)harper-adams.ac.uk
(6) eap_peap: Got inner identity '00703070(a)harper-adams.ac.uk'
(6) eap_peap: Setting default EAP type for tunneled EAP session
(6) eap_peap: Got tunneled request
(6) eap_peap: EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) eap_peap: Setting User-Name to 00703070(a)harper-adams.ac.uk
(6) eap_peap: Sending tunneled request to inner-tunnel
(6) eap_peap: EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(6) eap_peap: User-Name = '00703070(a)harper-adams.ac.uk'
(6) eap_peap: NAS-IP-Address = 192.168.30.121
(6) eap_peap: NAS-Port = 0
(6) eap_peap: NAS-Identifier = '192.168.30.121'
(6) eap_peap: NAS-Port-Type = Wireless-802.11
(6) eap_peap: Calling-Station-Id = '96006F089222'
(6) eap_peap: Called-Station-Id = '001A1E01CF58'
(6) eap_peap: Service-Type = Framed-User
(6) eap_peap: Framed-MTU = 1100
(6) eap_peap: Aruba-Essid-Name = 'eduroam'
(6) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01'
(6) eap_peap: Aruba-AP-Group = 'apg-comp'
(6) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(6) eap_peap: Operator-Name = '1harper-adams.ac.uk'
(6) eap_peap: Chargeable-User-Identity := 0x00
(6) Virtual server inner-tunnel received request
(6) EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) FreeRADIUS-Proxied-To = 127.0.0.1
(6) User-Name = '00703070(a)harper-adams.ac.uk'
(6) NAS-IP-Address = 192.168.30.121
(6) NAS-Port = 0
(6) NAS-Identifier = '192.168.30.121'
(6) NAS-Port-Type = Wireless-802.11
(6) Calling-Station-Id = '96006F089222'
(6) Called-Station-Id = '001A1E01CF58'
(6) Service-Type = Framed-User
(6) Framed-MTU = 1100
(6) Aruba-Essid-Name = 'eduroam'
(6) Aruba-Location-Id = 'CETLfoyer_AP01'
(6) Aruba-AP-Group = 'apg-comp'
(6) Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(6) Operator-Name = '1harper-adams.ac.uk'
(6) Chargeable-User-Identity := 0x00
(6) server inner-tunnel {
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(6) authorize {
(6) [chap] = noop
(6) [mschap] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(6) suffix: Found realm "harper-adams.ac.uk"
(6) suffix: Adding Stripped-User-Name = "00703070"
(6) suffix: Adding Realm = "harper-adams.ac.uk"
(6) suffix: Authentication realm is LOCAL
(6) [suffix] = ok
(6) update control {
(6) &Proxy-To-Realm := LOCAL
(6) } # update control = noop
(6) eap: Peer sent code Response (2) ID 7 length 32
(6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(6) [eap] = ok
(6) } # authorize = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(6) authenticate {
(6) eap: Peer sent method Identity (1)
(6) eap: Calling eap_mschapv2 to process EAP data
(6) eap_mschapv2: Issuing Challenge
(6) eap: EAP session adding &reply:State = 0xcef5e17acefdfb91
(6) [eap] = handled
(6) } # authenticate = handled
(6) } # server inner-tunnel
(6) Virtual server sending reply
(6) EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) Message-Authenticator = 0x00000000000000000000000000000000
(6) State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled reply code 11
(6) eap_peap: EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled reply RADIUS code 11
(6) eap_peap: EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled Access-Challenge
(6) eap: EAP session adding &reply:State = 0x5d232d885b2b34dd
(6) [eap] = handled
(6) } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) Post-Auth-Type sub-section not found. Ignoring.
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) Sent Access-Challenge Id 236 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(6) EAP-Message = 0x010800491900170303003edbf9a5fe6b58c9b1f544c668c8ce20a13bbdddec520dff4b916704c39eb5cd65054c4d14c94d5a4c2febf9467b7a0fb1cb9210743e34f5fc43aa84eb3dbd
(6) Message-Authenticator = 0x00000000000000000000000000000000
(6) State = 0x5d232d885b2b34dd60443f4cd8d35175
(6) Finished request
Waking up in 4.9 seconds.
