February 2021 - Freeradius-Users - lists.freeradius.org

Authenticate to AD but only allow certain group
by Brian C. Huffman 16 Aug '25

16 Aug '25

All, I've got authentication working nicely with MSCHAP, but now I'd like to only allow users that are members of a certain AD group. I would prefer to have this happen only when requests come from a specific client (wireless access point). In this case the idea is to have users only be able to get wireless access when they're in a specific AD group. How can I do this in freeradius? Thanks, Brian

7 18

RE: EAP-TLS Signature Check Failure
by nabble＠felix.world 12 Jul '22

12 Jul '22

Hi Together, we finally got the issue and for the anyone else, how will face the issue, the fix is quite simple. Update your TPM Firmware! In fact, during the authentication the client is sending a signature which only includes nulls. The packet itself is intact, sizes of the packets are valid and the signature algorithm is also well. The only thing that's not in the tls authentication is a signature. : ```` (4) eap_tls: <<< recv TLS 1.2 (type: 0016) [length 0108] handshake_type: 0f, alert_level: 00, alert_description: 00 0f000104 TLS handshake certificate_verify len 0x000104 = 260 0804 signature algorithm: rsa_pss_rsae_sha256 0100 signature size: 0x0100 = 256 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 00000000000000000000 000000000000 ```` That's also the reason why some of our clients are able to authenticate and some not, with the key, stored in TPM. Intel ships end customer TPM updater, STM as we know not. We also don't have clients with Infineon chips but they should also ship updates to the end customer. FYI: This was a team operation and thanks to all that helped here. Regards, Lineconnnect <quote author='Users mailing list'> 2 months later, a quick update on this topic (apologies, I may have broken the threading as I don't have a copy of the original e-mails any more!), just so there's an online reference here for anyone encountering the same error. Turns out I was wrong about it being Windows and OpenSSL getting muddled over TLS 1.2 vs. 1.3... To recap: Windows 10 clients, corporate WiFi network using EAP-TLS to RADIUS with machine certificate (SCEP) authentication only. Error in Freeradius logs: (6) eap_tls: ERROR: TLS Alert write:fatal:decrypt error tls: TLS_accept: Error in error (6) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read) (6) eap_tls: ERROR: error:0407E086:rsa routines:RSA_verify_PKCS1_PSS_mgf1:last octet invalid (6) eap_tls: ERROR: error:1417B07B:SSL routines:tls_process_cert_verify:bad signature (6) eap_tls: ERROR: System call (I/O) error (-1) (6) eap_tls: ERROR: TLS receive handshake failed during operation (6) eap_tls: ERROR: [eaptls process] = fail After encountering the error on a few machines again, even with "tls_max_version" set, I delved into the guts of Windows again, and found the error (which isn't helpful or descriptive) was actually caused because: * Some machine certificates had were stored/managed by the "Microsoft Platform Crypto Provider" (TPM-backed) * Built-in security measures control access to keys in that CSP, and it cannot be used non-interactively * Windows WiFi profile was set to auto-join (non-interactive) * Windows couldn't get the key, so $deity knows what signature it was sending * OpenSSL rightly got confused The solution: Ensure machine certificate keys are stored in the "Microsoft Software Key Storage Provider" (or another CSP/KSP that permits non-interactive use). All is well again, and I'm close to shutting down NPS :-) -- Peter Bance Information Security Adviser Alan DeKok wrote: > A final update on this, in case anyone here's interested (or to "wrap > up" for anyone stumbling across this thread online) - I fixed it, and > Windows clients are now happily joining WiFi. It's a beautiful thing to > behold :-) > > In the end, I had to force OpenSSL on FreeRADIUS to stop offering > TLS1.3 ciphers using the mods/eap config: > > tls_max_version = "1.2" Good to hear. > It seems there may be a bug in OpenSSL 1.1.1 such that even though the > negotiation resulted in a TLS 1.2 session, the weird back-port of TLS > 1.3 ciphers into TLS 1.2 confused things (a lot), and it tried checking > for TLS 1.3 style signatures inappropriately. Weird, but OK. It's OpenSSL :( Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html </quote> Quoted from: http://freeradius.1045715.n5.nabble.com/RE-EAP-TLS-Signature-Check-Failure-… _____________________________________ Sent from http://freeradius.1045715.n5.nabble.com

3 4

EAP-TLS PKI management
by Munroe Sollog 17 Jun '21

17 Jun '21

Has anyone deployed EAP-TLS in concert with BYOD? This Android 11 change that removes the ability for the user to "Do Not Validate" the CA certificate has forced us to re-evaluate our .1x PEAP solution. EAP-TLS seems like the best option, however the onboarding of user-brought devices seems tricky. With MDM or AD-joined devices pushing the certificates out are easy. In an environment where "bring your own device" is encouraged, I'm curious how network admins are making client certificate installations easy enough for end users to do. Android 11 change article for reference: https://www.xda-developers.com/android-11-break-enterprise-wifi-connection/ -- Munroe Sollog (He/Him/His) Senior Network Engineer munroe(a)lehigh.edu

5 7

CentOS 8 packages missing winbind support?
by Josef Vybíhal 14 Jun '21

14 Jun '21

Packages for CentOS 8 at https://networkradius.com/freeradius-packages/ appear to be compiled without winbind support. Is there a reason for that? CentOS 7 package have it - not sure about other distros. ... snip... # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting_syslog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "vlanlog" from file /etc/raddb/mods-enabled/linelog # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime # Instantiating module "mschap_winbind" from file /etc/raddb/mods-enabled/mschap /etc/raddb/mods-enabled/mschap[1]: 'winbind' auth not enabled at compiled time /etc/raddb/mods-enabled/mschap[1]: Instantiation failed for module "mschap_winbind" P.

6 12

Fwd: Question regarding the direction of eap_tls: <<< recv and eap_tls: >>> send
by Eric Nguyen 17 Mar '21

17 Mar '21

Hi, I'd like to ask a question regarding the direction of the exchanges in the radius log (radiusd -X). I used eapol_test as a client/authenticator against FreeRADIUS 3.0.21. - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a failure. In this case, "eap_tls: <<< recv TLS 1.3" looks like an exchange from FreeRADIUS to eapol_test (SERVER -> CLIENT): tls_min_version = "1.3" tls_max_version = "1.3" The FREERADIUS log shows: (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version - If I set the following parameters in the FreeRADIUS eap file, espol_test will results in a success. In this case, "eap_tls: <<< recv TLS 1.2" looks like an exchange from eapol_test to FreeRADIUS (CLIENT TO SERVER): tls_min_version = "1.2" tls_max_version = "1.3" (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs Could you please clarify the meaning of these "eap_tls: <<< recv" log messages? Thanks, Eric ------------------------------------------------------------------------------------------------------------------------------------------- FULL LOG tls_min_version = "1.3" tls_max_version = "1.3" (2) eap: Calling submodule eap_tls to process data (2) eap_tls: Continuing EAP-TLS (2) eap_tls: [eaptls verify] = ok (2) eap_tls: Done initial handshake (2) eap_tls: (other): before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: TLS_accept: before SSL initialization (2) eap_tls: <<< recv TLS 1.3 [length 00b9] (2) eap_tls: >>> send TLS 1.2 [length 0002] (2) eap_tls: ERROR: TLS Alert write:fatal:protocol version tls: TLS_accept: Error in error (2) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:14209102:SSL routines:tls_early_post_process_client_hello:unsupported protocol (2) eap_tls: ERROR: System call (I/O) error (-1) (2) eap_tls: ERROR: TLS receive handshake failed during operation (2) eap_tls: ERROR: [eaptls process] = fail (2) eap: ERROR: Failed continuing EAP TLS (13) session. EAP sub-module failed (2) eap: Sending EAP Failure (code 4) ID 54 length 4 (2) eap: Failed in EAP select (2) [eap] = invalid (2) } # authenticate = invalid ------------------------------------------------------------------------------------------------------------------------------------------- tls_min_version = "1.2" tls_max_version = "1.3" (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Got final TLS record fragment (1272 bytes) (6) eap_tls: [eaptls verify] = ok (6) eap_tls: Done initial handshake (6) eap_tls: TLS_accept: SSLv3/TLS write server done (6) eap_tls: <<< recv TLS 1.2 [length 08de] (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Cert-Serial := "315fa3c827cb5c44e13222c88ff80369d1a176f1" (6) eap_tls: TLS-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Cert-Subject := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Cert-Common-Name := "Example Certificate Authority" (6) eap_tls: TLS - Creating attributes from certificate OIDs (6) eap_tls: TLS-Client-Cert-Serial := "02" (6) eap_tls: TLS-Client-Cert-Expiration := "210113170058Z" (6) eap_tls: TLS-Client-Cert-Valid-Since := "201114170058Z" (6) eap_tls: TLS-Client-Cert-Subject := "/C=FR/ST=Radius/O=Example Inc./CN=user@example.org/emailAddress=user@example.org" (6) eap_tls: TLS-Client-Cert-Issuer := "/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin(a)example.org/CN=Example Certificate Authority" (6) eap_tls: TLS-Client-Cert-Common-Name := "user(a)example.org" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage += "TLS Web Client Authentication" (6) eap_tls: TLS-Client-Cert-X509v3-Extended-Key-Usage-OID += "1.3.6.1.5.5.7.3.2" (6) eap_tls: TLS_accept: SSLv3/TLS read client certificate (6) eap_tls: <<< recv TLS 1.2 [length 0046] (6) eap_tls: TLS_accept: SSLv3/TLS read client key exchange (6) eap_tls: <<< recv TLS 1.2 [length 0108] (6) eap_tls: TLS_accept: SSLv3/TLS read certificate verify (6) eap_tls: TLS_accept: SSLv3/TLS read change cipher spec (6) eap_tls: <<< recv TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS read finished (6) eap_tls: >>> send TLS 1.2 [length 0001] (6) eap_tls: TLS_accept: SSLv3/TLS write change cipher spec (6) eap_tls: >>> send TLS 1.2 [length 0010] (6) eap_tls: TLS_accept: SSLv3/TLS write finished (6) eap_tls: (other): SSL negotiation finished successfully (6) eap_tls: TLS - Connection Established (6) eap_tls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) eap_tls: TLS-Session-Version = "TLS 1.2" (6) eap_tls: TLS - got 51 bytes of data (6) eap_tls: [eaptls process] = handled

3 3

Standard & Realm Authentication
by Richard J Palmer 02 Mar '21

02 Mar '21

Hello All We have been using FreeRadius for quite a long time to authenticate PPPoE and L2TP sessions and hotspots. So far everything works. However I'd like to add an extra function and wondered if you could provide a pointers, Generally Users send their username - we look in SQL and return Data from radreply / ip pools etc. We have no problem there. On our LNS / LAC Devices we also have a small number of sessions that we forward to other ISPs. With these we don't have the username - but forward based on realm On our LNS We have: --- <match name="EXAMPLE-FWD" graph="EXAMPLE-FWD" username="*myexample.co.uk @example.ws" payload-table="0" relay-pick="true" relay-ip="1.2.3.4 1.2.3.5" relay-secret="test123" relay-hostname="test-hostname"/> --- As an alternative the LNS can get this data from Radius - and given the growing number of LNS devices - rather than keeping the sync up to date on multiple devices it makes sence to run this as part of the radius. NOTE this is not a radius proxy - where we pass on the radius request if it's a matching realm - BUT a radius reply to the LNS telling it to forward the connection on to the customers LNS. What I am trying to achieve in FreeRadius is 1) If there's an exact username (as now) continue as now 2) IF there's not a match either run a second SQL which will find the realm - and return accept. And then pass back the necessary attributes back to allow the session to forward. Pretty happy to do most of the work here but some pointers would be perfect. I could I suppose do this by replacing the SQL query with a stored procedure - but open to any better ideas? Thanks in advance Richard

3 6

sqlippool, same username, give different pool IP addresses
by Alberio Mirko 26 Feb '21

26 Feb '21

hello there, I am using a freeradius instance for assigning PPPoE public ip addresses to our customers. Also I created a different ip pool for service purpose, we have a service PPPoE single username for the management of the routers and it is always the same, the goal is that when the router is connected to our network it gets a private management IP so we can access and configure it. The management IP should be took from the aforemented pool, dynamically, and freed when the router is configured. So for example pool is: 172.16.0.1 172.16.0.2 172.16.0.3 172.16.0.4 routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.2 ... etc. Could this can be done using freeradius and its modules? At the moment using sqlippool I can only get the same user to get always the same ip, example: routerA authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 routerB authenticates with PPPoE service account "serviceuser@xyz", get ip 172.16.0.1 ... etc. can somebody help me? Thanks-a-lot! I attach the debugfile as intended. -- Mirko Alberio mirko.alberio(a)telemar.it

2 1

Freeradius3.x with Openldap Authorization
by Srijan 26 Feb '21

26 Feb '21

Hello, greetings.. I got some queries related to openldap authentication and authorization, followed ldap_howto.rst. Able to Authenticate via ldap but for authorization not working according to userwise's profiles.. how can i obtain user's profile. if i put default profile then it works and reply same to all users, Here's my ldap config: ldap { server = 'localhost' identity = 'cn=adm,dc=xyx,dc=com.' base_dn = 'ou=radius,dc=xyz,dc=com' update { control:Password-With-Header += 'userPassword' control:Expiration := 'radiusExpiration' control:Calling-Station-Id := 'radiusCallingStationId' control:NAS-Identifier := 'radiusNASIdentifier' control:Simultaneous-Use := 'radiusSimultaneousUse' reply:Reply-Message := 'radiusReplyMessage' control:NT-Password := 'ntPassword' reply:Idle-Timeout := 'radiusIdleTimeout' reply:Session-Timeout := 'radiusSessionTimeout' control: += 'radiusControlAttribute' request: += 'radiusRequestAttribute' reply: += 'radiusReplyAttribute' } user { base_dn = "${..base_dn}" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" sasl { } } profile { filter = '(objectclass=radiusprofile)' default = 'uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com' attribute = 'radiusProfileDn' } Result with Default profile config: Sent Access-Request Id 188 from 0.0.0.0:60201 to 127.0.0.1:1812 length 77 User-Name = "user1" User-Password = "user123" NAS-IP-Address = 10.21.8.10 NAS-Port = 1812 Message-Authenticator = 0x00 Cleartext-Password = "user123" Received Access-Accept Id 188 from 127.0.0.1:1812 to 127.0.0.1:60201 length 104 Idle-Timeout = 600 Session-Timeout = 86400 Acct-Interim-Interval = 10800 ERX-Egress-Policy-Name = "20MD" ERX-Ingress-Policy-Name = "20MU" MS-Primary-DNS-Server = 1.1.1.1 MS-Secondary-DNS-Server = 9.9.9.9 Framed-Pool = "staff-pool" Openldap: # planx, profiles, radius, xyz.com dn: uid=planx,ou=profiles,ou=radius,dc=xyz,dc=com cn: planx radiusIdleTimeout: 600 radiusSessionTimeout: 86400 radiusServiceType: Framed-User radiusFramedProtocol: PPP uid: planx objectClass: radiusObjectProfile objectClass: radiusprofile radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 20MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := staff-pool # plany, profiles, radius, xyz.com dn: uid=plany,ou=profiles,ou=radius,dc=xyz,dc=com cn: plany objectClass: radiusObjectProfile objectClass: radiusprofile objectClass: top radiusFramedProtocol: PPP radiusIdleTimeout: 600 radiusServiceType: Framed-User radiusSessionTimeout: 86400 uid: plany radiusReplyAttribute: Acct-Interim-Interval := 10800 radiusReplyAttribute: ERX-Egress-Policy-Name := 10MD radiusReplyAttribute: ERX-Ingress-Policy-Name := 10MU radiusReplyAttribute: MS-Primary-DNS-Server := 1.1.1.1 radiusReplyAttribute: MS-Secondary-DNS-Server := 9.9.9.9 radiusReplyAttribute: Framed-Pool := default-pool # users, radius, xyz.com dn: ou=users,ou=radius,dc=xyz,dc=com objectClass: organizationalUnit objectClass: top ou: users dn: uid=user1,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: planx uid: user1 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile *is " radiusGroupName:" obsolete in Freeradius3 ?* dn: uid=user2,ou=users,ou=radius,dc=xyz,dc=com radiusGroupName: plany uid: user2 objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: radiusprofile ----- How can I obtain a user's profile, please suggest.. Regards, Srijan

2 1

Change Of Authorization
by Hassan, Hazem (Nokia - EG/Cairo) 26 Feb '21

26 Feb '21

Hi , Is it possible to do COA via FreeRadius ? If yes how? Thanks, Hazem

3 2

Upgrade freeradius from version 3.0.16 to 3.0.21
by Brahim Bouchaiba 24 Feb '21

24 Feb '21

Hi, I'm new to freeradius and was tasked with upgrading Freeradius on ubuntu . Right now we are on version 3.0.16 and we would like to upgrade to version 3.018. I have searched around and can't seem to find any article or link on that process. Do we just run apt update and apt --list upgradable then apt--only-upgrade install freeradius, I have already backed up all the files in /etc/freeradius Please help. Thanks.

3 2

unknown CA when trying to authenticate
by Tyler Montney 24 Feb '21

24 Feb '21

Version 3.0.16, running on Ubuntu 18.04. While running freeradius -X and trying to connect a user (Ubiquiti controller), I see "eap_peap: ERROR: TLS Alert read:fatal:unknown CA". /etc/freeradius/3.0/mods-enabled/eap has its tls-config tls-common section like private_key_file = /etc/freeradius/3.0/certs/letsencrypt/privkey.pem certificate_file = /etc/freeradius/3.0/certs/letsencrypt/cert.pem ca_file = /etc/ssl/certs/ca-certificates.crt My CA was copied to /usr/local/share/ca-certificates/ and ran dpkg-reconfigure ca-certificates. I then checked ca-certificates.crt and confirmed my CA was appended to the bottom.

3 17

Comments on Active Directory IdP and YubiKey OTP integration that supports MS-CHAP v2
by David Herselman 23 Feb '21