(7) Received Access-Request Id 109 from 192.168.30.121:59063 to 192.168.10.211:1812 length 251
(7) User-Name = '00703070(a)harper-adams.ac.uk'
(7) NAS-IP-Address = 192.168.30.121
(7) NAS-Port = 0
(7) NAS-Identifier = '192.168.30.121'
(7) NAS-Port-Type = Wireless-802.11
(7) Calling-Station-Id = '96006F089222'
(7) Called-Station-Id = '001A1E01CF58'
(7) Service-Type = Framed-User
(7) Framed-MTU = 1100
(7) EAP-Message = 0x020800251900170303001a00000000000000025abd5dd6bbbaa0d2d85ec8fd3fc775e655b6
(7) State = 0x5d232d885b2b34dd60443f4cd8d35175
(7) Aruba-Essid-Name = 'eduroam'
(7) Aruba-Location-Id = 'CETLfoyer_AP01'
(7) Aruba-AP-Group = 'apg-comp'
(7) Message-Authenticator = 0xaf7a8dee6f40dcbd4932d108769f58b3
(7) session-state: No cached attributes
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(7) authorize {
(7) policy eduroam_filter {
(7) if (User-Name !~ /@/) {
(7) if (User-Name !~ /@/) -> FALSE
(7) if ("%{User-Name}" =~ /@$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070(a)harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /@$/) -> FALSE
(7) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070(a)harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(7) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070(a)harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(7) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070(a)harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(7) } # policy eduroam_filter = notfound
(7) [preprocess] = ok
(7) policy operator-name.authorize {
(7) if ("%{client:Operator-Name}") {
(7) EXPAND %{client:Operator-Name}
(7) --> 1harper-adams.ac.uk
(7) if ("%{client:Operator-Name}") -> TRUE
(7) if ("%{client:Operator-Name}") {
(7) update request {
(7) EXPAND %{client:Operator-Name}
(7) --> 1harper-adams.ac.uk
(7) &Operator-Name = 1harper-adams.ac.uk
(7) } # update request = noop
(7) } # if ("%{client:Operator-Name}") = noop
(7) } # policy operator-name.authorize = noop
(7) policy cui.authorize {
(7) if ("%{client:add_cui}" == 'yes') {
(7) EXPAND %{client:add_cui}
(7) --> yes
(7) if ("%{client:add_cui}" == 'yes') -> TRUE
(7) if ("%{client:add_cui}" == 'yes') {
(7) update request {
(7) &Chargeable-User-Identity := 0x00
(7) } # update request = noop
(7) } # if ("%{client:add_cui}" == 'yes') = noop
(7) } # policy cui.authorize = noop
(7) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070(a)harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(7) else {
(7) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(7) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(7) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(7) auth_log: EXPAND %t
(7) auth_log: --> Mon Sep 7 19:55:28 2020
(7) [auth_log] = ok
(7) } # else = ok
(7) [chap] = noop
(7) [mschap] = noop
(7) [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(7) suffix: Found realm "harper-adams.ac.uk"
(7) suffix: Adding Stripped-User-Name = "00703070"
(7) suffix: Adding Realm = "harper-adams.ac.uk"
(7) suffix: Authentication realm is LOCAL
(7) [suffix] = ok
(7) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070(a)harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(7) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(7) [noop] = noop
(7) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(7) ... skipping elsif for request 7: Preceding "if" was taken
(7) ... skipping elsif for request 7: Preceding "if" was taken
(7) ... skipping elsif for request 7: Preceding "if" was taken
(7) ... skipping else for request 7: Preceding "if" was taken
(7) eap: Peer sent code Response (2) ID 8 length 37
(7) eap: Continuing tunnel setup
(7) [eap] = ok
(7) } # authorize = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) authenticate {
(7) eap: Expiring EAP session with state 0xcef5e17acefdfb91
(7) eap: Finished EAP session with state 0x5d232d885b2b34dd
(7) eap: Previous EAP request found for state 0x5d232d885b2b34dd, released from the list
(7) eap: Peer sent method PEAP (25)
(7) eap: EAP PEAP (25)
(7) eap: Calling eap_peap to process EAP data
(7) eap_peap: processing EAP-TLS
(7) eap_peap: eaptls_verify returned 7
(7) eap_peap: Done initial handshake
(7) eap_peap: eaptls_process returned 7
(7) eap_peap: FR_TLS_OK
(7) eap_peap: Session established. Decoding tunneled attributes
(7) eap_peap: PEAP state phase2
(7) eap_peap: EAP type NAK (3)
(7) eap_peap: Got tunneled request
(7) eap_peap: EAP-Message = 0x020800060306
(7) eap_peap: Setting User-Name to 00703070(a)harper-adams.ac.uk
(7) eap_peap: Sending tunneled request to inner-tunnel
(7) eap_peap: EAP-Message = 0x020800060306
(7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(7) eap_peap: User-Name = '00703070(a)harper-adams.ac.uk'
(7) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d
(7) eap_peap: NAS-IP-Address = 192.168.30.121
(7) eap_peap: NAS-Port = 0
(7) eap_peap: NAS-Identifier = '192.168.30.121'
(7) eap_peap: NAS-Port-Type = Wireless-802.11
(7) eap_peap: Calling-Station-Id = '96006F089222'
(7) eap_peap: Called-Station-Id = '001A1E01CF58'
(7) eap_peap: Service-Type = Framed-User
(7) eap_peap: Framed-MTU = 1100
(7) eap_peap: Aruba-Essid-Name = 'eduroam'
(7) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01'
(7) eap_peap: Aruba-AP-Group = 'apg-comp'
(7) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(7) eap_peap: Operator-Name = '1harper-adams.ac.uk'
(7) eap_peap: Chargeable-User-Identity := 0x00
(7) Virtual server inner-tunnel received request
(7) EAP-Message = 0x020800060306
(7) FreeRADIUS-Proxied-To = 127.0.0.1
(7) User-Name = '00703070(a)harper-adams.ac.uk'
(7) State = 0xcef5e17acefdfb9195ed82a9e621722d
(7) NAS-IP-Address = 192.168.30.121
(7) NAS-Port = 0
(7) NAS-Identifier = '192.168.30.121'
(7) NAS-Port-Type = Wireless-802.11
(7) Calling-Station-Id = '96006F089222'