23 Feb '21

Hi, I was hoping the following may provide a more complete start to finish integration guide for others that may have similar requirements. I would very much like to invite dialogue regarding any recommendations anyone may have. Our requirements were: * RADIUS servers domain joined to handle PAP and MS-CHAP v2 authentication using information only from Active Directory * We do not want to store credentials in AD with reversible encryption * AD Group membership validation based on source * Yubico OTP Multi-Factor Authentication (MFA) System are domain joined as member servers using Samba. Samba winbind subsequently presents users and groups as native system accounts, which allows references to just the group name and unlike LDAP does not make the link sensitive to the placement of the security group within the AD folders or organisational units (distinguished name or DN). Password Authentication Protocol (PAP) transmits unencrypted passwords (i.e. plain-text) over the network so connectivity should be encrypted using either IPSec or TLS (RadSec or EAP-TTLS). MS-CHAP v2 provides mutual authentication and uses a hash of the password. This means that the request only includes a hash representing the password, so there is nothing to cut the password and OTP out of. One can however transmit the OTP as the username and then lookup the associated owner's AD account name for FreeRADIUS to retrieve the hash used during authentication via Samba winbind. Yubico devices generate a unique 32 character modhex passcode each time you press the button on a YubiKey 5 or scan it using NFC. This passcode comes after a 12 character public id, which is unique to each YubiKey. We therefore have two method of transmitting the OTP during login. The first is the classic RSA token method (although reversed) where we use our username, type our password and then press the YubiKey button, herewith an example: Username: davidh Password: secretcccccct00001krbhnvrjrdlujuujdcjvltdcrdkhhtit This method requires PAP, as we require the client to transmit the entered credentials, so that we can cut the information in to a password and Yubico OTP. The alternative is to make use of the YubiKey's public ID to lookup the AD username. This method works for PAP and allows MS-CHAP v2 authentication, herewith an example: Username: cccccct00001krbhnvrjrdlujuujdcjvltdcrdkhhtit Password: secret In the second case we type out password out and then press the YubiKey when prompted for the username. Devices we were authenticating to are generally switches and routers where we can transmit attributes as part of the access accept message to grant eg access permissions. Some platforms however (eg Check Point Management and VyOS) require user accounts to be defined, in those cases you are stuck with PAP being the only possible integration. PS: All is not lost, if you implement a jump host that you enforce MFA access to, which in turn simply uses single factor. Additional detail on the Yubico OTP is available directly from Yubico: https://developers.yubico.com/OTP/OTPs_Explained.html The following notes pertain to a Debian buster (10) install, they would require path changes but should in essence work on any Linux distribution. Join system to Active Directory: apt-get install libnss-winbind samba winbind; pico /etc/krb5.conf [libdefaults] default_realm = AD.ACME.COM dns_lookup_realm = false dns_lookup_kdc = true pico /etc/samba/smb.conf [---------------------------------------- /etc/samba/smb.conf ----------------------------------------] [global] server role = member server workgroup = ACME realm = ad.acme.com netbios name = FreeRADIUS1 server string = FreeRADIUS and Yubico OTP bind interfaces only = yes interfaces = 127.0.0.1/8 192.168.1.48/24 ntlm auth = mschapv2-and-ntlmv2-only guest account = nobody idmap cache time = 300 kerberos method = system keytab idmap config * : backend = tdb idmap config * : range = 100001-120000 idmap config Domain-01 : backend = rid idmap config Domain-01 : range = 1000-100000 template homedir = /home/users/%U template shell = /sbin/nologin log level = 2 log file = /var/log/samba/%m.log enable core files = no max log size = 50 dont descend = /dev, /mirror, /proc time server = no wins support = no map acl inherit = yes store dos attributes = yes printing = cups cups options = raw winbind use default domain = yes winbind enum users = yes winbind enum groups = yes winbind expand groups = 2 [nobody] path = /dev/null comment = Access denied - Guest guest ok = no printable = no browseable = no [---------------------------------------- /etc/samba/smb.conf ----------------------------------------] net ads join -U adm-domain-davidh; systemctl restart smbd; pico /etc/nsswitch.conf; # Append 'winbind' to 'passwd' and 'group' Check winbind and ntlm_auth authentication are working: wbinfo -t ntlm_auth --allow-mschapv2 --request-nt-key --domain=ACME --username=davidh pico /etc/group /etc/gshadow # Add 'freerad' to 'winbindd_priv:' Finally check that you are able to retrieve users and groups as if they were local users: getent passwd davidh getent group client_cpe_admin Install FreeRADIUS with the YubiKey module: apt-get install freeradius-yubikey If necessary set shortname on defined clients to apply different AD group membership or altering what reply attributes are sent back /etc/freeradius/3.0/clients.conf # Hash out existing active lines, then append: client fw1.acme.com { ipaddr = 192.168.10.1 secret = **************** require_message_authenticator = yes nastype = other shortname = checkpoint } client switch6.acme.com { ipaddr = 192.168.20.7 secret = **************** require_message_authenticator = yes nastype = cisco shortname = client_cpe } Define custom attributes: /etc/freeradius/3.0/dictionary.custom ATTRIBUTE sAMAccountName 3000 string ATTRIBUTE Original-User-Name 3001 string Sample Livingston style users file, in this case for use with MikroTik RouterOS, make as many as you need with whatever reply attributes you require: /etc/freeradius/3.0/users DEFAULT FreeRADIUS-Client-Shortname == "client_cpe", Group == "client_cpe_view" Mikrotik-Group = "view" DEFAULT FreeRADIUS-Client-Shortname == "client_cpe", Group == "client_cpe_admin" Mikrotik-Group = "full" DEFAULT FreeRADIUS-Client-Shortname == "client_cpe", Auth-Type := Reject Reply-Message = "Access Denied - Not a member of any client_cpe security groups" DEFAULT Auth-Type := Reject Reply-Message = "Access Denied" Edit MS-CHAP v2 module to use winbind and alter the username: /etc/freeradius/3.0/mods-available/mschap winbind_username = "%{%{sAMAccountName}:-%{mschap:User-Name}}" winbind_domain = "%{mschap:NT-Domain}" Add 'allow-mschapv2' and again change the username expansion variable: /etc/freeradius/3.0/mods-available/ntlm_auth program = "/usr/bin/ntlm_auth --allow-mschapv2 --request-nt-key --domain=DOMAIN-01 --username=%{%{sAMAccountName}:-%{mschap:User-Name}} --password=%{User-Password}" Register for a Yubico API integration account and then enable and configure the module: cd /etc/freeradius/3.0/mods-enabled; ln -s ../mods-available/yubikey yubikey; /etc/freeradius/3.0/mods-enabled/yubikey validate = yes client_id = ***** api_key = '****************************' The following changes are all in /etc/freeradius/3.0/sites-available/default Hash out 'pap', we'll force NTLMv2 by obtaining a hash of the password hash from AD with each authentication request and perform necessary operations on the plain text password we receive as part of the request After 'preprocess' in 'authorize {' if (&User-Name =~ /^([cbdefghijklnrtuv]{44})$/) { update request {Yubikey-OTP = "%{1}"} } elsif (&User-Password =~ /^(.+?)([cbdefghijklnrtuv]{44})$/) { update request {User-Password := "%{1}", Yubikey-OTP = "%{2}"} } if (&Yubikey-OTP =~ /^([cbdefghijklnrtuv]{12})/) { switch "%{1}" { case cccccct00001 {update request {sAMAccountName = "davidh"}} case cccccct00002 {update request {sAMAccountName = "philipo"}} } if (!&sAMAccountName || (&User-Name != &Yubikey-OTP && &User-Name != &sAMAccountName)) { update reply {Reply-Message := "Unregistered or user mismatch"} reject } } Before and after 'files' in 'authorize {' update request {FreeRADIUS-Client-Shortname = "%{Client-Shortname}"} if (&sAMAccountName && &User-Name != &sAMAccountName) { update request { Original-User-Name := "%{User-Name}", User-Name := "%{sAMAccountName}"}} files if (&Original-User-Name) {update request {User-Name := "%{Original-User-Name}"}} End of 'authorize {' if (&control:Auth-Type == "mschap") { if (&Yubikey-OTP) { update control {Auth-Type := "YubiCHAP"} } else {update control {Auth-Type := "MS-CHAP"}} if (!control:Auth-Type && User-Password) { if (&Yubikey-OTP) { update control {Auth-Type := "YubiNTLM"} } else {update control {Auth-Type := "ntlm_auth"}} } Exclusively have the following in 'authenticate {' Auth-Type MS-CHAP { mschap } Auth-Type YubiCHAP { mschap yubikey } Auth-Type ntlm_auth { ntlm_auth } Auth-Type YubiNTLM { ntlm_auth yubikey } Beginning of 'post-auth {' if (&sAMAccountName && &User-Name != &sAMAccountName) {update request {User-Name := "%{sAMAccountName}"}} Beginning of 'Post-Auth-Type REJECT {' if (&sAMAccountName && &User-Name == &Yubikey-OTP) {update request {User-Name := "%{sAMAccountName}"}} Herewith all active lines, as a comparative to where you've ended up: [---------------------------------------- grep -v '^\s*#\|^\s*$' /etc/freeradius/3.0/sites-enabled/default ----------------------------------------] server default { listen { type = auth ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipaddr = * port = 0 type = acct limit { } } listen { type = auth ipv6addr = :: # any. ::1 == localhost port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { ipv6addr = :: port = 0 type = acct limit { } } authorize { filter_username preprocess if (&User-Name =~ /^([cbdefghijklnrtuv]{44})$/) { update request {Yubikey-OTP = "%{1}"} } elsif (&User-Password =~ /^(.+?)([cbdefghijklnrtuv]{44})$/) { update request {User-Password := "%{1}", Yubikey-OTP = "%{2}"} } if (&Yubikey-OTP =~ /^([cbdefghijklnrtuv]{12})/) { switch "%{1}" { case cccccct0001 {update request {sAMAccountName = "davidh"}} case cccccct0002 {update request {sAMAccountName = "philipo"}} } if (!&sAMAccountName || (&User-Name != &Yubikey-OTP && &User-Name != &sAMAccountName)) { update reply {Reply-Message := "Unregistered or user missmatch"} reject } } chap mschap digest suffix eap { ok = return } update request {FreeRADIUS-Client-Shortname = "%{Client-Shortname}"} if (&sAMAccountName && &User-Name != &sAMAccountName) { update request { Original-User-Name := "%{User-Name}", User-Name := "%{sAMAccountName}"}} files if (&Original-User-Name) {update request {User-Name := "%{Original-User-Name}"}} -sql -ldap expiration logintime if (&control:Auth-Type == "mschap") { if (&Yubikey-OTP) { update control {Auth-Type := "YubiCHAP"} } else {update control {Auth-Type := "MS-CHAP"}} } if (!control:Auth-Type && User-Password) { if (&Yubikey-OTP) { update control {Auth-Type := "YubiNTLM"} } else {update control {Auth-Type := "ntlm_auth"}} } } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type YubiCHAP { mschap yubikey } Auth-Type ntlm_auth { ntlm_auth } Auth-Type YubiNTLM { ntlm_auth yubikey } } preacct { preprocess acct_unique suffix files } accounting { detail unix -sql exec attr_filter.accounting_response } session { } post-auth { if (&sAMAccountName && &User-Name != &sAMAccountName) {update request {User-Name := "%{sAMAccountName}"}} update { &reply: += &session-state: } -sql exec remove_reply_message_if_eap Post-Auth-Type REJECT { if (&sAMAccountName && &User-Name == &Yubikey-OTP) {update request {User-Name := "%{sAMAccountName}"}} -sql attr_filter.access_reject eap remove_reply_message_if_eap } Post-Auth-Type Challenge { } } pre-proxy { } post-proxy { eap } } [---------------------------------------- grep -v '^\s*#\|^\s*$' /etc/freeradius/3.0/sites-enabled/default ----------------------------------------] NB: Once everyone has a YubiKey hash out the single factor authenticate options (Auth-Type MS-CHAP and Auth-Type ntlm_auth) methods or update unlang to exempt 2FA from jump hosts or NMS. Unvalidated idea for users file: DEFAULT Yubikey-OTP !* "", Packet-Src-IP-Address !~ /192\.168\.14\./, Auth-Type := Reject Reply-Message = "Access Denied - 2FA required" Regards David Herselman

2 3

Remove from FreeRadius users mailing list
by YewFong.Chua＠fujitsu.com 23 Feb '21

23 Feb '21

Hi FreeRadius support, I would like to remove my email account from the mailing list as I am being spam by email non-related by other users. Regards, Yew Fong Off-in-Lieu Planning: Nil Annual Leave Planning: 5th, 12th, 19th, 25th and 26th Mar 2021 National Reservist Leave 23rd Apr to 6th May 2021 Fujitsu Asia Pte Ltd Nexus @One-North 1 Fusionopolis Link, #04-01 Singapore 138542 DID: +65 6512 7525 Mobile: +65 9794 6548 E-mail: yewfong.chua(a)fujitsu.com<mailto:yewfong.chua@fujitsu.com> Web: http://sg.fujitsu.com<http://sg.fujitsu.com/> | LinkedIn: www.linkedin.com/company/fujitsu-asia<http://www.linkedin.com/company/fujitsu-asia>

2 1

LDAP attribute update for clients
by DEV 22 Feb '21

22 Feb '21

Hi! Is it possible to configure FR to write the last authentication attempt from a client (NAS) to LDAP? For users I can set this: https://bitbucket.org/code-orange/django-cdstack-tpl-accessradius/src/cad14… Is there something similar for the clients? I'm interested in the same attribute update to see which clients are dead. Thank you. Kind regards Kevin

2 3

Masquerading MSCHAPv2 User-Name?
by David Herselman 20 Feb '21

20 Feb '21

Hi, We unfortunately have network devices which exclusively support MSCHAPv2 but have had excellent success using freeradius 3.0.17 with Samba Winbind. I presume freeRADIUS has built-in support to masquerade the presented username, as the mschap config file references the following: winbind_username = "%{mschap:User-Name}" winbind_domain = "%{mschap:NT-Domain}" I'm aware of MS-CHAPv2 proving knowledge of the password and previously assumed that it only applied to the password hash exchanges. My Google-Fo however lead me to an article titled Understanding PEAP In-Depth, where values initiators and radius generate is summarised as: Initiator: AuthenticatorChallenge = b''.fromhex('f5 b8 ad ee e9 ff 08 15 dd 83 e8 2d 89 6e eb 2a') PeerChallenge = b''.fromhex('e3 32 bf 8e c5 37 e5 72 1d 0d 9a 0e e4 40 46 d6') chap = MSCHAPV2(UserName, Password, AuthenticatorChallenge, PeerChallenge) PasswordHash = chap.NtPasswordHash(Password) Challenge = chap.ChallengeHash(PeerChallenge, AuthenticatorChallenge, UserName) NTResponse = chap.ChallengeResponse(Challenge, PasswordHash) print ('Challenge : '+Challenge.hex()) print ('NTResponse: '+NTResponse.hex()) radius: AuthenticatorChallenge = b''.fromhex('f5 b8 ad ee e9 ff 08 15 dd 83 e8 2d 89 6e eb 2a') PeerChallenge = b''.fromhex('e3 32 bf 8e c5 37 e5 72 1d 0d 9a 0e e4 40 46 d6') chap = MSCHAPV2(UserName, Password, AuthenticatorChallenge, PeerChallenge) NTResponse = b''.fromhex('6c da db 80 dd 53 10 b8 05 f2 a0 da 9b b4 5e ad 51 ee 65 34 4c 95 e6 00') PasswordHash = chap.NtPasswordHash(Password) AuthenticatorResponse = chap.GenerateAuthenticatorResponse(Password, NTResponse, PeerChallenge, AuthenticatorChallenge, UserName) print('Authenticator Response: ' + AuthenticatorResponse) I presume FR generates the AuthenticatorResponse after obtaining the NTResponse from winbind, after feeding it winbind_username? If that is the case, would it be feasible to replace winbind_username and have FR handle all the wizardry? I'd like to essentially transform a MSCHAPv2 client using USERNAME/PASSWORD to winbind authenticating this as USER2/PASSWORD. Why? I was hoping to implement 2FA by using my AD password as per normal, only replacing my username with the 44 char string that a YubiKey touch operation spits out via the USB HID keyboard. The prefix of this string is a globally unique 12 character fixed ID, unique to each key. This way I could lookup the username prefix in a file and then set winbind_username as the AD account name that key belong to. Thought process was to reject requests were the prefix wasn't found, then authenticate to AD using the username we looked up, check group membership and finally validate the Yubico OTP (the username supplied originally) against YubiCo validation servers. [cid:image001.png@01D703BA.131606D0] References: * Understanding PEAP In-Depth https://sensepost.com/blog/2019/understanding-peap-in-depth/ * Yubico OTPs Explained https://developers.yubico.com/OTP/OTPs_Explained.html Regards David Herselman

2 12

Anamoly in TLS Session Resumption
by Doug Wussler 19 Feb '21

19 Feb '21

We are using FreeRADIUS Version 3.0.20. I have an anamoly in TLS Session Resumption using a Windows 10 laptop. I have not been able to reproduce this using other clients. While this appears to be bad behavior by Windows, I'm also asking if this unexpected supplicant behavior might reveal some undesirable behavior on the part of freeradius. I deleted all TLS session cache records and restarted the server. In packet (2) you see the supplicant request a cached session, which is not found, so a full authentication takes place in packets (1) through (10). I then "forget" the network on the client, which I would expect would also delete any record of a previous TLS session, and then I reauthenticate to the network, which requires entering a username/password (but, sadly, does not require me to trust the server's certificate). At this point I would expect to see a full re-auth but in packet (13) you see the supplicant request a cached session, which is found and restored. In packet (14) the server declares a successful session resumption on its end and sends an Access-Challenge. But in packet (15) we then see: eap_peap: Client rejected our response. The password is probably incorrect eap_peap: Client rejected session resumption. Re-starting full authentication We then proceed through the inner-tunnel and do the full re-auth but we are still using the resumed session ID along with the attributes cached from that session. In the final packet (19), we see "&request:EAP-Session-Resumed := 1" This all came to my attention because I was originally using Cached-Session-Policy with the += operator. I ended up with duplicate session-state entries for Cached-Session-Policy, and, when that policy happened to change between authentications, one of those Cached-Session-Policy values was wrong. We can't do anything about the bad Windows behavior, but do you consider it appropriate for freeradius to handle a rejected session resumption this way? Doug (1) Received Access-Request Id 64 from w.x.y.z:54989 to a.b.c.e:1812 length 201 (1) User-Name = "myUsername" (1) NAS-IP-Address = a.b.c.d (1) NAS-Port = 0 (1) NAS-Identifier = "w.x.y.z" (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = "Calling-MAC" (1) Called-Station-Id = "Called-MAC" (1) Service-Type = Framed-User (1) Framed-MTU = 1100 (1) EAP-Message = 0x0201000d016d616e74686f6e79 (1) Aruba-Essid-Name = "FSUCoreX" (1) Aruba-Location-Id = "303H-mark" (1) Aruba-AP-Group = "RAP-VoIP" (1) Aruba-Device-Type = "Win 10" (1) Message-Authenticator = 0x68c94109b228a1962fd060c64c8863cb (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (1) authorize { (1) fsu-bad-passwords: EXPAND %{User-Name} (1) fsu-bad-passwords: --> myUsername (1) [fsu-bad-passwords] = noop (1) if (ok) { (1) if (ok) -> FALSE (1) policy rewrite_calling_station_id { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (1) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (1) update request { (1) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (1) --> Calling-MAC (1) } # update request = noop (1) [updated] = updated (1) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (1) ... skipping else: Preceding "if" was taken (1) } # policy rewrite_calling_station_id = updated (1) fsu-bad-macs: EXPAND %{Calling-Station-ID} (1) fsu-bad-macs: --> Calling-MAC (1) [fsu-bad-macs] = noop (1) if (ok) { (1) if (ok) -> FALSE (1) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (1) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (1) if (&User-Name =~ /^host\//) { (1) if (&User-Name =~ /^host\//) -> FALSE (1) if ( &User-Name =~ /\s/ ) { (1) if ( &User-Name =~ /\s/ ) -> FALSE (1) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (1) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (1) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (1) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (1) if ( &User-Name =~ /(a)my\.fsu$/i ) { (1) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (1) ntdomain: Checking for prefix before "\" (1) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (1) [ntdomain] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (1) suffix: Found realm "NULL" (1) suffix: Adding Stripped-User-Name = "myUsername" (1) suffix: Adding Realm = "NULL" (1) suffix: Authentication realm is LOCAL (1) [suffix] = ok (1) update request { (1) } # update request = noop (1) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (1) fsu-rsa-macs: --> Calling-MAC (1) [fsu-rsa-macs] = noop (1) if (ok) { (1) if (ok) -> FALSE (1) else { (1) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (1) fsu-rsa-atwpa-aruba: --> FSUCoreX (1) [fsu-rsa-atwpa-aruba] = noop (1) if (ok) { (1) if (ok) -> FALSE (1) else { (1) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (1) fsu-rsa-atwpa-cisco: --> (1) [fsu-rsa-atwpa-cisco] = noop (1) if (ok) { (1) if (ok) -> FALSE (1) } # else = noop (1) } # else = noop (1) if (&request:Hint == "RSA") { (1) if (&request:Hint == "RSA") -> FALSE (1) else { (1) fsu-eap: Peer sent EAP Response (code 2) ID 1 length 13 (1) fsu-eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [fsu-eap] = ok (1) } # else = ok (1) } # authorize = ok (1) Found Auth-Type = fsu-eap (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (1) Auth-Type fsu-eap { (1) fsu-eap: Peer sent packet with method EAP Identity (1) (1) fsu-eap: Calling submodule eap_peap to process data (1) eap_peap: Initiating new TLS session (1) eap_peap: [eaptls start] = request (1) fsu-eap: Sending EAP Request (code 1) ID 2 length 6 (1) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bbad1e41c (1) [fsu-eap] = handled (1) } # Auth-Type fsu-eap = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 64 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (1) EAP-Message = 0x010200061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xbad3fd1bbad1e41c1c1cd17260df3cc0 (1) Finished request (2) Received Access-Request Id 65 from w.x.y.z:54989 to a.b.c.e:1812 length 410 (2) User-Name = "myUsername" (2) NAS-IP-Address = a.b.c.d (2) NAS-Port = 0 (2) NAS-Identifier = "w.x.y.z" (2) NAS-Port-Type = Wireless-802.11 (2) Calling-Station-Id = "Calling-MAC" (2) Called-Station-Id = "Called-MAC" (2) Service-Type = Framed-User (2) Framed-MTU = 1100 (2) EAP-Message = 0x020200cc1980000000c216030300bd010000b90303602ed1269d888ec609f78e833194c064fd67012fbf825e56a50a8f228ad5760620478d25582f53a1dd580e9752f084466abf68961ab46bd12bc4085e1601e959cb002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000046000500050100000000000a00080006001d00170018000b00020100000d001a00180804080508060401050102010403050302030202060106030023000000170000ff01000100 (2) State = 0xbad3fd1bbad1e41c1c1cd17260df3cc0 (2) Aruba-Essid-Name = "FSUCoreX" (2) Aruba-Location-Id = "303H-mark" (2) Aruba-AP-Group = "RAP-VoIP" (2) Aruba-Device-Type = "Win 10" (2) Message-Authenticator = 0x018d8b6ea89b296c73c9cdd13c86ffdc (2) session-state: No cached attributes (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (2) authorize { (2) fsu-bad-passwords: EXPAND %{User-Name} (2) fsu-bad-passwords: --> myUsername (2) [fsu-bad-passwords] = noop (2) if (ok) { (2) if (ok) -> FALSE (2) policy rewrite_calling_station_id { (2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (2) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (2) update request { (2) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (2) --> Calling-MAC (2) } # update request = noop (2) [updated] = updated (2) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (2) ... skipping else: Preceding "if" was taken (2) } # policy rewrite_calling_station_id = updated (2) fsu-bad-macs: EXPAND %{Calling-Station-ID} (2) fsu-bad-macs: --> Calling-MAC (2) [fsu-bad-macs] = noop (2) if (ok) { (2) if (ok) -> FALSE (2) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (2) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (2) if (&User-Name =~ /^host\//) { (2) if (&User-Name =~ /^host\//) -> FALSE (2) if ( &User-Name =~ /\s/ ) { (2) if ( &User-Name =~ /\s/ ) -> FALSE (2) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (2) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (2) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (2) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (2) if ( &User-Name =~ /(a)my\.fsu$/i ) { (2) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (2) ntdomain: Checking for prefix before "\" (2) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (2) [ntdomain] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (2) suffix: Found realm "NULL" (2) suffix: Adding Stripped-User-Name = "myUsername" (2) suffix: Adding Realm = "NULL" (2) suffix: Authentication realm is LOCAL (2) [suffix] = ok (2) update request { (2) } # update request = noop (2) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (2) fsu-rsa-macs: --> Calling-MAC (2) [fsu-rsa-macs] = noop (2) if (ok) { (2) if (ok) -> FALSE (2) else { (2) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (2) fsu-rsa-atwpa-aruba: --> FSUCoreX (2) [fsu-rsa-atwpa-aruba] = noop (2) if (ok) { (2) if (ok) -> FALSE (2) else { (2) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (2) fsu-rsa-atwpa-cisco: --> (2) [fsu-rsa-atwpa-cisco] = noop (2) if (ok) { (2) if (ok) -> FALSE (2) } # else = noop (2) } # else = noop (2) if (&request:Hint == "RSA") { (2) if (&request:Hint == "RSA") -> FALSE (2) else { (2) fsu-eap: Peer sent EAP Response (code 2) ID 2 length 204 (2) fsu-eap: Continuing tunnel setup (2) [fsu-eap] = ok (2) } # else = ok (2) } # authorize = ok (2) Found Auth-Type = fsu-eap (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (2) Auth-Type fsu-eap { (2) fsu-eap: Expiring EAP session with state 0xbad3fd1bbad1e41c (2) fsu-eap: Finished EAP session with state 0xbad3fd1bbad1e41c (2) fsu-eap: Previous EAP request found for state 0xbad3fd1bbad1e41c, released from the list (2) fsu-eap: Peer sent packet with method EAP PEAP (25) (2) fsu-eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 194 bytes (2) eap_peap: Got complete TLS record (194 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: Peer requested cached session: 478d25582f53a1dd580e9752f084466abf68961ab46bd12bc4085e1601e959cb (2) : eap_peap: No persisted session file /var/log/radius/tlscache/478d25582f53a1dd580e9752f084466abf68961ab46bd12bc4085e1601e959cb.asn1: No such file or directory (2) eap_peap: TLS_accept: SSLv3/TLS read client hello (2) eap_peap: TLS_accept: SSLv3/TLS write server hello (2) eap_peap: TLS_accept: SSLv3/TLS write certificate (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange (2) eap_peap: TLS_accept: SSLv3/TLS write server done (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (2) eap_peap: TLS - In Handshake Phase (2) eap_peap: TLS - got 2767 bytes of data (2) eap_peap: [eaptls process] = handled (2) fsu-eap: Sending EAP Request (code 1) ID 3 length 1024 (2) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bbbd0e41c (2) [fsu-eap] = handled (2) } # Auth-Type fsu-eap = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 65 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (2) EAP-Message = 0x0103040019c000000acf160303005d020000590303931ef82c320593388fd052f008b384446eb7d423cfa3d8be2f14ff3355cca4b620422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5cc02b000011ff01000100000b0004030001020017000016030309c50b0009c10009be00060630820602308205a7a003020102021026a74309e2eaafaf31ae5776e74c05d3300a06082a8648ce3d040302308195310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f726431183016060355040a130f5365637469676f204c696d69746564313d303b060355040313345365637469676f20454343204f7267616e697a6174696f6e2056616c69646174696f6e2053656375726520536572766572204341301e170d3230303830333030303030305a170d3232303830333233353935395a30820103310b3009060355040613025553310e300c06035504 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xbad3fd1bbbd0e41c1c1cd17260df3cc0 (2) Finished request (3) Received Access-Request Id 66 from w.x.y.z:54989 to a.b.c.e:1812 length 212 (3) User-Name = "myUsername" (3) NAS-IP-Address = a.b.c.d (3) NAS-Port = 0 (3) NAS-Identifier = "w.x.y.z" (3) NAS-Port-Type = Wireless-802.11 (3) Calling-Station-Id = "Calling-MAC" (3) Called-Station-Id = "Called-MAC" (3) Service-Type = Framed-User (3) Framed-MTU = 1100 (3) EAP-Message = 0x020300061900 (3) State = 0xbad3fd1bbbd0e41c1c1cd17260df3cc0 (3) Aruba-Essid-Name = "FSUCoreX" (3) Aruba-Location-Id = "303H-mark" (3) Aruba-AP-Group = "RAP-VoIP" (3) Aruba-Device-Type = "Win 10" (3) Message-Authenticator = 0x989102d3ae927fa2abce294f1cc7210d (3) session-state: No cached attributes (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (3) authorize { (3) fsu-bad-passwords: EXPAND %{User-Name} (3) fsu-bad-passwords: --> myUsername (3) [fsu-bad-passwords] = noop (3) if (ok) { (3) if (ok) -> FALSE (3) policy rewrite_calling_station_id { (3) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (3) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (3) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (3) update request { (3) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (3) --> Calling-MAC (3) } # update request = noop (3) [updated] = updated (3) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (3) ... skipping else: Preceding "if" was taken (3) } # policy rewrite_calling_station_id = updated (3) fsu-bad-macs: EXPAND %{Calling-Station-ID} (3) fsu-bad-macs: --> Calling-MAC (3) [fsu-bad-macs] = noop (3) if (ok) { (3) if (ok) -> FALSE (3) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (3) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (3) if (&User-Name =~ /^host\//) { (3) if (&User-Name =~ /^host\//) -> FALSE (3) if ( &User-Name =~ /\s/ ) { (3) if ( &User-Name =~ /\s/ ) -> FALSE (3) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (3) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (3) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (3) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (3) if ( &User-Name =~ /(a)my\.fsu$/i ) { (3) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (3) ntdomain: Checking for prefix before "\" (3) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (3) [ntdomain] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (3) suffix: Found realm "NULL" (3) suffix: Adding Stripped-User-Name = "myUsername" (3) suffix: Adding Realm = "NULL" (3) suffix: Authentication realm is LOCAL (3) [suffix] = ok (3) update request { (3) } # update request = noop (3) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (3) fsu-rsa-macs: --> Calling-MAC (3) [fsu-rsa-macs] = noop (3) if (ok) { (3) if (ok) -> FALSE (3) else { (3) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (3) fsu-rsa-atwpa-aruba: --> FSUCoreX (3) [fsu-rsa-atwpa-aruba] = noop (3) if (ok) { (3) if (ok) -> FALSE (3) else { (3) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (3) fsu-rsa-atwpa-cisco: --> (3) [fsu-rsa-atwpa-cisco] = noop (3) if (ok) { (3) if (ok) -> FALSE (3) } # else = noop (3) } # else = noop (3) if (&request:Hint == "RSA") { (3) if (&request:Hint == "RSA") -> FALSE (3) else { (3) fsu-eap: Peer sent EAP Response (code 2) ID 3 length 6 (3) fsu-eap: Continuing tunnel setup (3) [fsu-eap] = ok (3) } # else = ok (3) } # authorize = ok (3) Found Auth-Type = fsu-eap (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (3) Auth-Type fsu-eap { (3) fsu-eap: Expiring EAP session with state 0xbad3fd1bbbd0e41c (3) fsu-eap: Finished EAP session with state 0xbad3fd1bbbd0e41c (3) fsu-eap: Previous EAP request found for state 0xbad3fd1bbbd0e41c, released from the list (3) fsu-eap: Peer sent packet with method EAP PEAP (25) (3) fsu-eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) fsu-eap: Sending EAP Request (code 1) ID 4 length 1020 (3) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bb8d7e41c (3) [fsu-eap] = handled (3) } # Auth-Type fsu-eap = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 66 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (3) EAP-Message = 0x010403fc194006082b060105050730028649687474703a2f2f6372742e7365637469676f2e636f6d2f5365637469676f4543434f7267616e697a6174696f6e56616c69646174696f6e53656375726553657276657243412e637274302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d3082017e060a2b06010401d6790204020482016e0482016a016800760046a555eb75fa912030b5a28969f4f37d112c4174befd49b885abf2fc70fe6d4700000173b4480f2d00000403004730450220289e527367d0857731154954f296721f9f37ef06d36eda0b0710dab4c3ca2fd2022100e212a014409ae8c4ba4f407a7070e714b2e7659f80a65af2a53ef9f39e06ccad007500dfa55eab68824f1f6cadeeb85f4e3e5aeacda212a46a5e8e3b12c020445c2a7300000173b4480f5e000004030046304402201c27dade36cab76fc20bd7888116d1c28e29360f798cc1141dc8562e857b509a02207b5c44654ee0a9c94e1390763ca3 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xbad3fd1bb8d7e41c1c1cd17260df3cc0 (3) Finished request (4) Received Access-Request Id 67 from w.x.y.z:54989 to a.b.c.e:1812 length 212 (4) User-Name = "myUsername" (4) NAS-IP-Address = a.b.c.d (4) NAS-Port = 0 (4) NAS-Identifier = "w.x.y.z" (4) NAS-Port-Type = Wireless-802.11 (4) Calling-Station-Id = "Calling-MAC" (4) Called-Station-Id = "Called-MAC" (4) Service-Type = Framed-User (4) Framed-MTU = 1100 (4) EAP-Message = 0x020400061900 (4) State = 0xbad3fd1bb8d7e41c1c1cd17260df3cc0 (4) Aruba-Essid-Name = "FSUCoreX" (4) Aruba-Location-Id = "303H-mark" (4) Aruba-AP-Group = "RAP-VoIP" (4) Aruba-Device-Type = "Win 10" (4) Message-Authenticator = 0x3698f3bc788ccfe70c7c1b09e167ff81 (4) session-state: No cached attributes (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (4) authorize { (4) fsu-bad-passwords: EXPAND %{User-Name} (4) fsu-bad-passwords: --> myUsername (4) [fsu-bad-passwords] = noop (4) if (ok) { (4) if (ok) -> FALSE (4) policy rewrite_calling_station_id { (4) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (4) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (4) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (4) update request { (4) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (4) --> Calling-MAC (4) } # update request = noop (4) [updated] = updated (4) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (4) ... skipping else: Preceding "if" was taken (4) } # policy rewrite_calling_station_id = updated (4) fsu-bad-macs: EXPAND %{Calling-Station-ID} (4) fsu-bad-macs: --> Calling-MAC (4) [fsu-bad-macs] = noop (4) if (ok) { (4) if (ok) -> FALSE (4) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (4) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (4) if (&User-Name =~ /^host\//) { (4) if (&User-Name =~ /^host\//) -> FALSE (4) if ( &User-Name =~ /\s/ ) { (4) if ( &User-Name =~ /\s/ ) -> FALSE (4) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (4) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (4) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (4) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (4) if ( &User-Name =~ /(a)my\.fsu$/i ) { (4) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (4) ntdomain: Checking for prefix before "\" (4) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (4) [ntdomain] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (4) suffix: Found realm "NULL" (4) suffix: Adding Stripped-User-Name = "myUsername" (4) suffix: Adding Realm = "NULL" (4) suffix: Authentication realm is LOCAL (4) [suffix] = ok (4) update request { (4) } # update request = noop (4) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (4) fsu-rsa-macs: --> Calling-MAC (4) [fsu-rsa-macs] = noop (4) if (ok) { (4) if (ok) -> FALSE (4) else { (4) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (4) fsu-rsa-atwpa-aruba: --> FSUCoreX (4) [fsu-rsa-atwpa-aruba] = noop (4) if (ok) { (4) if (ok) -> FALSE (4) else { (4) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (4) fsu-rsa-atwpa-cisco: --> (4) [fsu-rsa-atwpa-cisco] = noop (4) if (ok) { (4) if (ok) -> FALSE (4) } # else = noop (4) } # else = noop (4) if (&request:Hint == "RSA") { (4) if (&request:Hint == "RSA") -> FALSE (4) else { (4) fsu-eap: Peer sent EAP Response (code 2) ID 4 length 6 (4) fsu-eap: Continuing tunnel setup (4) [fsu-eap] = ok (4) } # else = ok (4) } # authorize = ok (4) Found Auth-Type = fsu-eap (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (4) Auth-Type fsu-eap { (4) fsu-eap: Expiring EAP session with state 0xbad3fd1bb8d7e41c (4) fsu-eap: Finished EAP session with state 0xbad3fd1bb8d7e41c (4) fsu-eap: Previous EAP request found for state 0xbad3fd1bb8d7e41c, released from the list (4) fsu-eap: Peer sent packet with method EAP PEAP (25) (4) fsu-eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer ACKed our handshake fragment (4) eap_peap: [eaptls verify] = request (4) eap_peap: [eaptls process] = handled (4) fsu-eap: Sending EAP Request (code 1) ID 5 length 745 (4) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bb9d6e41c (4) [fsu-eap] = handled (4) } # Auth-Type fsu-eap = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 67 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (4) EAP-Message = 0x010502e9190006072a8648ce3d020106082a8648ce3d030107034200049c8e5c0a616fa158a3d0d5cefafc44f9ffba061e7b161a721f42d30ab266cdfb0f4972214d27b1afdd873a5cfe687aa8184d2f49efc24b02c5a16719f16d6339a382016e3082016a301f0603551d230418301680143ae10986d4cf19c29676744976dce035c663639a301d0603551d0e041604144d4aefc446b312ad4f4e9ab159e251ab08107808300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737445434343657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b0601050507300286336874 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xbad3fd1bb9d6e41c1c1cd17260df3cc0 (4) Finished request (5) Received Access-Request Id 68 from w.x.y.z:54989 to a.b.c.e:1812 length 342 (5) User-Name = "myUsername" (5) NAS-IP-Address = a.b.c.d (5) NAS-Port = 0 (5) NAS-Identifier = "w.x.y.z" (5) NAS-Port-Type = Wireless-802.11 (5) Calling-Station-Id = "Calling-MAC" (5) Called-Station-Id = "Called-MAC" (5) Service-Type = Framed-User (5) Framed-MTU = 1100 (5) EAP-Message = 0x0205008819800000007e16030300461000004241044d601518295cc957a589f6af50ba6fdb09db67090661cc9d393bd8adac0306fabec728fd8d3a566e56b18258956648fc03ddd2cba0d449d5c8f707dd63984fbb14030300010116030300280000000000000000e4ed788d8b79fbf52f838b98a845ffe9a50b58bbef917334728f28828c245327 (5) State = 0xbad3fd1bb9d6e41c1c1cd17260df3cc0 (5) Aruba-Essid-Name = "FSUCoreX" (5) Aruba-Location-Id = "303H-mark" (5) Aruba-AP-Group = "RAP-VoIP" (5) Aruba-Device-Type = "Win 10" (5) Message-Authenticator = 0x249cb5193fd1494a9d8b9912fa5af320 (5) session-state: No cached attributes (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (5) authorize { (5) fsu-bad-passwords: EXPAND %{User-Name} (5) fsu-bad-passwords: --> myUsername (5) [fsu-bad-passwords] = noop (5) if (ok) { (5) if (ok) -> FALSE (5) policy rewrite_calling_station_id { (5) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (5) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (5) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (5) update request { (5) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (5) --> Calling-MAC (5) } # update request = noop (5) [updated] = updated (5) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (5) ... skipping else: Preceding "if" was taken (5) } # policy rewrite_calling_station_id = updated (5) fsu-bad-macs: EXPAND %{Calling-Station-ID} (5) fsu-bad-macs: --> Calling-MAC (5) [fsu-bad-macs] = noop (5) if (ok) { (5) if (ok) -> FALSE (5) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (5) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (5) if (&User-Name =~ /^host\//) { (5) if (&User-Name =~ /^host\//) -> FALSE (5) if ( &User-Name =~ /\s/ ) { (5) if ( &User-Name =~ /\s/ ) -> FALSE (5) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (5) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (5) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (5) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (5) if ( &User-Name =~ /(a)my\.fsu$/i ) { (5) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (5) ntdomain: Checking for prefix before "\" (5) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (5) [ntdomain] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (5) suffix: Found realm "NULL" (5) suffix: Adding Stripped-User-Name = "myUsername" (5) suffix: Adding Realm = "NULL" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) update request { (5) } # update request = noop (5) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (5) fsu-rsa-macs: --> Calling-MAC (5) [fsu-rsa-macs] = noop (5) if (ok) { (5) if (ok) -> FALSE (5) else { (5) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (5) fsu-rsa-atwpa-aruba: --> FSUCoreX (5) [fsu-rsa-atwpa-aruba] = noop (5) if (ok) { (5) if (ok) -> FALSE (5) else { (5) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (5) fsu-rsa-atwpa-cisco: --> (5) [fsu-rsa-atwpa-cisco] = noop (5) if (ok) { (5) if (ok) -> FALSE (5) } # else = noop (5) } # else = noop (5) if (&request:Hint == "RSA") { (5) if (&request:Hint == "RSA") -> FALSE (5) else { (5) fsu-eap: Peer sent EAP Response (code 2) ID 5 length 136 (5) fsu-eap: Continuing tunnel setup (5) [fsu-eap] = ok (5) } # else = ok (5) } # authorize = ok (5) Found Auth-Type = fsu-eap (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (5) Auth-Type fsu-eap { (5) fsu-eap: Expiring EAP session with state 0xbad3fd1bb9d6e41c (5) fsu-eap: Finished EAP session with state 0xbad3fd1bb9d6e41c (5) fsu-eap: Previous EAP request found for state 0xbad3fd1bb9d6e41c, released from the list (5) fsu-eap: Peer sent packet with method EAP PEAP (25) (5) fsu-eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer indicated complete TLS record size will be 126 bytes (5) eap_peap: Got complete TLS record (126 bytes) (5) eap_peap: [eaptls verify] = length included (5) eap_peap: TLS_accept: SSLv3/TLS write server done (5) eap_peap: TLS_accept: SSLv3/TLS read client key exchange (5) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (5) eap_peap: TLS_accept: SSLv3/TLS read finished (5) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (5) eap_peap: TLS_accept: SSLv3/TLS write finished (5) eap_peap: Serialising session 422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c, and storing in cache (5) : eap_peap: Wrote session 422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c to /var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1 (149 bytes) (5) eap_peap: (other): SSL negotiation finished successfully (5) eap_peap: TLS - Connection Established (5) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (5) eap_peap: TLS-Session-Version = "TLS 1.2" (5) eap_peap: TLS - got 51 bytes of data (5) eap_peap: [eaptls process] = handled (5) fsu-eap: Sending EAP Request (code 1) ID 6 length 57 (5) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bbed5e41c (5) [fsu-eap] = handled (5) } # Auth-Type fsu-eap = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (5) Challenge { ... } # empty sub-section is ignored (5) session-state: Saving cached attributes (5) TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (5) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (5) TLS-Session-Version = "TLS 1.2" (5) Sent Access-Challenge Id 68 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (5) EAP-Message = 0x0106003919001403030001011603030028b7cf4af33aedeba1fff80ce3d934b51a5d1673ffd272096bc1c0e67566bd54c3d9e98aa7892a05ca (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xbad3fd1bbed5e41c1c1cd17260df3cc0 (5) Finished request (6) Received Access-Request Id 69 from w.x.y.z:54989 to a.b.c.e:1812 length 212 (6) User-Name = "myUsername" (6) NAS-IP-Address = a.b.c.d (6) NAS-Port = 0 (6) NAS-Identifier = "w.x.y.z" (6) NAS-Port-Type = Wireless-802.11 (6) Calling-Station-Id = "Calling-MAC" (6) Called-Station-Id = "Called-MAC" (6) Service-Type = Framed-User (6) Framed-MTU = 1100 (6) EAP-Message = 0x020600061900 (6) State = 0xbad3fd1bbed5e41c1c1cd17260df3cc0 (6) Aruba-Essid-Name = "FSUCoreX" (6) Aruba-Location-Id = "303H-mark" (6) Aruba-AP-Group = "RAP-VoIP" (6) Aruba-Device-Type = "Win 10" (6) Message-Authenticator = 0xa13a4c03acd0a8a3de7fd344f477f378 (6) Restoring &session-state (6) &session-state:TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (6) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (6) &session-state:TLS-Session-Version = "TLS 1.2" (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (6) authorize { (6) fsu-bad-passwords: EXPAND %{User-Name} (6) fsu-bad-passwords: --> myUsername (6) [fsu-bad-passwords] = noop (6) if (ok) { (6) if (ok) -> FALSE (6) policy rewrite_calling_station_id { (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (6) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (6) update request { (6) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (6) --> Calling-MAC (6) } # update request = noop (6) [updated] = updated (6) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (6) ... skipping else: Preceding "if" was taken (6) } # policy rewrite_calling_station_id = updated (6) fsu-bad-macs: EXPAND %{Calling-Station-ID} (6) fsu-bad-macs: --> Calling-MAC (6) [fsu-bad-macs] = noop (6) if (ok) { (6) if (ok) -> FALSE (6) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (6) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (6) if (&User-Name =~ /^host\//) { (6) if (&User-Name =~ /^host\//) -> FALSE (6) if ( &User-Name =~ /\s/ ) { (6) if ( &User-Name =~ /\s/ ) -> FALSE (6) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (6) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (6) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (6) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (6) if ( &User-Name =~ /(a)my\.fsu$/i ) { (6) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (6) ntdomain: Checking for prefix before "\" (6) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (6) [ntdomain] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (6) suffix: Found realm "NULL" (6) suffix: Adding Stripped-User-Name = "myUsername" (6) suffix: Adding Realm = "NULL" (6) suffix: Authentication realm is LOCAL (6) [suffix] = ok (6) update request { (6) } # update request = noop (6) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (6) fsu-rsa-macs: --> Calling-MAC (6) [fsu-rsa-macs] = noop (6) if (ok) { (6) if (ok) -> FALSE (6) else { (6) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (6) fsu-rsa-atwpa-aruba: --> FSUCoreX (6) [fsu-rsa-atwpa-aruba] = noop (6) if (ok) { (6) if (ok) -> FALSE (6) else { (6) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (6) fsu-rsa-atwpa-cisco: --> (6) [fsu-rsa-atwpa-cisco] = noop (6) if (ok) { (6) if (ok) -> FALSE (6) } # else = noop (6) } # else = noop (6) if (&request:Hint == "RSA") { (6) if (&request:Hint == "RSA") -> FALSE (6) else { (6) fsu-eap: Peer sent EAP Response (code 2) ID 6 length 6 (6) fsu-eap: Continuing tunnel setup (6) [fsu-eap] = ok (6) } # else = ok (6) } # authorize = ok (6) Found Auth-Type = fsu-eap (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (6) Auth-Type fsu-eap { (6) fsu-eap: Expiring EAP session with state 0xbad3fd1bbed5e41c (6) fsu-eap: Finished EAP session with state 0xbad3fd1bbed5e41c (6) fsu-eap: Previous EAP request found for state 0xbad3fd1bbed5e41c, released from the list (6) fsu-eap: Peer sent packet with method EAP PEAP (25) (6) fsu-eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer ACKed our handshake fragment. handshake is finished (6) eap_peap: [eaptls verify] = success (6) eap_peap: [eaptls process] = success (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state TUNNEL ESTABLISHED (6) fsu-eap: Sending EAP Request (code 1) ID 7 length 40 (6) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bbfd4e41c (6) [fsu-eap] = handled (6) } # Auth-Type fsu-eap = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (6) Challenge { ... } # empty sub-section is ignored (6) session-state: Saving cached attributes (6) TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (6) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 69 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (6) EAP-Message = 0x010700281900170303001db7cf4af33aedeba2b21f528c211bf694c96d96a9f46043f8a3d4b25e39 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xbad3fd1bbfd4e41c1c1cd17260df3cc0 (6) Finished request (7) Received Access-Request Id 70 from w.x.y.z:54989 to a.b.c.e:1812 length 250 (7) User-Name = "myUsername" (7) NAS-IP-Address = a.b.c.d (7) NAS-Port = 0 (7) NAS-Identifier = "w.x.y.z" (7) NAS-Port-Type = Wireless-802.11 (7) Calling-Station-Id = "Calling-MAC" (7) Called-Station-Id = "Called-MAC" (7) Service-Type = Framed-User (7) Framed-MTU = 1100 (7) EAP-Message = 0x0207002c190017030300210000000000000001c5ef41f3042d7ba531433825f82a73cb4687ce9eb328fa6a3b (7) State = 0xbad3fd1bbfd4e41c1c1cd17260df3cc0 (7) Aruba-Essid-Name = "FSUCoreX" (7) Aruba-Location-Id = "303H-mark" (7) Aruba-AP-Group = "RAP-VoIP" (7) Aruba-Device-Type = "Win 10" (7) Message-Authenticator = 0x007cfcc7b4f70a34ef867accfd218ae4 (7) Restoring &session-state (7) &session-state:TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (7) authorize { (7) fsu-bad-passwords: EXPAND %{User-Name} (7) fsu-bad-passwords: --> myUsername (7) [fsu-bad-passwords] = noop (7) if (ok) { (7) if (ok) -> FALSE (7) policy rewrite_calling_station_id { (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (7) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (7) update request { (7) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (7) --> Calling-MAC (7) } # update request = noop (7) [updated] = updated (7) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (7) ... skipping else: Preceding "if" was taken (7) } # policy rewrite_calling_station_id = updated (7) fsu-bad-macs: EXPAND %{Calling-Station-ID} (7) fsu-bad-macs: --> Calling-MAC (7) [fsu-bad-macs] = noop (7) if (ok) { (7) if (ok) -> FALSE (7) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (7) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (7) if (&User-Name =~ /^host\//) { (7) if (&User-Name =~ /^host\//) -> FALSE (7) if ( &User-Name =~ /\s/ ) { (7) if ( &User-Name =~ /\s/ ) -> FALSE (7) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (7) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (7) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (7) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (7) if ( &User-Name =~ /(a)my\.fsu$/i ) { (7) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (7) ntdomain: Checking for prefix before "\" (7) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (7) [ntdomain] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (7) suffix: Found realm "NULL" (7) suffix: Adding Stripped-User-Name = "myUsername" (7) suffix: Adding Realm = "NULL" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) update request { (7) } # update request = noop (7) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (7) fsu-rsa-macs: --> Calling-MAC (7) [fsu-rsa-macs] = noop (7) if (ok) { (7) if (ok) -> FALSE (7) else { (7) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (7) fsu-rsa-atwpa-aruba: --> FSUCoreX (7) [fsu-rsa-atwpa-aruba] = noop (7) if (ok) { (7) if (ok) -> FALSE (7) else { (7) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (7) fsu-rsa-atwpa-cisco: --> (7) [fsu-rsa-atwpa-cisco] = noop (7) if (ok) { (7) if (ok) -> FALSE (7) } # else = noop (7) } # else = noop (7) if (&request:Hint == "RSA") { (7) if (&request:Hint == "RSA") -> FALSE (7) else { (7) fsu-eap: Peer sent EAP Response (code 2) ID 7 length 44 (7) fsu-eap: Continuing tunnel setup (7) [fsu-eap] = ok (7) } # else = ok (7) } # authorize = ok (7) Found Auth-Type = fsu-eap (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (7) Auth-Type fsu-eap { (7) fsu-eap: Expiring EAP session with state 0xbad3fd1bbfd4e41c (7) fsu-eap: Finished EAP session with state 0xbad3fd1bbfd4e41c (7) fsu-eap: Previous EAP request found for state 0xbad3fd1bbfd4e41c, released from the list (7) fsu-eap: Peer sent packet with method EAP PEAP (25) (7) fsu-eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - myUsername (7) eap_peap: Got inner identity 'myUsername' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0207000d016d616e74686f6e79 (7) eap_peap: Setting User-Name to myUsername (7) eap_peap: Sending tunneled request to fsu-peap-inner-tunnel (7) eap_peap: EAP-Message = 0x0207000d016d616e74686f6e79 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "myUsername" (7) Virtual server fsu-peap-inner-tunnel received request (7) EAP-Message = 0x0207000d016d616e74686f6e79 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "myUsername" (7) : Outer and inner identities are the same. User privacy is compromised. (7) server fsu-peap-inner-tunnel { (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (7) authorize { (7) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (7) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (7) if ( &User-Name =~ /\s/ ) { (7) if ( &User-Name =~ /\s/ ) -> FALSE (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (7) suffix: Found realm "NULL" (7) suffix: Adding Stripped-User-Name = "myUsername" (7) suffix: Adding Realm = "NULL" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) update { (7) EXPAND %{Client-Shortname} (7) --> Cam2 (7) } # update = noop (7) fsu-eap: Peer sent EAP Response (code 2) ID 7 length 13 (7) fsu-eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [fsu-eap] = ok (7) } # authorize = ok (7) Found Auth-Type = fsu-eap (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (7) Auth-Type fsu-eap { (7) fsu-eap: Peer sent packet with method EAP Identity (1) (7) fsu-eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: Issuing Challenge (7) fsu-eap: Sending EAP Request (code 1) ID 8 length 42 (7) fsu-eap: EAP session adding &reply:State = 0xbdbe91b7bdb68b3a (7) [fsu-eap] = handled (7) } # Auth-Type fsu-eap = handled (7) } # server fsu-peap-inner-tunnel (7) Virtual server sending reply (7) EAP-Message = 0x0108002a1a01080025109baa445450222aec1beb19ba94ed03b56673755f6561705f6d73636861707632 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xbdbe91b7bdb68b3a7f0fbe650d998692 (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x0108002a1a01080025109baa445450222aec1beb19ba94ed03b56673755f6561705f6d73636861707632 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0xbdbe91b7bdb68b3a7f0fbe650d998692 (7) eap_peap: Got tunneled Access-Challenge (7) fsu-eap: Sending EAP Request (code 1) ID 8 length 73 (7) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bbcdbe41c (7) [fsu-eap] = handled (7) } # Auth-Type fsu-eap = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (7) Challenge { ... } # empty sub-section is ignored (7) session-state: Saving cached attributes (7) TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (7) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (7) TLS-Session-Version = "TLS 1.2" (7) Sent Access-Challenge Id 70 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (7) EAP-Message = 0x010800491900170303003eb7cf4af33aedeba3cdd5c7ba70a4cc7d7cfd8a0762d9c26bc5ae93b4658121503793b363b4ed6304e0c4123a93536e70452c368f535ba3bad20de5e823a4 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xbad3fd1bbcdbe41c1c1cd17260df3cc0 (7) Finished request (8) Received Access-Request Id 71 from w.x.y.z:54989 to a.b.c.e:1812 length 304 (8) User-Name = "myUsername" (8) NAS-IP-Address = a.b.c.d (8) NAS-Port = 0 (8) NAS-Identifier = "w.x.y.z" (8) NAS-Port-Type = Wireless-802.11 (8) Calling-Station-Id = "Calling-MAC" (8) Called-Station-Id = "Called-MAC" (8) Service-Type = Framed-User (8) Framed-MTU = 1100 (8) EAP-Message = 0x020800621900170303005700000000000000028e27ce3a53464fde6326d09354698180aa53531ef4ca995a0ac159eb57b93070a23c5c40141bb0731e014889a5ff565ce9acc558fac42bd7c6373f1c2e52351836e75fd99d8944e0338b0d9d637118 (8) State = 0xbad3fd1bbcdbe41c1c1cd17260df3cc0 (8) Aruba-Essid-Name = "FSUCoreX" (8) Aruba-Location-Id = "303H-mark" (8) Aruba-AP-Group = "RAP-VoIP" (8) Aruba-Device-Type = "Win 10" (8) Message-Authenticator = 0xf6ff0643a9eed31b5cecf30091547c5a (8) Restoring &session-state (8) &session-state:TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (8) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (8) &session-state:TLS-Session-Version = "TLS 1.2" (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (8) authorize { (8) fsu-bad-passwords: EXPAND %{User-Name} (8) fsu-bad-passwords: --> myUsername (8) [fsu-bad-passwords] = noop (8) if (ok) { (8) if (ok) -> FALSE (8) policy rewrite_calling_station_id { (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (8) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (8) update request { (8) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (8) --> Calling-MAC (8) } # update request = noop (8) [updated] = updated (8) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (8) ... skipping else: Preceding "if" was taken (8) } # policy rewrite_calling_station_id = updated (8) fsu-bad-macs: EXPAND %{Calling-Station-ID} (8) fsu-bad-macs: --> Calling-MAC (8) [fsu-bad-macs] = noop (8) if (ok) { (8) if (ok) -> FALSE (8) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (8) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (8) if (&User-Name =~ /^host\//) { (8) if (&User-Name =~ /^host\//) -> FALSE (8) if ( &User-Name =~ /\s/ ) { (8) if ( &User-Name =~ /\s/ ) -> FALSE (8) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (8) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (8) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (8) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (8) if ( &User-Name =~ /(a)my\.fsu$/i ) { (8) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (8) ntdomain: Checking for prefix before "\" (8) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (8) [ntdomain] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (8) suffix: Found realm "NULL" (8) suffix: Adding Stripped-User-Name = "myUsername" (8) suffix: Adding Realm = "NULL" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) update request { (8) } # update request = noop (8) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (8) fsu-rsa-macs: --> Calling-MAC (8) [fsu-rsa-macs] = noop (8) if (ok) { (8) if (ok) -> FALSE (8) else { (8) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (8) fsu-rsa-atwpa-aruba: --> FSUCoreX (8) [fsu-rsa-atwpa-aruba] = noop (8) if (ok) { (8) if (ok) -> FALSE (8) else { (8) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (8) fsu-rsa-atwpa-cisco: --> (8) [fsu-rsa-atwpa-cisco] = noop (8) if (ok) { (8) if (ok) -> FALSE (8) } # else = noop (8) } # else = noop (8) if (&request:Hint == "RSA") { (8) if (&request:Hint == "RSA") -> FALSE (8) else { (8) fsu-eap: Peer sent EAP Response (code 2) ID 8 length 98 (8) fsu-eap: Continuing tunnel setup (8) [fsu-eap] = ok (8) } # else = ok (8) } # authorize = ok (8) Found Auth-Type = fsu-eap (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (8) Auth-Type fsu-eap { (8) fsu-eap: Expiring EAP session with state 0xbdbe91b7bdb68b3a (8) fsu-eap: Finished EAP session with state 0xbad3fd1bbcdbe41c (8) fsu-eap: Previous EAP request found for state 0xbad3fd1bbcdbe41c, released from the list (8) fsu-eap: Peer sent packet with method EAP PEAP (25) (8) fsu-eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x020800431a0208003e31833b15c9f3ef2852172280a74b6713570000000000000000744a1ec95ae0b4188d19786bca156b494eaeded4cf6c1848006d616e74686f6e79 (8) eap_peap: Setting User-Name to myUsername (8) eap_peap: Sending tunneled request to fsu-peap-inner-tunnel (8) eap_peap: EAP-Message = 0x020800431a0208003e31833b15c9f3ef2852172280a74b6713570000000000000000744a1ec95ae0b4188d19786bca156b494eaeded4cf6c1848006d616e74686f6e79 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "myUsername" (8) eap_peap: State = 0xbdbe91b7bdb68b3a7f0fbe650d998692 (8) Virtual server fsu-peap-inner-tunnel received request (8) EAP-Message = 0x020800431a0208003e31833b15c9f3ef2852172280a74b6713570000000000000000744a1ec95ae0b4188d19786bca156b494eaeded4cf6c1848006d616e74686f6e79 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "myUsername" (8) State = 0xbdbe91b7bdb68b3a7f0fbe650d998692 (8) : Outer and inner identities are the same. User privacy is compromised. (8) server fsu-peap-inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (8) authorize { (8) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (8) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (8) if ( &User-Name =~ /\s/ ) { (8) if ( &User-Name =~ /\s/ ) -> FALSE (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (8) suffix: Found realm "NULL" (8) suffix: Adding Stripped-User-Name = "myUsername" (8) suffix: Adding Realm = "NULL" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) update { (8) EXPAND %{Client-Shortname} (8) --> Cam2 (8) } # update = noop (8) fsu-eap: Peer sent EAP Response (code 2) ID 8 length 67 (8) fsu-eap: No EAP Start, assuming it's an on-going EAP conversation (8) [fsu-eap] = updated (8) if ( &EAP-Message =~ /^0x02..00061a..$/ ) { (8) if ( &EAP-Message =~ /^0x02..00061a..$/ ) -> FALSE (8) if ( &User-Name =~ /^host\/(COB-RBA[A-Za-z0-9-]+)(\.fsu\.edu)*$/i) { (8) if ( &User-Name =~ /^host\/(COB-RBA[A-Za-z0-9-]+)(\.fsu\.edu)*$/i) -> FALSE (8) elsif (&User-Name =~ /^host\/([A-Z]{2,5}-A-[0-9A-Z]{6,7})(\.fsu\.edu)*$/) { (8) elsif (&User-Name =~ /^host\/([A-Z]{2,5}-A-[0-9A-Z]{6,7})(\.fsu\.edu)*$/) -> FALSE (8) elsif ( (&request:Realm) && (&request:Realm == "devices") ) { (8) elsif ( (&request:Realm) && (&request:Realm == "devices") ) -> FALSE (8) else { (8) fsu-ldap-people: EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(uid=lib-guest*))) (8) fsu-ldap-people: --> (&(uid=myUsername)(!(uid=lib-guest*))) (8) fsu-ldap-people: Performing search in "ou=people,dc=fsu,dc=edu" with filter "(&(uid=myUsername)(!(uid=lib-guest*)))", scope "sub" (8) fsu-ldap-people: Waiting for search result... (8) fsu-ldap-people: User object found at DN "uid=myUsername,ou=People,dc=fsu,dc=edu" (8) fsu-ldap-people: Processing user attributes (8) [fsu-ldap-people] = updated (8) if (notfound) { (8) if (notfound) -> FALSE (8) if ( &reply:My-Local-fsuEduWINStatus ) { (8) if ( &reply:My-Local-fsuEduWINStatus ) -> FALSE (8) fsu-pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (8) : fsu-pap: Auth-Type already set. Not setting to PAP (8) [fsu-pap] = noop (8) update control { (8) } # update control = noop (8) if ( (&reply:My-Local-VLAN) && (!&reply:My-Local-employeeStatus) ) { (8) if ( (&reply:My-Local-VLAN) && (!&reply:My-Local-employeeStatus) ) -> FALSE (8) if (&reply:My-Local-fsuEduAppRoles) { (8) if (&reply:My-Local-fsuEduAppRoles) -> TRUE (8) if (&reply:My-Local-fsuEduAppRoles) { (8) if ((!&reply:My-Local-VLAN) && (&Client-Shortname !~ /^P/)) { (8) if ((!&reply:My-Local-VLAN) && (&Client-Shortname !~ /^P/)) -> FALSE (8) update { (8) } # update = noop (8) } # if (&reply:My-Local-fsuEduAppRoles) = noop (8) if ((!&reply:My-Local-employeeStatus) && (!&reply:My-Local-VLAN)) { (8) if ((!&reply:My-Local-employeeStatus) && (!&reply:My-Local-VLAN)) -> FALSE (8) elsif (!&reply:My-Local-VLAN) { (8) elsif (!