(7) Called-Station-Id = '001A1E01CF58'
(7) Service-Type = Framed-User
(7) Framed-MTU = 1100
(7) Aruba-Essid-Name = 'eduroam'
(7) Aruba-Location-Id = 'CETLfoyer_AP01'
(7) Aruba-AP-Group = 'apg-comp'
(7) Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(7) Operator-Name = '1harper-adams.ac.uk'
(7) Chargeable-User-Identity := 0x00
(7) server inner-tunnel {
(7) session-state: No cached attributes
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) authorize {
(7) [chap] = noop
(7) [mschap] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(7) suffix: Found realm "harper-adams.ac.uk"
(7) suffix: Adding Stripped-User-Name = "00703070"
(7) suffix: Adding Realm = "harper-adams.ac.uk"
(7) suffix: Authentication realm is LOCAL
(7) [suffix] = ok
(7) update control {
(7) &Proxy-To-Realm := LOCAL
(7) } # update control = noop
(7) eap: Peer sent code Response (2) ID 8 length 6
(7) eap: No EAP Start, assuming it's an on-going EAP conversation
(7) [eap] = updated
(7) [files] = noop
(7) [expiration] = noop
(7) [logintime] = noop
(7) [pap] = noop
(7) } # authorize = updated
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) authenticate {
(7) eap: Expiring EAP session with state 0xcef5e17acefdfb91
(7) eap: Finished EAP session with state 0xcef5e17acefdfb91
(7) eap: Previous EAP request found for state 0xcef5e17acefdfb91, released from the list
(7) eap: Peer sent method NAK (3)
(7) eap: Found mutually acceptable type GTC (6)
(7) eap: Calling eap_gtc to process EAP data
(7) eap_gtc: EXPAND Password:
(7) eap_gtc: --> Password:
(7) eap: EAP session adding &reply:State = 0xcef5e17acffce791
(7) [eap] = handled
(7) } # authenticate = handled
(7) } # server inner-tunnel
(7) Virtual server sending reply
(7) EAP-Message = 0x0109000f0650617373776f72643a20
(7) Message-Authenticator = 0x00000000000000000000000000000000
(7) State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled reply code 11
(7) eap_peap: EAP-Message = 0x0109000f0650617373776f72643a20
(7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled reply RADIUS code 11
(7) eap_peap: EAP-Message = 0x0109000f0650617373776f72643a20
(7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled Access-Challenge
(7) eap: EAP session adding &reply:State = 0x5d232d885a2a34dd
(7) [eap] = handled
(7) } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) Post-Auth-Type sub-section not found. Ignoring.
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) Sent Access-Challenge Id 109 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(7) EAP-Message = 0x0109002e19001703030023dbf9a5fe6b58c9b2c86f77544490173e291a25dd612c301797c162a5c8fc06f66e5112
(7) Message-Authenticator = 0x00000000000000000000000000000000
(7) State = 0x5d232d885a2a34dd60443f4cd8d35175
(7) Finished request
Waking up in 4.9 seconds.
(8) Received Access-Request Id 95 from 192.168.30.121:59063 to 192.168.10.211:1812 length 265
(8) User-Name = '00703070(a)harper-adams.ac.uk'
(8) NAS-IP-Address = 192.168.30.121
(8) NAS-Port = 0
(8) NAS-Identifier = '192.168.30.121'
(8) NAS-Port-Type = Wireless-802.11
(8) Calling-Station-Id = '96006F089222'
(8) Called-Station-Id = '001A1E01CF58'
(8) Service-Type = Framed-User
(8) Framed-MTU = 1100
(8) EAP-Message = 0x02090033190017030300280000000000000003e26173435d91e7f61b6321efcb63810a55eedad5f9ee2e3b1bd11f0c34e5d051
(8) State = 0x5d232d885a2a34dd60443f4cd8d35175
(8) Aruba-Essid-Name = 'eduroam'
(8) Aruba-Location-Id = 'CETLfoyer_AP01'
(8) Aruba-AP-Group = 'apg-comp'
(8) Message-Authenticator = 0x6290f9ac9790288097d9abada7f4cf76
(8) session-state: No cached attributes
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(8) authorize {
(8) policy eduroam_filter {
(8) if (User-Name !~ /@/) {
(8) if (User-Name !~ /@/) -> FALSE
(8) if ("%{User-Name}" =~ /@$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070(a)harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /@$/) -> FALSE
(8) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070(a)harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(8) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070(a)harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(8) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070(a)harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(8) } # policy eduroam_filter = notfound
(8) [preprocess] = ok
(8) policy operator-name.authorize {
(8) if ("%{client:Operator-Name}") {
(8) EXPAND %{client:Operator-Name}
(8) --> 1harper-adams.ac.uk
(8) if ("%{client:Operator-Name}") -> TRUE
(8) if ("%{client:Operator-Name}") {
(8) update request {
(8) EXPAND %{client:Operator-Name}
(8) --> 1harper-adams.ac.uk
(8) &Operator-Name = 1harper-adams.ac.uk
(8) } # update request = noop
(8) } # if ("%{client:Operator-Name}") = noop
(8) } # policy operator-name.authorize = noop
(8) policy cui.authorize {
(8) if ("%{client:add_cui}" == 'yes') {
(8) EXPAND %{client:add_cui}
(8) --> yes
(8) if ("%{client:add_cui}" == 'yes') -> TRUE
(8) if ("%{client:add_cui}" == 'yes') {
(8) update request {
(8) &Chargeable-User-Identity := 0x00
(8) } # update request = noop
(8) } # if ("%{client:add_cui}" == 'yes') = noop
(8) } # policy cui.authorize = noop
(8) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070(a)harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(8) else {
(8) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(8) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(8) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(8) auth_log: EXPAND %t
(8) auth_log: --> Mon Sep 7 19:55:28 2020
(8) [auth_log] = ok
(8) } # else = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(8) suffix: Found realm "harper-adams.ac.uk"
(8) suffix: Adding Stripped-User-Name = "00703070"
(8) suffix: Adding Realm = "harper-adams.ac.uk"
(8) suffix: Authentication realm is LOCAL
(8) [suffix] = ok
(8) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070(a)harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(8) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(8) [noop] = noop
(8) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(8) ... skipping elsif for request 8: Preceding "if" was taken
(8) ... skipping elsif for request 8: Preceding "if" was taken
(8) ... skipping elsif for request 8: Preceding "if" was taken
(8) ... skipping else for request 8: Preceding "if" was taken
(8) eap: Peer sent code Response (2) ID 9 length 51
(8) eap: Continuing tunnel setup
(8) [eap] = ok
(8) } # authorize = ok
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) authenticate {
(8) eap: Expiring EAP session with state 0xcef5e17acffce791
(8) eap: Finished EAP session with state 0x5d232d885a2a34dd
(8) eap: Previous EAP request found for state 0x5d232d885a2a34dd, released from the list
(8) eap: Peer sent method PEAP (25)
(8) eap: EAP PEAP (25)
(8) eap: Calling eap_peap to process EAP data
(8) eap_peap: processing EAP-TLS
(8) eap_peap: eaptls_verify returned 7
(8) eap_peap: Done initial handshake
(8) eap_peap: eaptls_process returned 7
(8) eap_peap: FR_TLS_OK
(8) eap_peap: Session established. Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP type GTC (6)
(8) eap_peap: Got tunneled request
(8) eap_peap: EAP-Message = 0x020900140654726964656e743234313030303239
(8) eap_peap: Setting User-Name to 00703070(a)harper-adams.ac.uk
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap: EAP-Message = 0x020900140654726964656e743234313030303239
(8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap: User-Name = '00703070(a)harper-adams.ac.uk'
(8) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d
(8) eap_peap: NAS-IP-Address = 192.168.30.121
(8) eap_peap: NAS-Port = 0
(8) eap_peap: NAS-Identifier = '192.168.30.121'
(8) eap_peap: NAS-Port-Type = Wireless-802.11
(8) eap_peap: Calling-Station-Id = '96006F089222'
(8) eap_peap: Called-Station-Id = '001A1E01CF58'
(8) eap_peap: Service-Type = Framed-User
(8) eap_peap: Framed-MTU = 1100
(8) eap_peap: Aruba-Essid-Name = 'eduroam'
(8) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01'
(8) eap_peap: Aruba-AP-Group = 'apg-comp'
(8) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(8) eap_peap: Operator-Name = '1harper-adams.ac.uk'
(8) eap_peap: Chargeable-User-Identity := 0x00
(8) Virtual server inner-tunnel received request
(8) EAP-Message = 0x020900140654726964656e743234313030303239
(8) FreeRADIUS-Proxied-To = 127.0.0.1
(8) User-Name = '00703070(a)harper-adams.ac.uk'
(8) State = 0xcef5e17acffce79195ed82a9e621722d
(8) NAS-IP-Address = 192.168.30.121
(8) NAS-Port = 0
(8) NAS-Identifier = '192.168.30.121'
(8) NAS-Port-Type = Wireless-802.11
(8) Calling-Station-Id = '96006F089222'
(8) Called-Station-Id = '001A1E01CF58'
(8) Service-Type = Framed-User
(8) Framed-MTU = 1100
(8) Aruba-Essid-Name = 'eduroam'
(8) Aruba-Location-Id = 'CETLfoyer_AP01'
(8) Aruba-AP-Group = 'apg-comp'
(8) Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(8) Operator-Name = '1harper-adams.ac.uk'
(8) Chargeable-User-Identity := 0x00
(8) server inner-tunnel {
(8) session-state: No cached attributes
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) authorize {
(8) [chap] = noop
(8) [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(8) suffix: Found realm "harper-adams.ac.uk"
(8) suffix: Adding Stripped-User-Name = "00703070"
(8) suffix: Adding Realm = "harper-adams.ac.uk"
(8) suffix: Authentication realm is LOCAL
(8) [suffix] = ok
(8) update control {
(8) &Proxy-To-Realm := LOCAL
(8) } # update control = noop
(8) eap: Peer sent code Response (2) ID 9 length 20
(8) eap: No EAP Start, assuming it's an on-going EAP conversation
(8) [eap] = updated
(8) [files] = noop
(8) [expiration] = noop
(8) [logintime] = noop
(8) [pap] = noop
(8) } # authorize = updated
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) authenticate {
(8) eap: Expiring EAP session with state 0xcef5e17acffce791
(8) eap: Finished EAP session with state 0xcef5e17acffce791
(8) eap: Previous EAP request found for state 0xcef5e17acffce791, released from the list
(8) eap: Peer sent method GTC (6)
(8) eap: EAP GTC (6)
(8) eap: Calling eap_gtc to process EAP data
(8) eap_gtc: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) eap_gtc: Auth-Type PAP {
(8) pap: Login attempt with password
(8) pap: No password configured for the user. Cannot do authentication
(8) [pap] = fail
(8) } # Auth-Type PAP = fail
(8) eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed
(8) eap: Failed in EAP select
(8) [eap] = invalid
(8) } # authenticate = invalid
(8) Failed to authenticate the user
(8) Using Post-Auth-Type Reject
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) Post-Auth-Type REJECT {
(8) attr_filter.access_reject: EXPAND %{User-Name}
(8) attr_filter.access_reject: --> 00703070(a)harper-adams.ac.uk
(8) attr_filter.access_reject: Matched entry DEFAULT at line 18
(8) [attr_filter.access_reject] = updated
(8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}
(8) inner_tunnel_server_log: --> inner_tunnel_server_log.Access-Reject
(8) inner_tunnel_server_log: EXPAND /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d
(8) inner_tunnel_server_log: --> /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-20200907
(8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject
(8) inner_tunnel_server_log: --> inner_tunnel_server_log#Mon Sep 7 19:55:28 2020#USERNAME=00703070@harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020900140654726964656e743234313030303239#RESULT=Access-Reject
(8) [inner_tunnel_server_log] = ok
(8) update outer.session-state {
(8) &Module-Failure-Message := &Module-Failure-Message -> eap: Failed continuing EAP GTC (6) session. EAP sub-module failed