&reply:My-Local-VLAN) -> FALSE (8) fsu-cache-ldap-people-inner-tunnel-attributes: EXPAND %{User-Name} (8) fsu-cache-ldap-people-inner-tunnel-attributes: --> myUsername (8) fsu-cache-ldap-people-inner-tunnel-attributes: No cache entry found for "myUsername" (8) fsu-cache-ldap-people-inner-tunnel-attributes: Creating new cache entry (8) fsu-cache-ldap-people-inner-tunnel-attributes: &reply:My-Local-VLAN := &reply:My-Local-VLAN -> 'vlan1' (8) fsu-cache-ldap-people-inner-tunnel-attributes: Merging cache entry into request (8) fsu-cache-ldap-people-inner-tunnel-attributes: &reply:My-Local-VLAN := "vlan1" (8) fsu-cache-ldap-people-inner-tunnel-attributes: Committed entry, TTL 10 seconds (8) [fsu-cache-ldap-people-inner-tunnel-attributes] = updated (8) } # else = updated (8) } # authorize = updated (8) Found Auth-Type = fsu-eap (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (8) Auth-Type fsu-eap { (8) fsu-eap: Expiring EAP session with state 0xbdbe91b7bdb68b3a (8) fsu-eap: Finished EAP session with state 0xbdbe91b7bdb68b3a (8) fsu-eap: Previous EAP request found for state 0xbdbe91b7bdb68b3a, released from the list (8) fsu-eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) fsu-eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (8) eap_mschapv2: Auth-Type MS-CHAP { (8) fsu-mschap-winbind: Found NT-Password (8) fsu-mschap-winbind: Creating challenge hash with username: myUsername (8) fsu-mschap-winbind: Client is using MS-CHAPv2 (8) fsu-mschap-winbind: Adding MS-CHAPv2 MPPE keys (8) eap_mschapv2: [fsu-mschap-winbind] = ok (8) eap_mschapv2: } # Auth-Type MS-CHAP = ok (8) eap_mschapv2: MSCHAP Success (8) fsu-eap: Sending EAP Request (code 1) ID 9 length 51 (8) fsu-eap: EAP session adding &reply:State = 0xbdbe91b7bcb78b3a (8) [fsu-eap] = handled (8) } # Auth-Type fsu-eap = handled (8) } # server fsu-peap-inner-tunnel (8) Virtual server sending reply (8) My-Local-employeeStatus = "Active" (8) My-Local-VLAN = "vlan1" (8) EAP-Message = 0x010900331a0308002e533d41393935354644354538374432394630414132383239393242333033343041313045414634313145 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xbdbe91b7bcb78b3a7f0fbe650d998692 (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: My-Local-employeeStatus = "Active" (8) eap_peap: My-Local-VLAN = "vlan1" (8) eap_peap: EAP-Message = 0x010900331a0308002e533d41393935354644354538374432394630414132383239393242333033343041313045414634313145 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0xbdbe91b7bcb78b3a7f0fbe650d998692 (8) eap_peap: Got tunneled Access-Challenge (8) fsu-eap: Sending EAP Request (code 1) ID 9 length 82 (8) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bbddae41c (8) [fsu-eap] = handled (8) } # Auth-Type fsu-eap = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (8) Challenge { ... } # empty sub-section is ignored (8) session-state: Saving cached attributes (8) TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (8) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (8) TLS-Session-Version = "TLS 1.2" (8) Sent Access-Challenge Id 71 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (8) EAP-Message = 0x0109005219001703030047b7cf4af33aedeba476f0ca80606e3598427bd6060b0e2f916bcffa2c3fc9c58dd50f86471e0cf17757762211678028238727728422349caf8dfcce26ca5e11e712af3dfe455357 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xbad3fd1bbddae41c1c1cd17260df3cc0 (8) Finished request (9) Received Access-Request Id 72 from w.x.y.z:54989 to a.b.c.e:1812 length 243 (9) User-Name = "myUsername" (9) NAS-IP-Address = a.b.c.d (9) NAS-Port = 0 (9) NAS-Identifier = "w.x.y.z" (9) NAS-Port-Type = Wireless-802.11 (9) Calling-Station-Id = "Calling-MAC" (9) Called-Station-Id = "Called-MAC" (9) Service-Type = Framed-User (9) Framed-MTU = 1100 (9) EAP-Message = 0x020900251900170303001a00000000000000030d1699cbaf6586c78b66fceffb50df5f09e8 (9) State = 0xbad3fd1bbddae41c1c1cd17260df3cc0 (9) Aruba-Essid-Name = "FSUCoreX" (9) Aruba-Location-Id = "303H-mark" (9) Aruba-AP-Group = "RAP-VoIP" (9) Aruba-Device-Type = "Win 10" (9) Message-Authenticator = 0xdf62b863a702c3f6c3695ae393531b03 (9) Restoring &session-state (9) &session-state:TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (9) &session-state:TLS-Session-Version = "TLS 1.2" (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (9) authorize { (9) fsu-bad-passwords: EXPAND %{User-Name} (9) fsu-bad-passwords: --> myUsername (9) [fsu-bad-passwords] = noop (9) if (ok) { (9) if (ok) -> FALSE (9) policy rewrite_calling_station_id { (9) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (9) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (9) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (9) update request { (9) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (9) --> Calling-MAC (9) } # update request = noop (9) [updated] = updated (9) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (9) ... skipping else: Preceding "if" was taken (9) } # policy rewrite_calling_station_id = updated (9) fsu-bad-macs: EXPAND %{Calling-Station-ID} (9) fsu-bad-macs: --> Calling-MAC (9) [fsu-bad-macs] = noop (9) if (ok) { (9) if (ok) -> FALSE (9) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (9) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (9) if (&User-Name =~ /^host\//) { (9) if (&User-Name =~ /^host\//) -> FALSE (9) if ( &User-Name =~ /\s/ ) { (9) if ( &User-Name =~ /\s/ ) -> FALSE (9) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (9) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (9) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (9) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (9) if ( &User-Name =~ /(a)my\.fsu$/i ) { (9) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (9) ntdomain: Checking for prefix before "\" (9) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (9) [ntdomain] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (9) suffix: Found realm "NULL" (9) suffix: Adding Stripped-User-Name = "myUsername" (9) suffix: Adding Realm = "NULL" (9) suffix: Authentication realm is LOCAL (9) [suffix] = ok (9) update request { (9) } # update request = noop (9) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (9) fsu-rsa-macs: --> Calling-MAC (9) [fsu-rsa-macs] = noop (9) if (ok) { (9) if (ok) -> FALSE (9) else { (9) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (9) fsu-rsa-atwpa-aruba: --> FSUCoreX (9) [fsu-rsa-atwpa-aruba] = noop (9) if (ok) { (9) if (ok) -> FALSE (9) else { (9) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (9) fsu-rsa-atwpa-cisco: --> (9) [fsu-rsa-atwpa-cisco] = noop (9) if (ok) { (9) if (ok) -> FALSE (9) } # else = noop (9) } # else = noop (9) if (&request:Hint == "RSA") { (9) if (&request:Hint == "RSA") -> FALSE (9) else { (9) fsu-eap: Peer sent EAP Response (code 2) ID 9 length 37 (9) fsu-eap: Continuing tunnel setup (9) [fsu-eap] = ok (9) } # else = ok (9) } # authorize = ok (9) Found Auth-Type = fsu-eap (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (9) Auth-Type fsu-eap { (9) fsu-eap: Expiring EAP session with state 0xbdbe91b7bcb78b3a (9) fsu-eap: Finished EAP session with state 0xbad3fd1bbddae41c (9) fsu-eap: Previous EAP request found for state 0xbad3fd1bbddae41c, released from the list (9) fsu-eap: Peer sent packet with method EAP PEAP (25) (9) fsu-eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x020900061a03 (9) eap_peap: Setting User-Name to myUsername (9) eap_peap: Sending tunneled request to fsu-peap-inner-tunnel (9) eap_peap: EAP-Message = 0x020900061a03 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "myUsername" (9) eap_peap: State = 0xbdbe91b7bcb78b3a7f0fbe650d998692 (9) Virtual server fsu-peap-inner-tunnel received request (9) EAP-Message = 0x020900061a03 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "myUsername" (9) State = 0xbdbe91b7bcb78b3a7f0fbe650d998692 (9) : Outer and inner identities are the same. User privacy is compromised. (9) server fsu-peap-inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (9) authorize { (9) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (9) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (9) if ( &User-Name =~ /\s/ ) { (9) if ( &User-Name =~ /\s/ ) -> FALSE (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (9) suffix: Found realm "NULL" (9) suffix: Adding Stripped-User-Name = "myUsername" (9) suffix: Adding Realm = "NULL" (9) suffix: Authentication realm is LOCAL (9) [suffix] = ok (9) update { (9) EXPAND %{Client-Shortname} (9) --> Cam2 (9) } # update = noop (9) fsu-eap: Peer sent EAP Response (code 2) ID 9 length 6 (9) fsu-eap: No EAP Start, assuming it's an on-going EAP conversation (9) [fsu-eap] = updated (9) if ( &EAP-Message =~ /^0x02..00061a..$/ ) { (9) if ( &EAP-Message =~ /^0x02..00061a..$/ ) -> TRUE (9) if ( &EAP-Message =~ /^0x02..00061a..$/ ) { (9) policy fsu-peap-cache-policy { (9) if ( &User-Name =~ /@devices/ ){ (9) if ( &User-Name =~ /@devices/ ) -> FALSE (9) else { (9) fsu-cache-ldap-people-inner-tunnel-attributes: EXPAND %{User-Name} (9) fsu-cache-ldap-people-inner-tunnel-attributes: --> myUsername (9) fsu-cache-ldap-people-inner-tunnel-attributes: Found entry for "myUsername" (9) fsu-cache-ldap-people-inner-tunnel-attributes: Merging cache entry into request (9) fsu-cache-ldap-people-inner-tunnel-attributes: &reply:My-Local-VLAN := "vlan1" (9) [fsu-cache-ldap-people-inner-tunnel-attributes] = ok (9) if (updated) { (9) if (updated) -> FALSE (9) elsif (noop) { (9) elsif (noop) -> FALSE (9) elsif (ok) { (9) elsif (ok) -> TRUE (9) elsif (ok) { (9) update control { (9) } # update control = noop (9) } # elsif (ok) = noop (9) ... skipping else: Preceding "if" was taken (9) } # else = ok (9) } # policy fsu-peap-cache-policy = ok (9) return (9) } # if ( &EAP-Message =~ /^0x02..00061a..$/ ) = ok (9) } # authorize = updated (9) Found Auth-Type = fsu-eap (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (9) Auth-Type fsu-eap { (9) fsu-eap: Expiring EAP session with state 0xbdbe91b7bcb78b3a (9) fsu-eap: Finished EAP session with state 0xbdbe91b7bcb78b3a (9) fsu-eap: Previous EAP request found for state 0xbdbe91b7bcb78b3a, released from the list (9) fsu-eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) fsu-eap: Calling submodule eap_mschapv2 to process data (9) fsu-eap: Sending EAP Success (code 3) ID 9 length 4 (9) fsu-eap: Freeing handler (9) [fsu-eap] = ok (9) } # Auth-Type fsu-eap = ok (9) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (9) post-auth { (9) update reply { (9) } # update reply = noop (9) update outer.session-state { (9) } # update outer.session-state = noop (9) } # post-auth = noop (9) EXPAND %{My-Local-SSID} %{My-Local-AP} %{My-Local-Group} %{My-Local-Device} %{reply:My-Local-VLAN} (9) --> vlan1 (9) } # server fsu-peap-inner-tunnel (9) Virtual server sending reply (9) My-Local-VLAN = "vlan1" (9) eap_peap: Got tunneled reply code 2 (9) eap_peap: My-Local-VLAN = "vlan1" (9) eap_peap: Tunneled authentication was successful (9) eap_peap: SUCCESS (9) eap_peap: Saving tunneled attributes for later (9) fsu-eap: Sending EAP Request (code 1) ID 10 length 46 (9) fsu-eap: EAP session adding &reply:State = 0xbad3fd1bb2d9e41c (9) [fsu-eap] = handled (9) } # Auth-Type fsu-eap = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (9) Challenge { ... } # empty sub-section is ignored (9) session-state: Saving cached attributes (9) TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (9) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (9) TLS-Session-Version = "TLS 1.2" (9) My-Local-VLAN := "vlan1" (9) Sent Access-Challenge Id 72 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (9) EAP-Message = 0x010a002e19001703030023b7cf4af33aedeba505c51c2e3171961fb71fe7fbd0c5c4e9758095d7bc824aa3c086c1 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0xbad3fd1bb2d9e41c1c1cd17260df3cc0 (9) Finished request (10) Received Access-Request Id 73 from w.x.y.z:54989 to a.b.c.e:1812 length 252 (10) User-Name = "myUsername" (10) NAS-IP-Address = a.b.c.d (10) NAS-Port = 0 (10) NAS-Identifier = "w.x.y.z" (10) NAS-Port-Type = Wireless-802.11 (10) Calling-Station-Id = "Calling-MAC" (10) Called-Station-Id = "Called-MAC" (10) Service-Type = Framed-User (10) Framed-MTU = 1100 (10) EAP-Message = 0x020a002e190017030300230000000000000004de7c7a2af3bccdc1ab6fbe745bd674fade6975f3841b77dd0bc828 (10) State = 0xbad3fd1bb2d9e41c1c1cd17260df3cc0 (10) Aruba-Essid-Name = "FSUCoreX" (10) Aruba-Location-Id = "303H-mark" (10) Aruba-AP-Group = "RAP-VoIP" (10) Aruba-Device-Type = "Win 10" (10) Message-Authenticator = 0x5e7f2636fe8c9843ebeac76225d66d1b (10) Restoring &session-state (10) &session-state:TLS-Cache-Filename = "/var/log/radius/tlscache/422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c.asn1" (10) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (10) &session-state:TLS-Session-Version = "TLS 1.2" (10) &session-state:My-Local-VLAN := "vlan1" (10) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (10) authorize { (10) fsu-bad-passwords: EXPAND %{User-Name} (10) fsu-bad-passwords: --> myUsername (10) [fsu-bad-passwords] = noop (10) if (ok) { (10) if (ok) -> FALSE (10) policy rewrite_calling_station_id { (10) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (10) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (10) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (10) update request { (10) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (10) --> Calling-MAC (10) } # update request = noop (10) [updated] = updated (10) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (10) ... skipping else: Preceding "if" was taken (10) } # policy rewrite_calling_station_id = updated (10) fsu-bad-macs: EXPAND %{Calling-Station-ID} (10) fsu-bad-macs: --> Calling-MAC (10) [fsu-bad-macs] = noop (10) if (ok) { (10) if (ok) -> FALSE (10) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (10) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (10) if (&User-Name =~ /^host\//) { (10) if (&User-Name =~ /^host\//) -> FALSE (10) if ( &User-Name =~ /\s/ ) { (10) if ( &User-Name =~ /\s/ ) -> FALSE (10) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (10) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (10) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (10) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (10) if ( &User-Name =~ /(a)my\.fsu$/i ) { (10) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (10) ntdomain: Checking for prefix before "\" (10) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (10) [ntdomain] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (10) suffix: Found realm "NULL" (10) suffix: Adding Stripped-User-Name = "myUsername" (10) suffix: Adding Realm = "NULL" (10) suffix: Authentication realm is LOCAL (10) [suffix] = ok (10) update request { (10) } # update request = noop (10) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (10) fsu-rsa-macs: --> Calling-MAC (10) [fsu-rsa-macs] = noop (10) if (ok) { (10) if (ok) -> FALSE (10) else { (10) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (10) fsu-rsa-atwpa-aruba: --> FSUCoreX (10) [fsu-rsa-atwpa-aruba] = noop (10) if (ok) { (10) if (ok) -> FALSE (10) else { (10) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (10) fsu-rsa-atwpa-cisco: --> (10) [fsu-rsa-atwpa-cisco] = noop (10) if (ok) { (10) if (ok) -> FALSE (10) } # else = noop (10) } # else = noop (10) if (&request:Hint == "RSA") { (10) if (&request:Hint == "RSA") -> FALSE (10) else { (10) fsu-eap: Peer sent EAP Response (code 2) ID 10 length 46 (10) fsu-eap: Continuing tunnel setup (10) [fsu-eap] = ok (10) } # else = ok (10) } # authorize = ok (10) Found Auth-Type = fsu-eap (10) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (10) Auth-Type fsu-eap { (10) fsu-eap: Expiring EAP session with state 0xbad3fd1bb2d9e41c (10) fsu-eap: Finished EAP session with state 0xbad3fd1bb2d9e41c (10) fsu-eap: Previous EAP request found for state 0xbad3fd1bb2d9e41c, released from the list (10) fsu-eap: Peer sent packet with method EAP PEAP (25) (10) fsu-eap: Calling submodule eap_peap to process data (10) eap_peap: Continuing EAP-TLS (10) eap_peap: [eaptls verify] = ok (10) eap_peap: Done initial handshake (10) eap_peap: [eaptls process] = ok (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv success (10) eap_peap: Received EAP-TLV response (10) eap_peap: Success (10) eap_peap: Using saved attributes from the original Access-Accept (10) eap_peap: My-Local-VLAN = "vlan1" (10) eap_peap: caching Stripped-User-Name = "myUsername" (10) eap_peap: caching My-Local-VLAN = "vlan1" (10) eap_peap: Saving session 422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c in the disk cache (10) fsu-eap: Sending EAP Success (code 3) ID 10 length 4 (10) fsu-eap: Freeing handler (10) [fsu-eap] = ok (10) } # Auth-Type fsu-eap = ok (10) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (10) post-auth { (10) update reply { (10) } # update reply = noop (10) if ( &reply:My-Local-VLAN == "student" ) { (10) if ( &reply:My-Local-VLAN == "student" ) -> FALSE (10) policy fsu-SSID-and-VLAN-policy { (10) update { (10) } # update = noop (10) if ( &Aruba-Essid-Name ) { (10) if ( &Aruba-Essid-Name ) -> TRUE (10) if ( &Aruba-Essid-Name ) { (10) update { (10) } # update = noop (10) if ( &My-Local-AP =~ /^(.*?)(\.wireless)?(\.fsu\.edu)$/i ) { (10) if ( &My-Local-AP =~ /^(.*?)(\.wireless)?(\.fsu\.edu)$/i ) -> FALSE (10) if ( &My-Local-Group =~ /^(.+) (.+$)/ ) { (10) if ( &My-Local-Group =~ /^(.+) (.+$)/ ) -> FALSE (10) } # if ( &Aruba-Essid-Name ) = noop (10) ... skipping elsif: Preceding "if" was taken (10) ... skipping elsif: Preceding "if" was taken (10) ... skipping else: Preceding "if" was taken (10) if (( !&My-Local-Device ) || ( &My-Local-Device == '' )) { (10) if (( !&My-Local-Device ) || ( &My-Local-Device == '' )) -> FALSE (10) elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) { (10) elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) -> TRUE (10) elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) { (10) update { (10) EXPAND %{1}_%{2} (10) --> Win_10 (10) } # update = noop (10) } # elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) = noop (10) } # policy fsu-SSID-and-VLAN-policy = noop (10) } # post-auth = noop (10) EXPAND %{My-Local-SSID} %{My-Local-AP} %{My-Local-Group} %{My-Local-Device} %{reply:My-Local-VLAN} (10) --> FSUCoreX 303H-mark RAP-VoIP Win_10 vlan1 (10) Sent Access-Accept Id 73 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (10) MS-MPPE-Recv-Key = 0x76c1709fb1a884db3c1dae08502e387b4ee3509699ba64fb2ac819dcd7cb9cf2 (10) MS-MPPE-Send-Key = 0x69113d50de374c367959ece9c252df752318770766c2fcd944e19608a88cd587 (10) EAP-Message = 0x030a0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "myUsername" (10) Aruba-User-Vlan := vlan1 (10) Finished request (1) Cleaning up request packet ID 64 with timestamp +100 (2) Cleaning up request packet ID 65 with timestamp +100 (3) Cleaning up request packet ID 66 with timestamp +100 (4) Cleaning up request packet ID 67 with timestamp +100 (5) Cleaning up request packet ID 68 with timestamp +100 (6) Cleaning up request packet ID 69 with timestamp +100 (7) Cleaning up request packet ID 70 with timestamp +100 (8) Cleaning up request packet ID 71 with timestamp +101 (9) Cleaning up request packet ID 72 with timestamp +101 (10) Cleaning up request packet ID 73 with timestamp +101 (12) Received Access-Request Id 75 from w.x.y.z:54989 to a.b.c.e:1812 length 201 (12) User-Name = "myUsername" (12) NAS-IP-Address = a.b.c.d (12) NAS-Port = 0 (12) NAS-Identifier = "w.x.y.z" (12) NAS-Port-Type = Wireless-802.11 (12) Calling-Station-Id = "Calling-MAC" (12) Called-Station-Id = "Called-MAC" (12) Service-Type = Framed-User (12) Framed-MTU = 1100 (12) EAP-Message = 0x0201000d016d616e74686f6e79 (12) Aruba-Essid-Name = "FSUCoreX" (12) Aruba-Location-Id = "303H-mark" (12) Aruba-AP-Group = "RAP-VoIP" (12) Aruba-Device-Type = "Win 10" (12) Message-Authenticator = 0xfba1cd2bb95371c14c3b6dec0b816152 (12) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (12) authorize { (12) fsu-bad-passwords: EXPAND %{User-Name} (12) fsu-bad-passwords: --> myUsername (12) [fsu-bad-passwords] = noop (12) if (ok) { (12) if (ok) -> FALSE (12) policy rewrite_calling_station_id { (12) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (12) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (12) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (12) update request { (12) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (12) --> Calling-MAC (12) } # update request = noop (12) [updated] = updated (12) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (12) ... skipping else: Preceding "if" was taken (12) } # policy rewrite_calling_station_id = updated (12) fsu-bad-macs: EXPAND %{Calling-Station-ID} (12) fsu-bad-macs: --> Calling-MAC (12) [fsu-bad-macs] = noop (12) if (ok) { (12) if (ok) -> FALSE (12) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (12) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (12) if (&User-Name =~ /^host\//) { (12) if (&User-Name =~ /^host\//) -> FALSE (12) if ( &User-Name =~ /\s/ ) { (12) if ( &User-Name =~ /\s/ ) -> FALSE (12) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (12) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (12) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (12) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (12) if ( &User-Name =~ /(a)my\.fsu$/i ) { (12) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (12) ntdomain: Checking for prefix before "\" (12) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (12) [ntdomain] = noop (12) suffix: Checking for suffix after "@" (12) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (12) suffix: Found realm "NULL" (12) suffix: Adding Stripped-User-Name = "myUsername" (12) suffix: Adding Realm = "NULL" (12) suffix: Authentication realm is LOCAL (12) [suffix] = ok (12) update request { (12) } # update request = noop (12) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (12) fsu-rsa-macs: --> Calling-MAC (12) [fsu-rsa-macs] = noop (12) if (ok) { (12) if (ok) -> FALSE (12) else { (12) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (12) fsu-rsa-atwpa-aruba: --> FSUCoreX (12) [fsu-rsa-atwpa-aruba] = noop (12) if (ok) { (12) if (ok) -> FALSE (12) else { (12) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (12) fsu-rsa-atwpa-cisco: --> (12) [fsu-rsa-atwpa-cisco] = noop (12) if (ok) { (12) if (ok) -> FALSE (12) } # else = noop (12) } # else = noop (12) if (&request:Hint == "RSA") { (12) if (&request:Hint == "RSA") -> FALSE (12) else { (12) fsu-eap: Peer sent EAP Response (code 2) ID 1 length 13 (12) fsu-eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (12) [fsu-eap] = ok (12) } # else = ok (12) } # authorize = ok (12) Found Auth-Type = fsu-eap (12) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (12) Auth-Type fsu-eap { (12) fsu-eap: Peer sent packet with method EAP Identity (1) (12) fsu-eap: Calling submodule eap_peap to process data (12) eap_peap: Initiating new TLS session (12) eap_peap: [eaptls start] = request (12) fsu-eap: Sending EAP Request (code 1) ID 2 length 6 (12) fsu-eap: EAP session adding &reply:State = 0xed876281ed857bf6 (12) [fsu-eap] = handled (12) } # Auth-Type fsu-eap = handled (12) Using Post-Auth-Type Challenge (12) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (12) Challenge { ... } # empty sub-section is ignored (12) Sent Access-Challenge Id 75 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (12) EAP-Message = 0x010200061920 (12) Message-Authenticator = 0x00000000000000000000000000000000 (12) State = 0xed876281ed857bf64bfe7e94b8bee491 (12) Finished request (13) Received Access-Request Id 76 from w.x.y.z:54989 to a.b.c.e:1812 length 410 (13) User-Name = "myUsername" (13) NAS-IP-Address = a.b.c.d (13) NAS-Port = 0 (13) NAS-Identifier = "w.x.y.z" (13) NAS-Port-Type = Wireless-802.11 (13) Calling-Station-Id = "Calling-MAC" (13) Called-Station-Id = "Called-MAC" (13) Service-Type = Framed-User (13) Framed-MTU = 1100 (13) EAP-Message = 0x020200cc1980000000c216030300bd010000b90303602ed14ac1f2d653bd77e58e5213aeb2b1761c505dae0f91b5abafddc637c96f20422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000046000500050100000000000a00080006001d00170018000b00020100000d001a00180804080508060401050102010403050302030202060106030023000000170000ff01000100 (13) State = 0xed876281ed857bf64bfe7e94b8bee491 (13) Aruba-Essid-Name = "FSUCoreX" (13) Aruba-Location-Id = "303H-mark" (13) Aruba-AP-Group = "RAP-VoIP" (13) Aruba-Device-Type = "Win 10" (13) Message-Authenticator = 0x535aa1354009ea5836ccfd33734fcc8c (13) session-state: No cached attributes (13) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (13) authorize { (13) fsu-bad-passwords: EXPAND %{User-Name} (13) fsu-bad-passwords: --> myUsername (13) [fsu-bad-passwords] = noop (13) if (ok) { (13) if (ok) -> FALSE (13) policy rewrite_calling_station_id { (13) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (13) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (13) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (13) update request { (13) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (13) --> Calling-MAC (13) } # update request = noop (13) [updated] = updated (13) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (13) ... skipping else: Preceding "if" was taken (13) } # policy rewrite_calling_station_id = updated (13) fsu-bad-macs: EXPAND %{Calling-Station-ID} (13) fsu-bad-macs: --> Calling-MAC (13) [fsu-bad-macs] = noop (13) if (ok) { (13) if (ok) -> FALSE (13) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (13) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (13) if (&User-Name =~ /^host\//) { (13) if (&User-Name =~ /^host\//) -> FALSE (13) if ( &User-Name =~ /\s/ ) { (13) if ( &User-Name =~ /\s/ ) -> FALSE (13) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (13) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (13) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (13) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (13) if ( &User-Name =~ /(a)my\.fsu$/i ) { (13) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (13) ntdomain: Checking for prefix before "\" (13) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (13) [ntdomain] = noop (13) suffix: Checking for suffix after "@" (13) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (13) suffix: Found realm "NULL" (13) suffix: Adding Stripped-User-Name = "myUsername" (13) suffix: Adding Realm = "NULL" (13) suffix: Authentication realm is LOCAL (13) [suffix] = ok (13) update request { (13) } # update request = noop (13) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (13) fsu-rsa-macs: --> Calling-MAC (13) [fsu-rsa-macs] = noop (13) if (ok) { (13) if (ok) -> FALSE (13) else { (13) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (13) fsu-rsa-atwpa-aruba: --> FSUCoreX (13) [fsu-rsa-atwpa-aruba] = noop (13) if (ok) { (13) if (ok) -> FALSE (13) else { (13) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (13) fsu-rsa-atwpa-cisco: --> (13) [fsu-rsa-atwpa-cisco] = noop (13) if (ok) { (13) if (ok) -> FALSE (13) } # else = noop (13) } # else = noop (13) if (&request:Hint == "RSA") { (13) if (&request:Hint == "RSA") -> FALSE (13) else { (13) fsu-eap: Peer sent EAP Response (code 2) ID 2 length 204 (13) fsu-eap: Continuing tunnel setup (13) [fsu-eap] = ok (13) } # else = ok (13) } # authorize = ok (13) Found Auth-Type = fsu-eap (13) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (13) Auth-Type fsu-eap { (13) fsu-eap: Expiring EAP session with state 0xed876281ed857bf6 (13) fsu-eap: Finished EAP session with state 0xed876281ed857bf6 (13) fsu-eap: Previous EAP request found for state 0xed876281ed857bf6, released from the list (13) fsu-eap: Peer sent packet with method EAP PEAP (25) (13) fsu-eap: Calling submodule eap_peap to process data (13) eap_peap: Continuing EAP-TLS (13) eap_peap: Peer indicated complete TLS record size will be 194 bytes (13) eap_peap: Got complete TLS record (194 bytes) (13) eap_peap: [eaptls verify] = length included (13) eap_peap: (other): before SSL initialization (13) eap_peap: TLS_accept: before SSL initialization (13) eap_peap: TLS_accept: before SSL initialization (13) eap_peap: Peer requested cached session: 422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c (13) eap_peap: Successfully restored session 422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c (13) eap_peap: reply:Stripped-User-Name = "myUsername" (13) eap_peap: reply:My-Local-VLAN = "vlan1" (13) eap_peap: TLS_accept: SSLv3/TLS read client hello (13) eap_peap: TLS_accept: SSLv3/TLS write server hello (13) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (13) eap_peap: TLS_accept: SSLv3/TLS write finished (13) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write finished (13) eap_peap: TLS - In Handshake Phase (13) eap_peap: TLS - got 141 bytes of data (13) eap_peap: [eaptls process] = handled (13) fsu-eap: Sending EAP Request (code 1) ID 3 length 147 (13) fsu-eap: EAP session adding &reply:State = 0xed876281ec847bf6 (13) [fsu-eap] = handled (13) } # Auth-Type fsu-eap = handled (13) Using Post-Auth-Type Challenge (13) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (13) Challenge { ... } # empty sub-section is ignored (13) Sent Access-Challenge Id 76 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (13) EAP-Message = 0x0103009319001603030055020000510303535c075d9ba79179c49631cfbe31ff45262678a833b2ae1c34e0949ff5ee853a20422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5cc02b000009ff0100010000170000140303000101160303002889c27588c852f56c61f9f2cf794234739860a9e037ffa2c8089ad130dbba4b5d4877e410b28dcf32 (13) Message-Authenticator = 0x00000000000000000000000000000000 (13) State = 0xed876281ec847bf64bfe7e94b8bee491 (13) Finished request (14) Received Access-Request Id 77 from w.x.y.z:54989 to a.b.c.e:1812 length 267 (14) User-Name = "myUsername" (14) NAS-IP-Address = a.b.c.d (14) NAS-Port = 0 (14) NAS-Identifier = "w.x.y.z" (14) NAS-Port-Type = Wireless-802.11 (14) Calling-Station-Id = "Calling-MAC" (14) Called-Station-Id = "Called-MAC" (14) Service-Type = Framed-User (14) Framed-MTU = 1100 (14) EAP-Message = 0x0203003d198000000033140303000101160303002800000000000000008e96422f1c79714e1d0364108107f26591d1473152a392a5e62afcf078383caf (14) State = 0xed876281ec847bf64bfe7e94b8bee491 (14) Aruba-Essid-Name = "FSUCoreX" (14) Aruba-Location-Id = "303H-mark" (14) Aruba-AP-Group = "RAP-VoIP" (14) Aruba-Device-Type = "Win 10" (14) Message-Authenticator = 0x8ecf71006fe00b92f9384c908fb856aa (14) session-state: No cached attributes (14) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (14) authorize { (14) fsu-bad-passwords: EXPAND %{User-Name} (14) fsu-bad-passwords: --> myUsername (14) [fsu-bad-passwords] = noop (14) if (ok) { (14) if (ok) -> FALSE (14) policy rewrite_calling_station_id { (14) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (14) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (14) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (14) update request { (14) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (14) --> Calling-MAC (14) } # update request = noop (14) [updated] = updated (14) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (14) ... skipping else: Preceding "if" was taken (14) } # policy rewrite_calling_station_id = updated (14) fsu-bad-macs: EXPAND %{Calling-Station-ID} (14) fsu-bad-macs: --> Calling-MAC (14) [fsu-bad-macs] = noop (14) if (ok) { (14) if (ok) -> FALSE (14) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (14) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (14) if (&User-Name =~ /^host\//) { (14) if (&User-Name =~ /^host\//) -> FALSE (14) if ( &User-Name =~ /\s/ ) { (14) if ( &User-Name =~ /\s/ ) -> FALSE (14) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (14) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (14) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (14) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (14) if ( &User-Name =~ /(a)my\.fsu$/i ) { (14) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (14) ntdomain: Checking for prefix before "\" (14) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (14) [ntdomain] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (14) suffix: Found realm "NULL" (14) suffix: Adding Stripped-User-Name = "myUsername" (14) suffix: Adding Realm = "NULL" (14) suffix: Authentication realm is LOCAL (14) [suffix] = ok (14) update request { (14) } # update request = noop (14) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (14) fsu-rsa-macs: --> Calling-MAC (14) [fsu-rsa-macs] = noop (14) if (ok) { (14) if (ok) -> FALSE (14) else { (14) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (14) fsu-rsa-atwpa-aruba: --> FSUCoreX (14) [fsu-rsa-atwpa-aruba] = noop (14) if (ok) { (14) if (ok) -> FALSE (14) else { (14) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (14) fsu-rsa-atwpa-cisco: --> (14) [fsu-rsa-atwpa-cisco] = noop (14) if (ok) { (14) if (ok) -> FALSE (14) } # else = noop (14) } # else = noop (14) if (&request:Hint == "RSA") { (14) if (&request:Hint == "RSA") -> FALSE (14) else { (14) fsu-eap: Peer sent EAP Response (code 2) ID 3 length 61 (14) fsu-eap: Continuing tunnel setup (14) [fsu-eap] = ok (14) } # else = ok (14) } # authorize = ok (14) Found Auth-Type = fsu-eap (14) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (14) Auth-Type fsu-eap { (14) fsu-eap: Expiring EAP session with state 0xed876281ec847bf6 (14) fsu-eap: Finished EAP session with state 0xed876281ec847bf6 (14) fsu-eap: Previous EAP request found for state 0xed876281ec847bf6, released from the list (14) fsu-eap: Peer sent packet with method EAP PEAP (25) (14) fsu-eap: Calling submodule eap_peap to process data (14) eap_peap: Continuing EAP-TLS (14) eap_peap: Peer indicated complete TLS record size will be 51 bytes (14) eap_peap: Got complete TLS record (51 bytes) (14) eap_peap: [eaptls verify] = length included (14) eap_peap: TLS_accept: SSLv3/TLS write finished (14) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (14) eap_peap: TLS_accept: SSLv3/TLS read finished (14) eap_peap: (other): SSL negotiation finished successfully (14) eap_peap: TLS - Connection Established (14) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (14) eap_peap: TLS-Session-Version = "TLS 1.2" (14) eap_peap: TLS - Application data. (14) eap_peap: Adding cached attributes from session 422008cb2218eec0c9b9213653c1024e54e214c181dd0ef4731faa91f9095c5c (14) eap_peap: &reply:Stripped-User-Name = "myUsername" (14) eap_peap: &session-state:My-Local-VLAN = "vlan1" (14) eap_peap: [eaptls process] = success (14) eap_peap: Session established. Decoding tunneled attributes (14) eap_peap: PEAP state TUNNEL ESTABLISHED (14) eap_peap: Skipping Phase2 because of session resumption (14) eap_peap: SUCCESS (14) fsu-eap: Sending EAP Request (code 1) ID 4 length 46 (14) fsu-eap: EAP session adding &reply:State = 0xed876281ef837bf6 (14) [fsu-eap] = handled (14) } # Auth-Type fsu-eap = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (14) Challenge { ... } # empty sub-section is ignored (14) session-state: Saving cached attributes (14) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (14) TLS-Session-Version = "TLS 1.2" (14) My-Local-VLAN = "vlan1" (14) Sent Access-Challenge Id 77 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (14) EAP-Message = 0x0104002e1900170303002389c27588c852f56d03998abf7aa436f822de6761ff8fa87d41936d48062a9435b3d6b6 (14) Message-Authenticator = 0x00000000000000000000000000000000 (14) State = 0xed876281ef837bf64bfe7e94b8bee491 (14) Finished request (15) Received Access-Request Id 78 from w.x.y.z:54989 to a.b.c.e:1812 length 252 (15) User-Name = "myUsername" (15) NAS-IP-Address = a.b.c.d (15) NAS-Port = 0 (15) NAS-Identifier = "w.x.y.z" (15) NAS-Port-Type = Wireless-802.11 (15) Calling-Station-Id = "Calling-MAC" (15) Called-Station-Id = "Called-MAC" (15) Service-Type = Framed-User (15) Framed-MTU = 1100 (15) EAP-Message = 0x0204002e190017030300230000000000000001df1ace71998c697ac31fb2855c4002515ba65690aab44afcc4278e (15) State = 0xed876281ef837bf64bfe7e94b8bee491 (15) Aruba-Essid-Name = "FSUCoreX" (15) Aruba-Location-Id = "303H-mark" (15) Aruba-AP-Group = "RAP-VoIP" (15) Aruba-Device-Type = "Win 10" (15) Message-Authenticator = 0x8f6ecf737fe491dfb9ce940b13a95d3d (15) Restoring &session-state (15) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (15) &session-state:TLS-Session-Version = "TLS 1.2" (15) &session-state:My-Local-VLAN = "vlan1" (15) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (15) authorize { (15) fsu-bad-passwords: EXPAND %{User-Name} (15) fsu-bad-passwords: --> myUsername (15) [fsu-bad-passwords] = noop (15) if (ok) { (15) if (ok) -> FALSE (15) policy rewrite_calling_station_id { (15) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (15) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (15) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (15) update request { (15) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (15) --> Calling-MAC (15) } # update request = noop (15) [updated] = updated (15) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (15) ... skipping else: Preceding "if" was taken (15) } # policy rewrite_calling_station_id = updated (15) fsu-bad-macs: EXPAND %{Calling-Station-ID} (15) fsu-bad-macs: --> Calling-MAC (15) [fsu-bad-macs] = noop (15) if (ok) { (15) if (ok) -> FALSE (15) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (15) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (15) if (&User-Name =~ /^host\//) { (15) if (&User-Name =~ /^host\//) -> FALSE (15) if ( &User-Name =~ /\s/ ) { (15) if ( &User-Name =~ /\s/ ) -> FALSE (15) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (15) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (15) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (15) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (15) if ( &User-Name =~ /(a)my\.fsu$/i ) { (15) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (15) ntdomain: Checking for prefix before "\" (15) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (15) [ntdomain] = noop (15) suffix: Checking for suffix after "@" (15) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (15) suffix: Found realm "NULL" (15) suffix: Adding Stripped-User-Name = "myUsername" (15) suffix: Adding Realm = "NULL" (15) suffix: Authentication realm is LOCAL (15) [suffix] = ok (15) update request { (15) } # update request = noop (15) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (15) fsu-rsa-macs: --> Calling-MAC (15) [fsu-rsa-macs] = noop (15) if (ok) { (15) if (ok) -> FALSE (15) else { (15) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (15) fsu-rsa-atwpa-aruba: --> FSUCoreX (15) [fsu-rsa-atwpa-aruba] = noop (15) if (ok) { (15) if (ok) -> FALSE (15) else { (15) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (15) fsu-rsa-atwpa-cisco: --> (15) [fsu-rsa-atwpa-cisco] = noop (15) if (ok) { (15) if (ok) -> FALSE (15) } # else = noop (15) } # else = noop (15) if (&request:Hint == "RSA") { (15) if (&request:Hint == "RSA") -> FALSE (15) else { (15) fsu-eap: Peer sent EAP Response (code 2) ID 4 length 46 (15) fsu-eap: Continuing tunnel setup (15) [fsu-eap] = ok (15) } # else = ok (15) } # authorize = ok (15) Found Auth-Type = fsu-eap (15) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (15) Auth-Type fsu-eap { (15) fsu-eap: Expiring EAP session with state 0xed876281ef837bf6 (15) fsu-eap: Finished EAP session with state 0xed876281ef837bf6 (15) fsu-eap: Previous EAP request found for state 0xed876281ef837bf6, released from the list (15) fsu-eap: Peer sent packet with method EAP PEAP (25) (15) fsu-eap: Calling submodule eap_peap to process data (15) eap_peap: Continuing EAP-TLS (15) eap_peap: [eaptls verify] = ok (15) eap_peap: Done initial handshake (15) eap_peap: [eaptls process] = ok (15) eap_peap: Session established. Decoding tunneled attributes (15) eap_peap: PEAP state send tlv success (15) eap_peap: Received EAP-TLV response (15) eap_peap: Client rejected our response. The password is probably incorrect (15) eap_peap: Client rejected session resumption. Re-starting full authentication (15) fsu-eap: Sending EAP Request (code 1) ID 5 length 40 (15) fsu-eap: EAP session adding &reply:State = 0xed876281ee827bf6 (15) [fsu-eap] = handled (15) } # Auth-Type fsu-eap = handled (15) Using Post-Auth-Type Challenge (15) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (15) Challenge { ... } # empty sub-section is ignored (15) session-state: Saving cached attributes (15) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (15) TLS-Session-Version = "TLS 1.2" (15) My-Local-VLAN = "vlan1" (15) Sent Access-Challenge Id 78 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (15) EAP-Message = 0x010500281900170303001d89c27588c852f56eae73f7eeb5abced29ab24cd1c66e6aee6ff95dde12 (15) Message-Authenticator = 0x00000000000000000000000000000000 (15) State = 0xed876281ee827bf64bfe7e94b8bee491 (15) Finished request (16) Received Access-Request Id 79 from w.x.y.z:54989 to a.b.c.e:1812 length 250 (16) User-Name = "myUsername" (16) NAS-IP-Address = a.b.c.d (16) NAS-Port = 0 (16) NAS-Identifier = "w.x.y.z" (16) NAS-Port-Type = Wireless-802.11 (16) Calling-Station-Id = "Calling-MAC" (16) Called-Station-Id = "Called-MAC" (16) Service-Type = Framed-User (16) Framed-MTU = 1100 (16) EAP-Message = 0x0205002c19001703030021000000000000000282558f8dd6938dc7f2fc9e87fe2dbd243191b612d5c9595c1d (16) State = 0xed876281ee827bf64bfe7e94b8bee491 (16) Aruba-Essid-Name = "FSUCoreX" (16) Aruba-Location-Id = "303H-mark" (16) Aruba-AP-Group = "RAP-VoIP" (16) Aruba-Device-Type = "Win 10" (16) Message-Authenticator = 0x0323fd4fec32900b263af0272dba6948 (16) Restoring &session-state (16) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (16) &session-state:TLS-Session-Version = "TLS 1.2" (16) &session-state:My-Local-VLAN = "vlan1" (16) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (16) authorize { (16) fsu-bad-passwords: EXPAND %{User-Name} (16) fsu-bad-passwords: --> myUsername (16) [fsu-bad-passwords] = noop (16) if (ok) { (16) if (ok) -> FALSE (16) policy rewrite_calling_station_id { (16) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (16) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (16) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (16) update request { (16) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (16) --> Calling-MAC (16) } # update request = noop (16) [updated] = updated (16) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (16) ... skipping else: Preceding "if" was taken (16) } # policy rewrite_calling_station_id = updated (16) fsu-bad-macs: EXPAND %{Calling-Station-ID} (16) fsu-bad-macs: --> Calling-MAC (16) [fsu-bad-macs] = noop (16) if (ok) { (16) if (ok) -> FALSE (16) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (16) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (16) if (&User-Name =~ /^host\//) { (16) if (&User-Name =~ /^host\//) -> FALSE (16) if ( &User-Name =~ /\s/ ) { (16) if ( &User-Name =~ /\s/ ) -> FALSE (16) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (16) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (16) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (16) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (16) if ( &User-Name =~ /(a)my\.fsu$/i ) { (16) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (16) ntdomain: Checking for prefix before "\" (16) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (16) [ntdomain] = noop (16) suffix: Checking for suffix after "@" (16) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (16) suffix: Found realm "NULL" (16) suffix: Adding Stripped-User-Name = "myUsername" (16) suffix: Adding Realm = "NULL" (16) suffix: Authentication realm is LOCAL (16) [suffix] = ok (16) update request { (16) } # update request = noop (16) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (16) fsu-rsa-macs: --> Calling-MAC (16) [fsu-rsa-macs] = noop (16) if (ok) { (16) if (ok) -> FALSE (16) else { (16) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (16) fsu-rsa-atwpa-aruba: --> FSUCoreX (16) [fsu-rsa-atwpa-aruba] = noop (16) if (ok) { (16) if (ok) -> FALSE (16) else { (16) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (16) fsu-rsa-atwpa-cisco: --> (16) [fsu-rsa-atwpa-cisco] = noop (16) if (ok) { (16) if (ok) -> FALSE (16) } # else = noop (16) } # else = noop (16) if (&request:Hint == "RSA") { (16) if (&request:Hint == "RSA") -> FALSE (16) else { (16) fsu-eap: Peer sent EAP Response (code 2) ID 5 length 44 (16) fsu-eap: Continuing tunnel setup (16) [fsu-eap] = ok (16) } # else = ok (16) } # authorize = ok (16) Found Auth-Type = fsu-eap (16) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (16) Auth-Type fsu-eap { (16) fsu-eap: Expiring EAP session with state 0xed876281ee827bf6 (16) fsu-eap: Finished EAP session with state 0xed876281ee827bf6 (16) fsu-eap: Previous EAP request found for state 0xed876281ee827bf6, released from the list (16) fsu-eap: Peer sent packet with method EAP PEAP (25) (16) fsu-eap: Calling submodule eap_peap to process data (16) eap_peap: Continuing EAP-TLS (16) eap_peap: [eaptls verify] = ok (16) eap_peap: Done initial handshake (16) eap_peap: [eaptls process] = ok (16) eap_peap: Session established. Decoding tunneled attributes (16) eap_peap: PEAP state WAITING FOR INNER IDENTITY (16) eap_peap: Identity - myUsername (16) eap_peap: Got inner identity 'myUsername' (16) eap_peap: Setting default EAP type for tunneled EAP session (16) eap_peap: Got tunneled request (16) eap_peap: EAP-Message = 0x0205000d016d616e74686f6e79 (16) eap_peap: Setting User-Name to myUsername (16) eap_peap: Sending tunneled request to fsu-peap-inner-tunnel (16) eap_peap: EAP-Message = 0x0205000d016d616e74686f6e79 (16) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (16) eap_peap: User-Name = "myUsername" (16) Virtual server fsu-peap-inner-tunnel received request (16) EAP-Message = 0x0205000d016d616e74686f6e79 (16) FreeRADIUS-Proxied-To = 127.0.0.1 (16) User-Name = "myUsername" (16)G: Outer and inner identities are the same. User privacy is compromised. (16) server fsu-peap-inner-tunnel { (16) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (16) authorize { (16) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (16) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (16) if ( &User-Name =~ /\s/ ) { (16) if ( &User-Name =~ /\s/ ) -> FALSE (16) suffix: Checking for suffix after "@" (16) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (16) suffix: Found realm "NULL" (16) suffix: Adding Stripped-User-Name = "myUsername" (16) suffix: Adding Realm = "NULL" (16) suffix: Authentication realm is LOCAL (16) [suffix] = ok (16) update { (16) EXPAND %{Client-Shortname} (16) --> Cam2 (16) } # update = noop (16) fsu-eap: Peer sent EAP Response (code 2) ID 5 length 13 (16) fsu-eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (16) [fsu-eap] = ok (16) } # authorize = ok (16) Found Auth-Type = fsu-eap (16) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (16) Auth-Type fsu-eap { (16) fsu-eap: Peer sent packet with method EAP Identity (1) (16) fsu-eap: Calling submodule eap_mschapv2 to process data (16) eap_mschapv2: Issuing Challenge (16) fsu-eap: Sending EAP Request (code 1) ID 6 length 42 (16) fsu-eap: EAP session adding &reply:State = 0x6295751762936f56 (16) [fsu-eap] = handled (16) } # Auth-Type fsu-eap = handled (16) } # server fsu-peap-inner-tunnel (16) Virtual server sending reply (16) EAP-Message = 0x0106002a1a01060025109f50784156a46729b0cf55b725fe519e6673755f6561705f6d73636861707632 (16) Message-Authenticator = 0x00000000000000000000000000000000 (16) State = 0x6295751762936f5699fbad14c2f8e6da (16) eap_peap: Got tunneled reply code 11 (16) eap_peap: EAP-Message = 0x0106002a1a01060025109f50784156a46729b0cf55b725fe519e6673755f6561705f6d73636861707632 (16) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (16) eap_peap: State = 0x6295751762936f5699fbad14c2f8e6da (16) eap_peap: Got tunneled Access-Challenge (16) fsu-eap: Sending EAP Request (code 1) ID 6 length 73 (16) fsu-eap: EAP session adding &reply:State = 0xed876281e9817bf6 (16) [fsu-eap] = handled (16) } # Auth-Type fsu-eap = handled (16) Using Post-Auth-Type Challenge (16) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (16) Challenge { ... } # empty sub-section is ignored (16) session-state: Saving cached attributes (16) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (16) TLS-Session-Version = "TLS 1.2" (16) My-Local-VLAN = "vlan1" (16) Sent Access-Challenge Id 79 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (16) EAP-Message = 0x010600491900170303003e89c27588c852f56f98c1d1a9fa6d0cc0a1e10e32209323a00f2555899d0c5b91cfa2736c4e76b4e6395920f98ab9de29bc0d8add2be3043afcff649388d1 (16) Message-Authenticator = 0x00000000000000000000000000000000 (16) State = 0xed876281e9817bf64bfe7e94b8bee491 (16) Finished request (17) Received Access-Request Id 80 from w.x.y.z:54989 to a.b.c.e:1812 length 304 (17) User-Name = "myUsername" (17) NAS-IP-Address = a.b.c.d (17) NAS-Port = 0 (17) NAS-Identifier = "w.x.y.z" (17) NAS-Port-Type = Wireless-802.11 (17) Calling-Station-Id = "Calling-MAC" (17) Called-Station-Id = "Called-MAC" (17) Service-Type = Framed-User (17) Framed-MTU = 1100 (17) EAP-Message = 0x02060062190017030300570000000000000003b9e70fd69206a3d7a95ab9ac375fe2dc092d419ab0150d028624f3aef3776408b084186a1725af7691dfa0111e22d0016deef88177d33c53ade442ae16ea9b365f036d82f0a5b06eae811cc7eee242 (17) State = 0xed876281e9817bf64bfe7e94b8bee491 (17) Aruba-Essid-Name = "FSUCoreX" (17) Aruba-Location-Id = "303H-mark" (17) Aruba-AP-Group = "RAP-VoIP" (17) Aruba-Device-Type = "Win 10" (17) Message-Authenticator = 0xd65c14c6e79e81442cb62c7af5845f07 (17) Restoring &session-state (17) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (17) &session-state:TLS-Session-Version = "TLS 1.2" (17) &session-state:My-Local-VLAN = "vlan1" (17) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (17) authorize { (17) fsu-bad-passwords: EXPAND %{User-Name} (17) fsu-bad-passwords: --> myUsername (17) [fsu-bad-passwords] = noop (17) if (ok) { (17) if (ok) -> FALSE (17) policy rewrite_calling_station_id { (17) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (17) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (17) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (17) update request { (17) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (17) --> Calling-MAC (17) } # update request = noop (17) [updated] = updated (17) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (17) ... skipping else: Preceding "if" was taken (17) } # policy rewrite_calling_station_id = updated (17) fsu-bad-macs: EXPAND %{Calling-Station-ID} (17) fsu-bad-macs: --> Calling-MAC (17) [fsu-bad-macs] = noop (17) if (ok) { (17) if (ok) -> FALSE (17) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (17) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (17) if (&User-Name =~ /^host\//) { (17) if (&User-Name =~ /^host\//) -> FALSE (17) if ( &User-Name =~ /\s/ ) { (17) if ( &User-Name =~ /\s/ ) -> FALSE (17) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (17) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (17) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (17) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (17) if ( &User-Name =~ /(a)my\.fsu$/i ) { (17) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (17) ntdomain: Checking for prefix before "\" (17) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (17) [ntdomain] = noop (17) suffix: Checking for suffix after "@" (17) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (17) suffix: Found realm "NULL" (17) suffix: Adding Stripped-User-Name = "myUsername" (17) suffix: Adding Realm = "NULL" (17) suffix: Authentication realm is LOCAL (17) [suffix] = ok (17) update request { (17) } # update request = noop (17) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (17) fsu-rsa-macs: --> Calling-MAC (17) [fsu-rsa-macs] = noop (17) if (ok) { (17) if (ok) -> FALSE (17) else { (17) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (17) fsu-rsa-atwpa-aruba: --> FSUCoreX (17) [fsu-rsa-atwpa-aruba] = noop (17) if (ok) { (17) if (ok) -> FALSE (17) else { (17) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (17) fsu-rsa-atwpa-cisco: --> (17) [fsu-rsa-atwpa-cisco] = noop (17) if (ok) { (17) if (ok) -> FALSE (17) } # else = noop (17) } # else = noop (17) if (&request:Hint == "RSA") { (17) if (&request:Hint == "RSA") -> FALSE (17) else { (17) fsu-eap: Peer sent EAP Response (code 2) ID 6 length 98 (17) fsu-eap: Continuing tunnel setup (17) [fsu-eap] = ok (17) } # else = ok (17) } # authorize = ok (17) Found Auth-Type = fsu-eap (17) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (17) Auth-Type fsu-eap { (17) fsu-eap: Expiring EAP session with state 0x6295751762936f56 (17) fsu-eap: Finished EAP session with state 0xed876281e9817bf6 (17) fsu-eap: Previous EAP request found for state 0xed876281e9817bf6, released from the list (17) fsu-eap: Peer sent packet with method EAP PEAP (25) (17) fsu-eap: Calling submodule eap_peap to process data (17) eap_peap: Continuing EAP-TLS (17) eap_peap: [eaptls verify] = ok (17) eap_peap: Done initial handshake (17) eap_peap: [eaptls process] = ok (17) eap_peap: Session established. Decoding tunneled attributes (17) eap_peap: PEAP state phase2 (17) eap_peap: EAP method MSCHAPv2 (26) (17) eap_peap: Got tunneled request (17) eap_peap: EAP-Message = 0x020600431a0206003e315f7e3ca3f8250759d5875f3b03820d250000000000000000bd11aaca3c823d8c2cd3779eb03a248abe0580965b154b9d006d616e74686f6e79 (17) eap_peap: Setting User-Name to myUsername (17) eap_peap: Sending tunneled request to fsu-peap-inner-tunnel (17) eap_peap: EAP-Message = 0x020600431a0206003e315f7e3ca3f8250759d5875f3b03820d250000000000000000bd11aaca3c823d8c2cd3779eb03a248abe0580965b154b9d006d616e74686f6e79 (17) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (17) eap_peap: User-Name = "myUsername" (17) eap_peap: State = 0x6295751762936f5699fbad14c2f8e6da (17) Virtual server fsu-peap-inner-tunnel received request (17) EAP-Message = 0x020600431a0206003e315f7e3ca3f8250759d5875f3b03820d250000000000000000bd11aaca3c823d8c2cd3779eb03a248abe0580965b154b9d006d616e74686f6e79 (17) FreeRADIUS-Proxied-To = 127.0.0.1 (17) User-Name = "myUsername" (17) State = 0x6295751762936f5699fbad14c2f8e6da (17)G: Outer and inner identities are the same. User privacy is compromised. (17) server fsu-peap-inner-tunnel { (17) session-state: No cached attributes (17) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (17) authorize { (17) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (17) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (17) if ( &User-Name =~ /\s/ ) { (17) if ( &User-Name =~ /\s/ ) -> FALSE (17) suffix: Checking for suffix after "@" (17) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (17) suffix: Found realm "NULL" (17) suffix: Adding Stripped-User-Name = "myUsername" (17) suffix: Adding Realm = "NULL" (17) suffix: Authentication realm is LOCAL (17) [suffix] = ok (17) update { (17) EXPAND %{Client-Shortname} (17) --> Cam2 (17) } # update = noop (17) fsu-eap: Peer sent EAP Response (code 2) ID 6 length 67 (17) fsu-eap: No EAP Start, assuming it's an on-going EAP conversation (17) [fsu-eap] = updated (17) if ( &EAP-Message =~ /^0x02..00061a..