(8) } # update outer.session-state = noop
(8) } # Post-Auth-Type REJECT = updated
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8) EAP-Message = 0x04090004
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Got tunneled reply code 3
(8) eap_peap: EAP-Message = 0x04090004
(8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Got tunneled reply RADIUS code 3
(8) eap_peap: EAP-Message = 0x04090004
(8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Tunneled authentication was rejected
(8) eap_peap: FAILURE
(8) eap: EAP session adding &reply:State = 0x5d232d88552934dd
(8) [eap] = handled
(8) } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) Post-Auth-Type sub-section not found. Ignoring.
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) session-state: Saving cached attributes
(8) Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed'
(8) Sent Access-Challenge Id 95 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(8) EAP-Message = 0x010a002e19001703030023dbf9a5fe6b58c9b35409b5950099335ab262a924b463f36eeabe34c5e86c199e0fb490
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0x5d232d88552934dd60443f4cd8d35175
(8) Finished request
Waking up in 4.9 seconds.
(9) Received Access-Request Id 205 from 192.168.30.121:59063 to 192.168.10.211:1812 length 260
(9) User-Name = '00703070(a)harper-adams.ac.uk'
(9) NAS-IP-Address = 192.168.30.121
(9) NAS-Port = 0
(9) NAS-Identifier = '192.168.30.121'
(9) NAS-Port-Type = Wireless-802.11
(9) Calling-Station-Id = '96006F089222'
(9) Called-Station-Id = '001A1E01CF58'
(9) Service-Type = Framed-User
(9) Framed-MTU = 1100
(9) EAP-Message = 0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490
(9) State = 0x5d232d88552934dd60443f4cd8d35175
(9) Aruba-Essid-Name = 'eduroam'
(9) Aruba-Location-Id = 'CETLfoyer_AP01'
(9) Aruba-AP-Group = 'apg-comp'
(9) Message-Authenticator = 0x9fd80c90ae227ad00b39d0f216ca9efb
(9) session-state: Found cached attributes
(9) Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed'
(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(9) authorize {
(9) policy eduroam_filter {
(9) if (User-Name !~ /@/) {
(9) if (User-Name !~ /@/) -> FALSE
(9) if ("%{User-Name}" =~ /@$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070(a)harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /@$/) -> FALSE
(9) if ("%{User-Name}" =~ /(a)gmail\.com$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070(a)harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE
(9) if ("%{User-Name}" =~ /(a)yahoo\.com$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070(a)harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE
(9) if ("%{User-Name}" =~ /(a)hotmail\.com$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070(a)harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE
(9) } # policy eduroam_filter = notfound
(9) [preprocess] = ok
(9) policy operator-name.authorize {
(9) if ("%{client:Operator-Name}") {
(9) EXPAND %{client:Operator-Name}
(9) --> 1harper-adams.ac.uk
(9) if ("%{client:Operator-Name}") -> TRUE
(9) if ("%{client:Operator-Name}") {
(9) update request {
(9) EXPAND %{client:Operator-Name}
(9) --> 1harper-adams.ac.uk
(9) &Operator-Name = 1harper-adams.ac.uk
(9) } # update request = noop
(9) } # if ("%{client:Operator-Name}") = noop
(9) } # policy operator-name.authorize = noop
(9) policy cui.authorize {
(9) if ("%{client:add_cui}" == 'yes') {
(9) EXPAND %{client:add_cui}
(9) --> yes
(9) if ("%{client:add_cui}" == 'yes') -> TRUE
(9) if ("%{client:add_cui}" == 'yes') {
(9) update request {
(9) &Chargeable-User-Identity := 0x00
(9) } # update request = noop
(9) } # if ("%{client:add_cui}" == 'yes') = noop
(9) } # policy cui.authorize = noop
(9) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070(a)harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE
(9) else {
(9) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(9) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(9) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(9) auth_log: EXPAND %t
(9) auth_log: --> Mon Sep 7 19:55:28 2020
(9) [auth_log] = ok
(9) } # else = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk"
(9) suffix: Found realm "harper-adams.ac.uk"
(9) suffix: Adding Stripped-User-Name = "00703070"
(9) suffix: Adding Realm = "harper-adams.ac.uk"
(9) suffix: Authentication realm is LOCAL
(9) [suffix] = ok
(9) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070(a)harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE
(9) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) {
(9) [noop] = noop
(9) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop
(9) ... skipping elsif for request 9: Preceding "if" was taken
(9) ... skipping elsif for request 9: Preceding "if" was taken
(9) ... skipping elsif for request 9: Preceding "if" was taken
(9) ... skipping else for request 9: Preceding "if" was taken
(9) eap: Peer sent code Response (2) ID 10 length 46
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = EAP
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x5d232d88552934dd
(9) eap: Finished EAP session with state 0x5d232d88552934dd
(9) eap: Previous EAP request found for state 0x5d232d88552934dd, released from the list
(9) eap: Peer sent method PEAP (25)
(9) eap: EAP PEAP (25)
(9) eap: Calling eap_peap to process EAP data
(9) eap_peap: processing EAP-TLS
(9) eap_peap: eaptls_verify returned 7
(9) eap_peap: Done initial handshake
(9) eap_peap: eaptls_process returned 7
(9) eap_peap: FR_TLS_OK
(9) eap_peap: Session established. Decoding tunneled attributes
(9) eap_peap: PEAP state send tlv failure
(9) eap_peap: Received EAP-TLV response
(9) eap_peap: The users session was previously rejected: returning reject (again.)
(9) eap_peap: This means you need to read the PREVIOUS messages in the debug output
(9) eap_peap: to find out the reason why the user was rejected
(9) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you
(9) eap_peap: what went wrong, and how to fix the problem
SSL: Removing session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c from the cache
(9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed
(9) eap: Failed in EAP select
(9) [eap] = invalid
(9) } # authenticate = invalid
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) Post-Auth-Type REJECT {
(9) attr_filter.access_reject: EXPAND %{User-Name}
(9) attr_filter.access_reject: --> 00703070(a)harper-adams.ac.uk
(9) attr_filter.access_reject: Matched entry DEFAULT at line 18
(9) [attr_filter.access_reject] = updated
(9) [eap] = noop
(9) policy remove_reply_message_if_eap {
(9) if (&reply:EAP-Message && &reply:Reply-Message) {
(9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(9) else {
(9) [noop] = noop
(9) } # else = noop
(9) } # policy remove_reply_message_if_eap = noop
(9) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
(9) reply_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907
(9) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907
(9) reply_log: EXPAND %t
(9) reply_log: --> Mon Sep 7 19:55:28 2020
(9) [reply_log] = ok
(9) default_server_log: EXPAND default_server_log.%{%{reply:Packet-Type}:-format}
(9) default_server_log: --> default_server_log.Access-Reject
(9) default_server_log: EXPAND /usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d
(9) default_server_log: --> /usr/local/var/log/radius/radacct/default_server_log/default_server_log-20200907
(9) default_server_log: EXPAND default_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject
(9) default_server_log: --> default_server_log#Mon Sep 7 19:55:28 2020#USERNAME=00703070@harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490#RESULT=Access-Reject
(9) [default_server_log] = ok
(9) on-site-reject-log: EXPAND on-site-reject-log.%{%{reply:Packet-Type}:-format}
(9) on-site-reject-log: --> on-site-reject-log.Access-Reject
(9) on-site-reject-log: EXPAND /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d
(9) on-site-reject-log: --> /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-20200907
(9) on-site-reject-log: EXPAND %S#USERNAME=%{%{request:User-Name}:-NO-USER-NAME}#MACADDR=%{%{Calling-Station-Id}:-NO-MAC-ADDR}##DEVICE=%{%{request:Aruba-Device-Type}:-NO-DEVICE-TYPE}#LOCATION=%{%{request:Aruba-Location-Id}:-NO-LOCATION-ID}#ERRORMSG=%{%{reply:Reply-Message}:-%{&session-state:Module-Failure-Message}}
(9) on-site-reject-log: --> 2020-09-07 19:55:28#USERNAME=00703070@harper-adams.ac.uk#MACADDR=96006F089222##DEVICE=NO-DEVICE-TYPE#LOCATION=CETLfoyer_AP01#ERRORMSG=eap: Failed continuing EAP GTC (6) session. EAP sub-module failed
(9) [on-site-reject-log] = ok
(9) } # Post-Auth-Type REJECT = updated
(9) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(9) <delay>: Sending delayed response
(9) <delay>: Sent Access-Reject Id 205 from 192.168.10.211:1812 to 192.168.30.121:59063 length 44
(9) <delay>: EAP-Message = 0x040a0004
(9) <delay>: Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) <done>: Cleaning up request packet ID 66 with timestamp +5
(1) <done>: Cleaning up request packet ID 36 with timestamp +5
(2) <done>: Cleaning up request packet ID 101 with timestamp +5
(3) <done>: Cleaning up request packet ID 246 with timestamp +5
(4) <done>: Cleaning up request packet ID 93 with timestamp +5
(5) <done>: Cleaning up request packet ID 254 with timestamp +5
(6) <done>: Cleaning up request packet ID 236 with timestamp +5
(7) <done>: Cleaning up request packet ID 109 with timestamp +5
(8) <done>: Cleaning up request packet ID 95 with timestamp +5
(9) <delay>: Cleaning up request packet ID 205 with timestamp +5
Ready to process requests
3
3
Hello all,
I am trying to configure FreeRadius 3.0X with remote MSSQL and unixODBC,
all basic tests have been passed sucefully.