$/ ) { (17) if ( &EAP-Message =~ /^0x02..00061a..$/ ) -> FALSE (17) if ( &User-Name =~ /^host\/(COB-RBA[A-Za-z0-9-]+)(\.fsu\.edu)*$/i) { (17) if ( &User-Name =~ /^host\/(COB-RBA[A-Za-z0-9-]+)(\.fsu\.edu)*$/i) -> FALSE (17) elsif (&User-Name =~ /^host\/([A-Z]{2,5}-A-[0-9A-Z]{6,7})(\.fsu\.edu)*$/) { (17) elsif (&User-Name =~ /^host\/([A-Z]{2,5}-A-[0-9A-Z]{6,7})(\.fsu\.edu)*$/) -> FALSE (17) elsif ( (&request:Realm) && (&request:Realm == "devices") ) { (17) elsif ( (&request:Realm) && (&request:Realm == "devices") ) -> FALSE (17) else { (17) fsu-ldap-people: EXPAND (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(!(uid=lib-guest*))) (17) fsu-ldap-people: --> (&(uid=myUsername)(!(uid=lib-guest*))) (17) fsu-ldap-people: Performing search in "ou=people,dc=fsu,dc=edu" with filter "(&(uid=myUsername)(!(uid=lib-guest*)))", scope "sub" (17) fsu-ldap-people: Waiting for search result... (17) fsu-ldap-people: User object found at DN "uid=myUsername,ou=People,dc=fsu,dc=edu" (17) fsu-ldap-people: Processing user attributes (17) [fsu-ldap-people] = updated (17) if (notfound) { (17) if (notfound) -> FALSE (17) if ( &reply:My-Local-fsuEduWINStatus ) { (17) if ( &reply:My-Local-fsuEduWINStatus ) -> FALSE (17) fsu-pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes (17)G: fsu-pap: Auth-Type already set. Not setting to PAP (17) [fsu-pap] = noop (17) update control { (17) } # update control = noop (17) if ( (&reply:My-Local-VLAN) && (!&reply:My-Local-employeeStatus) ) { (17) if ( (&reply:My-Local-VLAN) && (!&reply:My-Local-employeeStatus) ) -> FALSE (17) if (&reply:My-Local-fsuEduAppRoles) { (17) if (&reply:My-Local-fsuEduAppRoles) -> TRUE (17) if (&reply:My-Local-fsuEduAppRoles) { (17) if ((!&reply:My-Local-VLAN) && (&Client-Shortname !~ /^P/)) { (17) if ((!&reply:My-Local-VLAN) && (&Client-Shortname !~ /^P/)) -> FALSE (17) update { (17) } # update = noop (17) } # if (&reply:My-Local-fsuEduAppRoles) = noop (17) if ((!&reply:My-Local-employeeStatus) && (!&reply:My-Local-VLAN)) { (17) if ((!&reply:My-Local-employeeStatus) && (!&reply:My-Local-VLAN)) -> FALSE (17) elsif (!&reply:My-Local-VLAN) { (17) elsif (!&reply:My-Local-VLAN) -> FALSE (17) fsu-cache-ldap-people-inner-tunnel-attributes: EXPAND %{User-Name} (17) fsu-cache-ldap-people-inner-tunnel-attributes: --> myUsername (17) fsu-cache-ldap-people-inner-tunnel-attributes: No cache entry found for "myUsername" (17) fsu-cache-ldap-people-inner-tunnel-attributes: Creating new cache entry (17) fsu-cache-ldap-people-inner-tunnel-attributes: &reply:My-Local-VLAN := &reply:My-Local-VLAN -> 'vlan2' (17) fsu-cache-ldap-people-inner-tunnel-attributes: Merging cache entry into request (17) fsu-cache-ldap-people-inner-tunnel-attributes: &reply:My-Local-VLAN := "vlan2" (17) fsu-cache-ldap-people-inner-tunnel-attributes: Committed entry, TTL 10 seconds (17) [fsu-cache-ldap-people-inner-tunnel-attributes] = updated (17) } # else = updated (17) } # authorize = updated (17) Found Auth-Type = fsu-eap (17) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (17) Auth-Type fsu-eap { (17) fsu-eap: Expiring EAP session with state 0x6295751762936f56 (17) fsu-eap: Finished EAP session with state 0x6295751762936f56 (17) fsu-eap: Previous EAP request found for state 0x6295751762936f56, released from the list (17) fsu-eap: Peer sent packet with method EAP MSCHAPv2 (26) (17) fsu-eap: Calling submodule eap_mschapv2 to process data (17) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (17) eap_mschapv2: Auth-Type MS-CHAP { (17) fsu-mschap-winbind: Found NT-Password (17) fsu-mschap-winbind: Creating challenge hash with username: myUsername (17) fsu-mschap-winbind: Client is using MS-CHAPv2 (17) fsu-mschap-winbind: Adding MS-CHAPv2 MPPE keys (17) eap_mschapv2: [fsu-mschap-winbind] = ok (17) eap_mschapv2: } # Auth-Type MS-CHAP = ok (17) eap_mschapv2: MSCHAP Success (17) fsu-eap: Sending EAP Request (code 1) ID 7 length 51 (17) fsu-eap: EAP session adding &reply:State = 0x6295751763926f56 (17) [fsu-eap] = handled (17) } # Auth-Type fsu-eap = handled (17) } # server fsu-peap-inner-tunnel (17) Virtual server sending reply (17) My-Local-employeeStatus = "Active" (17) My-Local-VLAN = "vlan2" (17) EAP-Message = 0x010700331a0306002e533d30453232363542464230323643314536413241423936443939354644443543343538423931444235 (17) Message-Authenticator = 0x00000000000000000000000000000000 (17) State = 0x6295751763926f5699fbad14c2f8e6da (17) eap_peap: Got tunneled reply code 11 (17) eap_peap: My-Local-employeeStatus = "Active" (17) eap_peap: My-Local-VLAN = "vlan2" (17) eap_peap: EAP-Message = 0x010700331a0306002e533d30453232363542464230323643314536413241423936443939354644443543343538423931444235 (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (17) eap_peap: State = 0x6295751763926f5699fbad14c2f8e6da (17) eap_peap: Got tunneled Access-Challenge (17) fsu-eap: Sending EAP Request (code 1) ID 7 length 82 (17) fsu-eap: EAP session adding &reply:State = 0xed876281e8807bf6 (17) [fsu-eap] = handled (17) } # Auth-Type fsu-eap = handled (17) Using Post-Auth-Type Challenge (17) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (17) Challenge { ... } # empty sub-section is ignored (17) session-state: Saving cached attributes (17) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (17) TLS-Session-Version = "TLS 1.2" (17) My-Local-VLAN = "vlan1" (17) Sent Access-Challenge Id 80 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (17) EAP-Message = 0x010700521900170303004789c27588c852f57045aba025448705421526a0428cd53ca921a53102d6ba99fb07e81bab3ab01057cf487def2a59e6022f25e43177c85bed11c9d233cd9d04307552cca530e3f2 (17) Message-Authenticator = 0x00000000000000000000000000000000 (17) State = 0xed876281e8807bf64bfe7e94b8bee491 (17) Finished request (18) Received Access-Request Id 81 from w.x.y.z:54989 to a.b.c.e:1812 length 243 (18) User-Name = "myUsername" (18) NAS-IP-Address = a.b.c.d (18) NAS-Port = 0 (18) NAS-Identifier = "w.x.y.z" (18) NAS-Port-Type = Wireless-802.11 (18) Calling-Station-Id = "Calling-MAC" (18) Called-Station-Id = "Called-MAC" (18) Service-Type = Framed-User (18) Framed-MTU = 1100 (18) EAP-Message = 0x020700251900170303001a00000000000000048d403c8866333c3a2458917f40809eb5d560 (18) State = 0xed876281e8807bf64bfe7e94b8bee491 (18) Aruba-Essid-Name = "FSUCoreX" (18) Aruba-Location-Id = "303H-mark" (18) Aruba-AP-Group = "RAP-VoIP" (18) Aruba-Device-Type = "Win 10" (18) Message-Authenticator = 0x652291c2e70a5b6b3eaeccfb35ec9c3e (18) Restoring &session-state (18) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (18) &session-state:TLS-Session-Version = "TLS 1.2" (18) &session-state:My-Local-VLAN = "vlan1" (18) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (18) authorize { (18) fsu-bad-passwords: EXPAND %{User-Name} (18) fsu-bad-passwords: --> myUsername (18) [fsu-bad-passwords] = noop (18) if (ok) { (18) if (ok) -> FALSE (18) policy rewrite_calling_station_id { (18) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (18) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (18) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (18) update request { (18) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (18) --> Calling-MAC (18) } # update request = noop (18) [updated] = updated (18) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (18) ... skipping else: Preceding "if" was taken (18) } # policy rewrite_calling_station_id = updated (18) fsu-bad-macs: EXPAND %{Calling-Station-ID} (18) fsu-bad-macs: --> Calling-MAC (18) [fsu-bad-macs] = noop (18) if (ok) { (18) if (ok) -> FALSE (18) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (18) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (18) if (&User-Name =~ /^host\//) { (18) if (&User-Name =~ /^host\//) -> FALSE (18) if ( &User-Name =~ /\s/ ) { (18) if ( &User-Name =~ /\s/ ) -> FALSE (18) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (18) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (18) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (18) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (18) if ( &User-Name =~ /(a)my\.fsu$/i ) { (18) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (18) ntdomain: Checking for prefix before "\" (18) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (18) [ntdomain] = noop (18) suffix: Checking for suffix after "@" (18) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (18) suffix: Found realm "NULL" (18) suffix: Adding Stripped-User-Name = "myUsername" (18) suffix: Adding Realm = "NULL" (18) suffix: Authentication realm is LOCAL (18) [suffix] = ok (18) update request { (18) } # update request = noop (18) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (18) fsu-rsa-macs: --> Calling-MAC (18) [fsu-rsa-macs] = noop (18) if (ok) { (18) if (ok) -> FALSE (18) else { (18) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (18) fsu-rsa-atwpa-aruba: --> FSUCoreX (18) [fsu-rsa-atwpa-aruba] = noop (18) if (ok) { (18) if (ok) -> FALSE (18) else { (18) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (18) fsu-rsa-atwpa-cisco: --> (18) [fsu-rsa-atwpa-cisco] = noop (18) if (ok) { (18) if (ok) -> FALSE (18) } # else = noop (18) } # else = noop (18) if (&request:Hint == "RSA") { (18) if (&request:Hint == "RSA") -> FALSE (18) else { (18) fsu-eap: Peer sent EAP Response (code 2) ID 7 length 37 (18) fsu-eap: Continuing tunnel setup (18) [fsu-eap] = ok (18) } # else = ok (18) } # authorize = ok (18) Found Auth-Type = fsu-eap (18) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (18) Auth-Type fsu-eap { (18) fsu-eap: Expiring EAP session with state 0x6295751763926f56 (18) fsu-eap: Finished EAP session with state 0xed876281e8807bf6 (18) fsu-eap: Previous EAP request found for state 0xed876281e8807bf6, released from the list (18) fsu-eap: Peer sent packet with method EAP PEAP (25) (18) fsu-eap: Calling submodule eap_peap to process data (18) eap_peap: Continuing EAP-TLS (18) eap_peap: [eaptls verify] = ok (18) eap_peap: Done initial handshake (18) eap_peap: [eaptls process] = ok (18) eap_peap: Session established. Decoding tunneled attributes (18) eap_peap: PEAP state phase2 (18) eap_peap: EAP method MSCHAPv2 (26) (18) eap_peap: Got tunneled request (18) eap_peap: EAP-Message = 0x020700061a03 (18) eap_peap: Setting User-Name to myUsername (18) eap_peap: Sending tunneled request to fsu-peap-inner-tunnel (18) eap_peap: EAP-Message = 0x020700061a03 (18) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (18) eap_peap: User-Name = "myUsername" (18) eap_peap: State = 0x6295751763926f5699fbad14c2f8e6da (18) Virtual server fsu-peap-inner-tunnel received request (18) EAP-Message = 0x020700061a03 (18) FreeRADIUS-Proxied-To = 127.0.0.1 (18) User-Name = "myUsername" (18) State = 0x6295751763926f5699fbad14c2f8e6da (18)G: Outer and inner identities are the same. User privacy is compromised. (18) server fsu-peap-inner-tunnel { (18) session-state: No cached attributes (18) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (18) authorize { (18) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (18) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (18) if ( &User-Name =~ /\s/ ) { (18) if ( &User-Name =~ /\s/ ) -> FALSE (18) suffix: Checking for suffix after "@" (18) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (18) suffix: Found realm "NULL" (18) suffix: Adding Stripped-User-Name = "myUsername" (18) suffix: Adding Realm = "NULL" (18) suffix: Authentication realm is LOCAL (18) [suffix] = ok (18) update { (18) EXPAND %{Client-Shortname} (18) --> Cam2 (18) } # update = noop (18) fsu-eap: Peer sent EAP Response (code 2) ID 7 length 6 (18) fsu-eap: No EAP Start, assuming it's an on-going EAP conversation (18) [fsu-eap] = updated (18) if ( &EAP-Message =~ /^0x02..00061a..$/ ) { (18) if ( &EAP-Message =~ /^0x02..00061a..$/ ) -> TRUE (18) if ( &EAP-Message =~ /^0x02..00061a..$/ ) { (18) policy fsu-peap-cache-policy { (18) if ( &User-Name =~ /@devices/ ){ (18) if ( &User-Name =~ /@devices/ ) -> FALSE (18) else { (18) fsu-cache-ldap-people-inner-tunnel-attributes: EXPAND %{User-Name} (18) fsu-cache-ldap-people-inner-tunnel-attributes: --> myUsername (18) fsu-cache-ldap-people-inner-tunnel-attributes: Found entry for "myUsername" (18) fsu-cache-ldap-people-inner-tunnel-attributes: Merging cache entry into request (18) fsu-cache-ldap-people-inner-tunnel-attributes: &reply:My-Local-VLAN := "vlan2" (18) [fsu-cache-ldap-people-inner-tunnel-attributes] = ok (18) if (updated) { (18) if (updated) -> FALSE (18) elsif (noop) { (18) elsif (noop) -> FALSE (18) elsif (ok) { (18) elsif (ok) -> TRUE (18) elsif (ok) { (18) update control { (18) } # update control = noop (18) } # elsif (ok) = noop (18) ... skipping else: Preceding "if" was taken (18) } # else = ok (18) } # policy fsu-peap-cache-policy = ok (18) return (18) } # if ( &EAP-Message =~ /^0x02..00061a..$/ ) = ok (18) } # authorize = updated (18) Found Auth-Type = fsu-eap (18) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (18) Auth-Type fsu-eap { (18) fsu-eap: Expiring EAP session with state 0x6295751763926f56 (18) fsu-eap: Finished EAP session with state 0x6295751763926f56 (18) fsu-eap: Previous EAP request found for state 0x6295751763926f56, released from the list (18) fsu-eap: Peer sent packet with method EAP MSCHAPv2 (26) (18) fsu-eap: Calling submodule eap_mschapv2 to process data (18) fsu-eap: Sending EAP Success (code 3) ID 7 length 4 (18) fsu-eap: Freeing handler (18) [fsu-eap] = ok (18) } # Auth-Type fsu-eap = ok (18) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/fsu-peap-inner-tunnel (18) post-auth { (18) update reply { (18) } # update reply = noop (18) update outer.session-state { (18) } # update outer.session-state = noop (18) } # post-auth = noop (18) EXPAND %{My-Local-SSID} %{My-Local-AP} %{My-Local-Group} %{My-Local-Device} %{reply:My-Local-VLAN} (18) --> vlan2 (18) } # server fsu-peap-inner-tunnel (18) Virtual server sending reply (18) My-Local-VLAN = "vlan2" (18) eap_peap: Got tunneled reply code 2 (18) eap_peap: My-Local-VLAN = "vlan2" (18) eap_peap: Tunneled authentication was successful (18) eap_peap: SUCCESS (18) eap_peap: Saving tunneled attributes for later (18) fsu-eap: Sending EAP Request (code 1) ID 8 length 46 (18) fsu-eap: EAP session adding &reply:State = 0xed876281eb8f7bf6 (18) [fsu-eap] = handled (18) } # Auth-Type fsu-eap = handled (18) Using Post-Auth-Type Challenge (18) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (18) Challenge { ... } # empty sub-section is ignored (18) session-state: Saving cached attributes (18) TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (18) TLS-Session-Version = "TLS 1.2" (18) My-Local-VLAN := "vlan2" (18) Sent Access-Challenge Id 81 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (18) EAP-Message = 0x0108002e1900170303002389c27588c852f5715e6c41502105700e5214de10b96118258b9bc05e08f83024124f92 (18) Message-Authenticator = 0x00000000000000000000000000000000 (18) State = 0xed876281eb8f7bf64bfe7e94b8bee491 (18) Finished request (19) Received Access-Request Id 82 from w.x.y.z:54989 to a.b.c.e:1812 length 252 (19) User-Name = "myUsername" (19) NAS-IP-Address = a.b.c.d (19) NAS-Port = 0 (19) NAS-Identifier = "w.x.y.z" (19) NAS-Port-Type = Wireless-802.11 (19) Calling-Station-Id = "Calling-MAC" (19) Called-Station-Id = "Called-MAC" (19) Service-Type = Framed-User (19) Framed-MTU = 1100 (19) EAP-Message = 0x0208002e190017030300230000000000000005b340395d206b4b01c23ec16546b856e439347ccfb389a5358bf72a (19) State = 0xed876281eb8f7bf64bfe7e94b8bee491 (19) Aruba-Essid-Name = "FSUCoreX" (19) Aruba-Location-Id = "303H-mark" (19) Aruba-AP-Group = "RAP-VoIP" (19) Aruba-Device-Type = "Win 10" (19) Message-Authenticator = 0x627c9e1982dd68cca2ae68b38deb7992 (19) Restoring &session-state (19) &session-state:TLS-Session-Cipher-Suite = "ECDHE-ECDSA-AES128-GCM-SHA256" (19) &session-state:TLS-Session-Version = "TLS 1.2" (19) &session-state:My-Local-VLAN := "vlan2" (19) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (19) authorize { (19) fsu-bad-passwords: EXPAND %{User-Name} (19) fsu-bad-passwords: --> myUsername (19) [fsu-bad-passwords] = noop (19) if (ok) { (19) if (ok) -> FALSE (19) policy rewrite_calling_station_id { (19) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (19) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) -> TRUE (19) if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) { (19) update request { (19) EXPAND %{toupper:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} (19) --> Calling-MAC (19) } # update request = noop (19) [updated] = updated (19) } # if (&Calling-Station-Id && (&Calling-Station-Id =~ /^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$/i)) = updated (19) ... skipping else: Preceding "if" was taken (19) } # policy rewrite_calling_station_id = updated (19) fsu-bad-macs: EXPAND %{Calling-Station-ID} (19) fsu-bad-macs: --> Calling-MAC (19) [fsu-bad-macs] = noop (19) if (ok) { (19) if (ok) -> FALSE (19) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) { (19) if ( ( ! &User-Name ) || ( &User-Name == "" ) ) -> FALSE (19) if (&User-Name =~ /^host\//) { (19) if (&User-Name =~ /^host\//) -> FALSE (19) if ( &User-Name =~ /\s/ ) { (19) if ( &User-Name =~ /\s/ ) -> FALSE (19) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) { (19) if (( &User-Name =~ /^.*\\/ ) && ( &User-Name !~ /^med\\/i )) -> FALSE (19) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) { (19) if ((&User-Name =~ /(a)med.fsu.edu/i) || (&User-Name =~ /@wlan\.[[:alnum:]]+\.[[:alnum:]]+\.3gppnetwork\.org$/i)) -> FALSE (19) if ( &User-Name =~ /(a)my\.fsu$/i ) { (19) if ( &User-Name =~ /(a)my\.fsu$/i ) -> FALSE (19) ntdomain: Checking for prefix before "\" (19) ntdomain: No '\' in User-Name = "myUsername", skipping NULL due to config. (19) [ntdomain] = noop (19) suffix: Checking for suffix after "@" (19) suffix: No '@' in User-Name = "myUsername", looking up realm NULL (19) suffix: Found realm "NULL" (19) suffix: Adding Stripped-User-Name = "myUsername" (19) suffix: Adding Realm = "NULL" (19) suffix: Authentication realm is LOCAL (19) [suffix] = ok (19) update request { (19) } # update request = noop (19) fsu-rsa-macs: EXPAND %{Calling-Station-ID} (19) fsu-rsa-macs: --> Calling-MAC (19) [fsu-rsa-macs] = noop (19) if (ok) { (19) if (ok) -> FALSE (19) else { (19) fsu-rsa-atwpa-aruba: EXPAND %{Aruba-Essid-Name} (19) fsu-rsa-atwpa-aruba: --> FSUCoreX (19) [fsu-rsa-atwpa-aruba] = noop (19) if (ok) { (19) if (ok) -> FALSE (19) else { (19) fsu-rsa-atwpa-cisco: EXPAND %{Airespace-Wlan-Id} (19) fsu-rsa-atwpa-cisco: --> (19) [fsu-rsa-atwpa-cisco] = noop (19) if (ok) { (19) if (ok) -> FALSE (19) } # else = noop (19) } # else = noop (19) if (&request:Hint == "RSA") { (19) if (&request:Hint == "RSA") -> FALSE (19) else { (19) fsu-eap: Peer sent EAP Response (code 2) ID 8 length 46 (19) fsu-eap: Continuing tunnel setup (19) [fsu-eap] = ok (19) } # else = ok (19) } # authorize = ok (19) Found Auth-Type = fsu-eap (19) # Executing group from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (19) Auth-Type fsu-eap { (19) fsu-eap: Expiring EAP session with state 0xed876281eb8f7bf6 (19) fsu-eap: Finished EAP session with state 0xed876281eb8f7bf6 (19) fsu-eap: Previous EAP request found for state 0xed876281eb8f7bf6, released from the list (19) fsu-eap: Peer sent packet with method EAP PEAP (25) (19) fsu-eap: Calling submodule eap_peap to process data (19) eap_peap: Continuing EAP-TLS (19) eap_peap: [eaptls verify] = ok (19) eap_peap: Done initial handshake (19) eap_peap: [eaptls process] = ok (19) eap_peap: Session established. Decoding tunneled attributes (19) eap_peap: PEAP state send tlv success (19) eap_peap: Received EAP-TLV response (19) eap_peap: Success (19) eap_peap: Using saved attributes from the original Access-Accept (19) eap_peap: My-Local-VLAN = "vlan2" (19) eap_peap: &request:EAP-Session-Resumed := 1 (19) fsu-eap: Sending EAP Success (code 3) ID 8 length 4 (19) fsu-eap: Freeing handler (19) [fsu-eap] = ok (19) } # Auth-Type fsu-eap = ok (19) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/fsu-peap-1812 (19) post-auth { (19) update reply { (19) } # update reply = noop (19) if ( &reply:My-Local-VLAN == "student" ) { (19) if ( &reply:My-Local-VLAN == "student" ) -> FALSE (19) policy fsu-SSID-and-VLAN-policy { (19) update { (19) } # update = noop (19) if ( &Aruba-Essid-Name ) { (19) if ( &Aruba-Essid-Name ) -> TRUE (19) if ( &Aruba-Essid-Name ) { (19) update { (19) } # update = noop (19) if ( &My-Local-AP =~ /^(.*?)(\.wireless)?(\.fsu\.edu)$/i ) { (19) if ( &My-Local-AP =~ /^(.*?)(\.wireless)?(\.fsu\.edu)$/i ) -> FALSE (19) if ( &My-Local-Group =~ /^(.+) (.+$)/ ) { (19) if ( &My-Local-Group =~ /^(.+) (.+$)/ ) -> FALSE (19) } # if ( &Aruba-Essid-Name ) = noop (19) ... skipping elsif: Preceding "if" was taken (19) ... skipping elsif: Preceding "if" was taken (19) ... skipping else: Preceding "if" was taken (19) if (( !&My-Local-Device ) || ( &My-Local-Device == '' )) { (19) if (( !&My-Local-Device ) || ( &My-Local-Device == '' )) -> FALSE (19) elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) { (19) elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) -> TRUE (19) elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) { (19) update { (19) EXPAND %{1}_%{2} (19) --> Win_10 (19) } # update = noop (19) } # elsif ( &My-Local-Device =~ /^(.+) (.+$)/ ) = noop (19) } # policy fsu-SSID-and-VLAN-policy = noop (19) } # post-auth = noop (19) EXPAND %{My-Local-SSID} %{My-Local-AP} %{My-Local-Group} %{My-Local-Device} %{reply:My-Local-VLAN} (19) --> FSUCoreX 303H-mark RAP-VoIP Win_10 vlan2 (19) Sent Access-Accept Id 82 from a.b.c.e:1812 to w.x.y.z:54989 length 0 (19) MS-MPPE-Recv-Key = 0xfc57aa43d0064c088b6c4375f15801b657c140dce3bbf3f12d588b495c095e46 (19) MS-MPPE-Send-Key = 0x27eb19dc16c19e8d22e9feb7c2b80cc7bc2840f2569955a368777696ef4d8bb6 (19) EAP-Message = 0x03080004 (19) Message-Authenticator = 0x00000000000000000000000000000000 (19) User-Name = "myUsername" (19) Aruba-User-Vlan := vlan2 (19) Finished request (12) Cleaning up request packet ID 75 with timestamp +136 (13) Cleaning up request packet ID 76 with timestamp +136 (14) Cleaning up request packet ID 77 with timestamp +137 (15) Cleaning up request packet ID 78 with timestamp +137 (16) Cleaning up request packet ID 79 with timestamp +137 (17) Cleaning up request packet ID 80 with timestamp +137 (18) Cleaning up request packet ID 81 with timestamp +137 (19) Cleaning up request packet ID 82 with timestamp +137