However, when I run radtest, on my radiusd server, I get the following error
-
[root@radius-1 ~]# radtest testnesma(a)1024.corp.nesma.net.sa 112233
localhost 0 testing123
Sent Access-Request Id 108 from 0.0.0.0:45102 to 127.0.0.1:1812 length 102
User-Name = "testnesma(a)1024.corp.nesma.net.sa"
User-Password = "112233"
NAS-IP-Address = 212.71.40.32
NAS-Port = 0
Message-Authenticator = 0x00
Cleartext-Password = "112233"
Received Access-Reject Id 108 from 127.0.0.1:1812 to 127.0.0.1:45102 length
20
(0) -: Expected Access-Accept got Access-Reject
Debug output.
(0) Received Access-Request Id 108 from 127.0.0.1:45102 to 127.0.0.1:1812
length 102
(0) User-Name = "testnesma(a)1024.corp.nesma.net.sa"
(0) User-Password = "112233"
(0) NAS-IP-Address = 212.71.40.32
(0) NAS-Port = 0
(0) Message-Authenticator = 0xcae0ae6cc9464e071bedb1119c825542
(0) # Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) ->
FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /(a)\./) {
(0) if (&User-Name =~ /(a)\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "1024.corp.nesma.net.sa" for User-Name =
"testnesma(a)1024.corp.nesma.net.sa"
(0) suffix: No such realm "1024.corp.nesma.net.sa"
(0) [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0) [eap] = noop
(0) [files] = noop
(0) sql: EXPAND %{User-Name}
(0) sql: --> testnesma(a)1024.corp.nesma.net.sa
(0) sql: SQL-User-Name set to 'testnesma(a)1024.corp.nesma.net.sa'
rlm_sql (sql): Reserved connection (0)
(0) sql: EXPAND SELECT select password, replyattr, checkattr FROM
NB_Authentication_Nesma WHERE Username = '%{User-Name}' ORDER BY id
(0) sql: --> SELECT select password, replyattr, checkattr FROM
NB_Authentication_Nesma WHERE Username = 'testnesma(a)1024.corp.nesma.net.sa'
ORDER BY id
(0) sql: Executing select query: SELECT select password, replyattr,
checkattr FROM NB_Authentication_Nesma WHERE Username =
'testnesma(a)1024.corp.nesma.net.sa' ORDER BY id
The 'rlm_sql_null' driver CANNOT be used for SELECTS.
Please update the 'sql' module configuration to use a real database.
Set 'driver = ...' to the database you want to use.
(0) sql: WARNING: Cannot do check groups when group_membership_query is not
set
rlm_sql (sql): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used
(0) [sql] = notfound
(0) [expiration] = noop
(0) [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user. Not setting
Auth-Type
(0) pap: WARNING: Authentication will fail unless a "known good" password is
available
(0) [pap] = noop
(0) } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type =
Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) Post-Auth-Type REJECT {
(0) sql: EXPAND .query
(0) sql: --> .query
(0) sql: Using query template 'query'
rlm_sql (sql): Reserved connection (1)
(0) sql: EXPAND %{User-Name}
(0) sql: --> testnesma(a)1024.corp.nesma.net.sa
(0) sql: SQL-User-Name set to 'testnesma(a)1024.corp.nesma.net.sa'
(0) sql: EXPAND insert into RADONLINE
(USERNAME,NASIDENTIFIER,NASPORT,ACCTSESSIONID,TIME_STAMP,FRAMEDIPADDRESS,NAS
PORTTYPE,SERVICETYPE,CALLERID) values
('%{User-Name}','%{NAS-IP-Address}',%{NAS-Port},'%{Acct-Session-Id}',Cast
('%G' as
datetime),'%{Framed-IP-Address}','%{NAS-Port-Type}','%{Framed-Protocol}','%{
Calling-Station-Id}')
(0) sql: --> insert into RADONLINE
(USERNAME,NASIDENTIFIER,NASPORT,ACCTSESSIONID,TIME_STAMP,FRAMEDIPADDRESS,NAS
PORTTYPE,SERVICETYPE,CALLERID) values
('testnesma(a)1024.corp.nesma.net.sa','212.71.40.32',0,'',Cast ('39' as
datetime),'','','','')
(0) sql: Executing query: insert into RADONLINE
(USERNAME,NASIDENTIFIER,NASPORT,ACCTSESSIONID,TIME_STAMP,FRAMEDIPADDRESS,NAS
PORTTYPE,SERVICETYPE,CALLERID) values
('testnesma(a)1024.corp.nesma.net.sa','212.71.40.32',0,'',Cast ('39' as
datetime),'','','','')
(0) sql: SQL query returned: success
(0) sql: 1 record(s) updated
rlm_sql (sql): Released connection (1)
(0) [sql] = ok
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject: --> testnesma(a)1024.corp.nesma.net.sa
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0) [attr_filter.access_reject] = updated
(0) [eap] = noop
(0) policy remove_reply_message_if_eap {
(0) if (&reply:EAP-Message && &reply:Reply-Message) {
(0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(0) else {
(0) [noop] = noop
(0) } # else = noop
(0) } # policy remove_reply_message_if_eap = noop
(0) } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
3
11
I'd like to run FreeRADIUS in a docker container, but I can't start it with the default config.
(I am not sure if this is the right place for my question or should I go to an alpine forum/list.)
What I do:
$ docker run -it alpine
# apk add freeradius-eap make openssl
# cd /etc/raddb/certs
# ./bootstrap
# radiusd -X
What I wait: it starts radius server.
What I get instead of it: an error message.
# Instantiating module "eap" from file /etc/raddb/mods-enabled/eap
/etc/raddb/mods-enabled/eap[14]: Failed to find 'Auth-Type EAP' section. Cannot authenticate users.
/etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap"
But... If I edit /etc/raddb/sites-enabled/default and change
authenticate {
...
-eap
...
}
to
authenticate {
...
eap
...
}
then it starts with no error.
I've tried to compare the logs with "diff -y --suppress-common-lines wrong.log good.log" and in the left column I get only that error message.
Have you got any idea, what happens, what is the problem with the conditional loading of eap module?
Regards,
Victor Sugo
2
1
Freeradius, Kerberos and Openldap GSSAPI-SASL service principal issue
by Dario García Díaz-Miguel 18 Sep '20
by Dario García Díaz-Miguel 18 Sep '20
18 Sep '20
Hi there,
I'm writing to this mailing list looking for some help in order to configure Freeradius on a Kerberos and OpenLDAP GSSAPI-SASL infrastructure.
We have everything working flawlessly. Freeradius service and server is working fine with krb5 and ldap modules enabled. The problem is when we need to start the freeradius service.
The service only starts if you manually issue a ticket for the service kerberos principal or the host principal.
This is such a strange behavior I can't understand.
Krb5 module:
krb5 {
keytab = /etc/radius.keytab
service_principal = radius/ex.ample.com
pool {
start = ${thread[pool].start_servers}
min = ${thread[pool].min_spare_servers}
max = ${thread[pool].max_servers}
spare = ${thread[pool].max_spare_servers}
uses = 0
lifetime = 0
idle_timeout = 0
}
}
The keytab /etc/radius.keytab contains the keys for the service principal radius/ex.ample.com.
The service should be able to access to the keytab to asks automatically for a ticket for radius/ex.ample.com. But it doesn't. Instead, the service fails until we issue for a new ticket:
kinit -k -t /etc/radius.keytab radius/ex.ample.com
The ownership of this keytab is radiusd:radiusd and it has reading permissions 440. But I've also tried with 777 with no luck
The reason because it does not understand is that ldap has anon bind disallowed and the freeradius service tries an anonymous bind.
I know that according to the rules I should have posted the full output debug log but I'm afraid that since it's a totally isolated environment, I can't extract the whole log.
Error: rlm_ldap (ldap): Bind with (anonymous) to ldap://ex.ample.com:389 failed: Local error
Error: rlm_ldap (ldap): Opening connection failed (0)
Error: rlm_ldap (ldap): Error: /etc/raddb/mods-enabled/ldap [8]: Instantiation failed for module "ldap"
This is how the ldap module SASL section looks:
sasl {
mech = 'GSSAPI'
realm ='EX.AMPLE.COM'
}
The most weird behavior is that If we issue a host ticket (kinit -k) it starts and bind correctly using the host/ex.ample.com service principal. No matter that the service principal configured on krb5 module is radius/ex.ample.com
Any ideas about how to proceed and the reasons why this happens?
We are running the 3.0.15-2.11.2 freeradius version on SuSE12 SP3.
Thank you so much.
Kind Regards.
Dario Garcia
Díaz-Miguel
GGCS-SES Unit
GGCS SKMF Infrastructure Division
GMV
C\ de Isaac Newton, 11
28760, Tres Cantos, Madrid
España
+34 918 07 21 00
+34 918 07 21 99
www.gmv.com
P Please consider the environment before printing this e-mail.
3
3
I want to limit the number of users online to 1 at the same time. Is it OK to operate the database only?
by 纽约城门口的小木匠 ■ 17 Sep '20
by 纽约城门口的小木匠 ■ 17 Sep '20
17 Sep '20
I want to limit the number of users online to 1 at the same time. Is it OK to operate the database only?
2
1
Hi
I am looking into a possible scenario where we need to pass the accounting
start record to two devices simultaneously, but because we have multiple
sites, I will need to look at the source NAS and then forward/proxy to the
two correct accounting servers based on that site. Currently our NAS can
only send the accounting start to one device at a time.
In my research, I know that there is the option of setting up a freeradius
accounting proxy with some home servers, but I am struggling to understand
if this will accomplish what we are looking to do as above. Will I need to
reference these home servers in the Accounting section in the
sites-enabled>default config file?
Hope I made sense, sorry.
- Kind Regards
- Byron Jeffery
- Assisting ICT Manager
--
The content of this message is provided without responsibility in law for
their accuracy or otherwise, and without assumption of a duty of care by
Christian Education Ministries. Whilst every attempt has been made to
ensure that material contained in this email is free from computer viruses
or other defects, the attached files are provided, and may only be used, on
the basis that the user assumes all responsibility for use of the material
transmitted. This email is intended only for the use of the individual or
entity names above and may contain information that is confidential and
privileged. If you are not the intended recipient, please note that any
dissemination, distribution or copying of this email is strictly
prohibited. If you have received this email in error, please notify us
immediately by return email and destroy the original message.
2
1