2 1

Re: Anamoly in TLS Session Resumption
by Doug Wussler 19 Feb '21

19 Feb '21

I should have specified that we are using FreeRADIUS Version 3.0.20 Doug

2 1

delete posts
by Janis Heller 18 Feb '21

18 Feb '21

Dear admin, because of identity fraud, please remove my whole post here: http://lists.freeradius.org/pipermail/freeradius-users/2016-October/085222.… Thanks a lot, please leave me a short reply. All the best and stay save during covid19.

1 0

Re: v4: Can't see TLS certificate fields from `send Access-Accept` section anymore
by Nick Bogdanov 18 Feb '21

18 Feb '21

>> In v4 I can see the cert fields in the `recv Access-Request` section >> (after setting `virtual_server = default` in mods-available/eap) but >> they are all empty when I try to read them from the `send >> Access-Accept` section. In fact, if I uncomment these sections from >> the default config, the fields are all empty too: > Look at the debug output. You should be able to see when these attributes are added (or not). Hi Alan, They are getting set under "authenticate eap" and they are being correctly parsed under "recv Access-Request". But then when I hit the "send Access-Accept" step, they all vanish: (14) Received Access-Request ID 237 from [redacted] to [redacted] length 397 via socket radius_udp server * port 1812 (14) User-Name = "a" (14) NAS-IP-Address = [redacted] (14) NAS-Identifier = [redacted] (14) Called-Station-Id = [redacted] (14) NAS-Port-Type = Wireless-802.11 (14) Service-Type = Framed-User (14) Calling-Station-Id = [redacted] (14) Connect-Info = "CONNECT 0Mbps 802.11b" (14) Acct-Session-Id = [redacted] (14) Acct-Multi-Session-Id = [redacted] (14) Mobility-Domain-Id = 21689 (14) WLAN-Pairwise-Cipher.OUI = [redacted] (14) WLAN-Pairwise-Cipher.Suite-Type = 4 (14) WLAN-Group-Cipher.OUI = [redacted] (14) WLAN-Group-Cipher.Type = 4 (14) WLAN-AKM-Suite.OUI = [redacted] (14) WLAN-AKM-Suite.Suite-Type = 3 (14) Framed-MTU = 1400 (14) EAP-Message = [redacted] (14) State = [redacted] (14) Message-Authenticator = [redacted] (14) Running request (14,8) Restored &session-state (14,8) &session-state.Session-State-User-Name = "a" (14,8) Running 'recv Access-Request' from file /root/freeradius-server/pfx/etc/raddb/sites-enabled/default (14,8) recv Access-Request { (14,8) policy filter_username { (14,8) if (&State) { (14,8) if (&User-Name) { (14,8) if (!&session-state.Session-State-User-Name) { (14,8) ... (14,8) } (14,8) if (&User-Name != &session-state.Session-State-User-Name) { (14,8) ... (14,8) } (14,8) } # if (&User-Name) (...) (14,8) } # if (&State) (...) (14,8) } # policy filter_username (...) (14,8) eap - Peer sent EAP Response (code 2) ID 19 length 153 (14,8) eap - Continuing on-going EAP conversation (14,8) eap - Setting &control.Auth-Type = eap (14,8) eap (updated) (14,8) if ("%{session-state.TLS-Client-Cert-Common-Name}" != '') { (14,8) EXPAND %{session-state.TLS-Client-Cert-Common-Name} (14,8) --> (14,8) ... (14,8) } (14,8) files - EXPAND %{session-state.TLS-Client-Cert-Common-Name} (14,8) files - --> (14,8) files (noop) (14,8) expiration (noop) (14,8) logintime (noop) (14,8) pap (noop) (14,8) } # recv Access-Request (updated) (14,8) Running 'authenticate eap' from file /root/freeradius-server/pfx/etc/raddb/sites-enabled/default (14,8) authenticate eap { (14,8) eap - Continuing EAP session (14,8) eap - Peer sent packet with EAP method TLS (13) (14,8) eap - Calling submodule eap_tls (14,8) eap (noop) (14,8) subrequest { (14,8) Creating subrequest (14.0) (14,8) EAP-Type = TLS (14,8) EAP-Identity = "a" (14.0) eap.tls - Continuing EAP-TLS (14.0) eap.tls - Got final TLS record fragment (147 bytes) (14.0) eap.tls - [eap-tls verify] = complete (14.0) eap.tls - Handshake state - Server SSLv3/TLS write server done (26) (14.0) eap.tls - <<< recv TLS 1.2, handshake[length 2543], unknown_handshake_type_0x000b (14.0) eap.tls - [verify chain] = ok (14.0) eap.tls - Adding certificate attributes to session-state (14.0) eap.tls - &session-state.TLS-Cert-Serial = [redacted] (14.0) eap.tls - &session-state.TLS-Cert-Expiration = "Jun 11 1979 21:19:41 UTC" (14.0) eap.tls - &session-state.TLS-Cert-Subject = [redacted] (14.0) eap.tls - &session-state.TLS-Cert-Common-Name = [redacted] (14.0) eap.tls - &session-state.TLS-Cert-Issuer = [redacted] (14.0) eap.tls - [verify chain] = ok (14.0) eap.tls - Adding certificate attributes to session-state (14.0) eap.tls - &session-state.TLS-Client-Cert-Serial = [redacted] (14.0) eap.tls - &session-state.TLS-Client-Cert-Expiration = [redacted] (14.0) eap.tls - &session-state.TLS-Client-Cert-Subject = [redacted] (14.0) eap.tls - &session-state.TLS-Client-Cert-Common-Name = [redacted] (14.0) eap.tls - &session-state.TLS-Client-Cert-Issuer = [redacted] (14.0) eap.tls - &session-state.TLS-Client-Cert-X509v3-Basic-Constraints = "CA:FALSE" (14.0) eap.tls - &session-state.TLS-Client-Cert-X509v3-Subject-Key-Identifier = [redacted] (14.0) eap.tls - &session-state.TLS-Client-Cert-X509v3-Authority-Key-Identifier = [redacted] (14.0) eap.tls - [verify client] = ok (14.0) eap.tls - Handshake state - Server SSLv3/TLS read client certificate (27) (14.0) eap.tls - <<< recv TLS 1.2, handshake[length 70], unknown_handshake_type_0x0010 (14.0) eap.tls - Handshake state - Server SSLv3/TLS read client key exchange (28) (14.0) eap.tls - <<< recv TLS 1.2, handshake[length 264], unknown_handshake_type_0x000f (14.0) eap.tls - Handshake state - Server SSLv3/TLS read certificate verify (29) (14.0) eap.tls - Handshake state - Server SSLv3/TLS read change cipher spec (31) (14.0) eap.tls - <<< recv TLS 1.2, handshake[length 16], unknown_handshake_type_0x0014 (14.0) eap.tls - Handshake state - Server SSLv3/TLS read finished (32) (14.0) eap.tls - >>> send TLS 1.2, change_cipher_spec[length 1] (14.0) eap.tls - Handshake state - Server SSLv3/TLS write change cipher spec (35) (14.0) eap.tls - >>> send TLS 1.2, handshake[length 16], unknown_handshake_type_0x0014 (14.0) eap.tls - Handshake state - Server SSLv3/TLS write finished (36) (14.0) eap.tls - Handshake state - SSL negotiation finished successfully (1) (14.0) eap.tls - Cipher suite: ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD (14.0) eap.tls - Adding TLS session information to request (14.0) eap.tls - &session-state.TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (14.0) eap.tls - &session-state.TLS-Session-Version := "TLS 1.2" (14.0) eap.tls - Sending complete TLS record (51 bytes) (14.0) eap.tls - [eap-tls process] = handled (14.0) eap.tls (handled) (14,8) } # subrequest (handled) (14,8) eap - Sending EAP Request (code 1) ID 20 length 61 (14,8) eap (handled) (14,8) } # authenticate eap (handled) (14,8) Running 'send Access-Challenge' from file /root/freeradius-server/pfx/etc/raddb/sites-enabled/default (14,8) send Access-Challenge { (14,8) attr_filter.access_challenge - EXPAND %{User-Name} (14,8) attr_filter.access_challenge - --> a (14,8) attr_filter.access_challenge - Matched entry DEFAULT at line 12 (14,8) attr_filter.access_challenge.post-auth (updated) (14,8) handled (handled) (14,8) } # send Access-Challenge (handled) (14,8) Saving &session-state (14,8) &session-state.Session-State-User-Name = "a" (14,8) Done request (14,8) Sending Access-Challenge ID 237 from [redacted] to [redacted] length 119 via socket radius_udp server * port 1812 (14,8) State = [redacted] (14,8) Message-Authenticator = [redacted] (14,8) EAP-Message = [redacted] (14,8) Finished request proto_radius_udp - cleaning up request in 5.000000s proto_radius_udp - Received Access-Request ID 238 length 250 radius_udp server * port 1812 (15) Received Access-Request ID 238 from [redacted] to [redacted] length 250 via socket radius_udp server * port 1812 (15) User-Name = "a" (15) NAS-IP-Address = [redacted] (15) NAS-Identifier = [redacted] (15) Called-Station-Id = [redacted] (15) NAS-Port-Type = Wireless-802.11 (15) Service-Type = Framed-User (15) Calling-Station-Id = [redacted] (15) Connect-Info = "CONNECT 0Mbps 802.11b" (15) Acct-Session-Id = [redacted] (15) Acct-Multi-Session-Id = [redacted] (15) Mobility-Domain-Id = 21689 (15) WLAN-Pairwise-Cipher.OUI = [redacted] (15) WLAN-Pairwise-Cipher.Suite-Type = 4 (15) WLAN-Group-Cipher.OUI = [redacted] (15) WLAN-Group-Cipher.Type = 4 (15) WLAN-AKM-Suite.OUI = [redacted] (15) WLAN-AKM-Suite.Suite-Type = 3 (15) Framed-MTU = 1400 (15) EAP-Message = [redacted] (15) State = [redacted] (15) Message-Authenticator = [redacted] (15) Running request (15,8) Restored &session-state (15,8) &session-state.Session-State-User-Name = "a" (15,8) Running 'recv Access-Request' from file /root/freeradius-server/pfx/etc/raddb/sites-enabled/default (15,8) recv Access-Request { (15,8) policy filter_username { (15,8) if (&State) { (15,8) if (&User-Name) { (15,8) if (!&session-state.Session-State-User-Name) { (15,8) ... (15,8) } (15,8) if (&User-Name != &session-state.Session-State-User-Name) { (15,8) ... (15,8) } (15,8) } # if (&User-Name) (...) (15,8) } # if (&State) (...) (15,8) } # policy filter_username (...) (15,8) eap - Peer sent EAP Response (code 2) ID 20 length 6 (15,8) eap - Continuing on-going EAP conversation (15,8) eap - Setting &control.Auth-Type = eap (15,8) eap (updated) (15,8) if ("%{session-state.TLS-Client-Cert-Common-Name}" != '') { (15,8) EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15,8) --> (15,8) ... (15,8) } (15,8) files - EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15,8) files - --> (15,8) files (noop) (15,8) expiration (noop) (15,8) logintime (noop) (15,8) pap (noop) (15,8) } # recv Access-Request (updated) (15,8) Running 'authenticate eap' from file /root/freeradius-server/pfx/etc/raddb/sites-enabled/default (15,8) authenticate eap { (15,8) eap - Continuing EAP session (15,8) eap - Peer sent packet with EAP method TLS (13) (15,8) eap - Calling submodule eap_tls (15,8) eap (noop) (15,8) subrequest { (15,8) Creating subrequest (15.0) (15,8) EAP-Type = TLS (15,8) EAP-Identity = "a" (15.0) eap.tls - Continuing EAP-TLS (15.0) eap.tls - Peer ACKed our handshake fragment. handshake is finished (15.0) eap.tls - [eap-tls verify] = established (15.0) eap.tls - [eap-tls process] = established (15.0) eap.tls - Validating certificate (15.0) eap.tls (yield) (15.0) recv Access-Request { (15.0) policy filter_username { (15.0) if (&State) { (15.0) ... (15.0) } (15.0) elsif (&User-Name) { (15.0) ... (15.0) } (15.0) } # policy filter_username (...) (15.0) eap - No EAP-Message, not doing EAP (15.0) eap (noop) (15.0) if ("%{session-state.TLS-Client-Cert-Common-Name}" != '') { (15.0) EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15.0) --> [redacted] (15.0) files - EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15.0) files - --> [redacted] (15.0) files - Found match "[redacted]" on line 3 of /root/freeradius-server/pfx/etc/raddb/mods-config/files/authorize (15.0) files (ok) (15.0) if (!ok) { (15.0) ... (15.0) } (15.0) update reply { (15.0) &Tunnel-Type = VLAN (15.0) &Tunnel-Medium-Type = IEEE-802 (15.0) } # update reply (noop) (15.0) if ("%{session-state.TLS-Client-Cert-Subject}" =~ /[redacted]/) { (15.0) EXPAND %{session-state.TLS-Client-Cert-Subject} (15.0) --> /CN=[redacted] (15.0) ... (15.0) } (15.0) elsif ("%{session-state.TLS-Client-Cert-Subject}" =~ /[redacted]/) { (15.0) EXPAND %{session-state.TLS-Client-Cert-Subject} (15.0) --> /CN=[redacted] (15.0) update reply { (15.0) &Tunnel-Private-Group-Id = "7" (15.0) } # update reply (noop) (15.0) update session-state { (15.0) &Tmp-String-9 = "7" (15.0) } # update session-state (noop) (15.0) } # elsif ("%{session-state.TLS-Client-Cert-Subject}" =~ /[redacted]/) (noop) (15.0) } # if ("%{session-state.TLS-Client-Cert-Common-Name}" != '') (ok) (15.0) files - EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15.0) files - --> [redacted] (15.0) files - Found match "[redacted]" on line 3 of /root/freeradius-server/pfx/etc/raddb/mods-config/files/authorize (15.0) files (ok) (15.0) expiration (noop) (15.0) logintime (noop) (15.0) pap - No User-Password attribute in the request. Cannot do PAP (15.0) pap (noop) (15.0) } # recv Access-Request (ok) (15.0) No session data available to cache (15,8) Adding session keys (15,8) &reply.Vendor-Specific.Microsoft.MPPE-Recv-Key = [redacted] (15,8) &reply.Vendor-Specific.Microsoft.MPPE-Send-Key = [redacted] (15,8) &reply.EAP-MSK = [redacted] (15,8) &reply.EAP-EMSK = [redacted] (15.0) &reply.EAP-Session-Id = [redacted] (15,8) } # subrequest (ok) (15,8) eap - Sending EAP Success (code 3) ID 20 length 4 (15,8) eap - Cleaning up EAP session (15,8) eap (ok) (15,8) } # authenticate eap (ok) (15,8) Running 'send Access-Accept' from file /root/freeradius-server/pfx/etc/raddb/sites-enabled/default (15,8) send Access-Accept { (15,8) update { (15,8) &reply += &session-state -> "a" (15,8) } # update (noop) (15,8) eap (noop) (15,8) update reply { (15,8) EXPAND %{session-state.TLS-Cert-Serial} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Expiration} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Subject} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Issuer} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Common-Name} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Subject-Alt-Name-Email} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Serial} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Expiration} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Issuer} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject-Alt-Name-Email} (15,8) --> (null) (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) } # update reply (noop) (15,8) update reply { (15,8) EXPAND %{session-state.Tmp-String-9} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject} (15,8) --> (null) (15,8) &Tunnel-Type = VLAN (15,8) &Tunnel-Medium-Type = IEEE-802 (15,8) &Tunnel-Private-Group-Id = "" (15,8) &Tmp-String-9 := "" (15,8) } # update reply (noop) (15,8) if ("%{reply.Tunnel-Private-Group-Id}" == "") { (15,8) EXPAND %{reply.Tunnel-Private-Group-Id} (15,8) --> (15,8) reject (reject) (15,8) } # if ("%{reply.Tunnel-Private-Group-Id}" == "") (reject) (15,8) } # send Access-Accept (reject) (15,8) WARNING: Failed running 'send Access-Accept', trying 'send Access-Reject' Notes: 1) The above log also reflects some unsuccessful experiments I was doing to try to get the Tunnel-Private-Group-Id to propagate to the Access-Accept stage, so some of the variable assignments might not make sense. 2) I don't think session-state.TLS-Cert-Expiration is being parsed correctly. 3) I didn't enable delivery of every freeradius-users message, so if you could cc: me on replies that would be much appreciated.

2 4

v4: Can't see TLS certificate fields from `send Access-Accept` section anymore
by Nick Bogdanov 17 Feb '21

17 Feb '21

I am using EAP-TLS authentication and trying to read the %{session-state.TLS-Client-Cert-Subject} attribute in order to set the reply.Tunnel-Private-Group-Id field. In v3 I could just add this to my post-auth section: if (TLS-Client-Cert-Subject =~ /\/OU=VLAN 1\//) { update reply { &Tunnel-Private-Group-Id = "1" } } In v4 I can see the cert fields in the `recv Access-Request` section (after setting `virtual_server = default` in mods-available/eap) but they are all empty when I try to read them from the `send Access-Accept` section. In fact, if I uncomment these sections from the default config, the fields are all empty too: # update reply { # &Reply-Message += "%{session-state.TLS-Cert-Serial}" # &Reply-Message += "%{session-state.TLS-Cert-Expiration}" # &Reply-Message += "%{session-state.TLS-Cert-Subject}" # &Reply-Message += "%{session-state.TLS-Cert-Issuer}" # &Reply-Message += "%{session-state.TLS-Cert-Common-Name}" # &Reply-Message += "%{session-state.TLS-Cert-Subject-Alt-Name-Email}" # # &Reply-Message += "%{session-state.TLS-Client-Cert-Serial}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Expiration}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Subject}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Issuer}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Common-Name}" # &Reply-Message += "%{session-state.TLS-Client-Cert-Subject-Alt-Name-Email}" # } The log says: (15,8) update reply { (15,8) EXPAND %{session-state.TLS-Cert-Serial} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Expiration} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Subject} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Issuer} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Common-Name} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Cert-Subject-Alt-Name-Email} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Serial} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Expiration} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Issuer} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Common-Name} (15,8) --> (null) (15,8) EXPAND %{session-state.TLS-Client-Cert-Subject-Alt-Name-Email} (15,8) --> (null) (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) &Reply-Message += "" (15,8) } # update reply (noop) I am running git rev 89b77dc09571cb4ac3cd4d639aee6c17bea23182, built from source. I saw something in upgrade.adoc about using the `filter` directive but it wasn't clear to me what that meant. Am I missing something simple or is this a bug?

2 1

advice for breaking an array of vendor attributes into local attributes and updating a database
by Matt Zagrabelny 16 Feb '21

16 Feb '21

Greetings FR-users, Scenario: I receive an accounting packet from a Cisco NAS. It has an array of Cisco-AVPair tuples that FR processes. I am hoping to break out the various Cisco-AVPair tuples into key-value pairs to insert into a database. I am starting with a single (and specific) Cisco-AVPair. Snippets of freeradius -X follows... Here is the AVP in the accounting packet... (23) Cisco-AVPair = "mdm-tlv=device-platform-version=10.0.18363 " Here is my unlang... (23) elsif ("%{Foreach-Variable-0}" =~ /^mdm-tlv=device-platform-version=(.*?) *$/) { (23) update reply { (23) EXPAND %{1} (23) --> 10.0.18363 (23) &Local-MDM-TLV-Device-Platform-Version := 10.0.18363 (23) } # update reply = noop Here is the SQL... (23) sql_netdb: EXPAND UPDATE radius_accounting SET [...] cisco_device_platform_version = NULLIF('%{Local-MDM-TLV-Device-Platform-Version}', '') [...] WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND AcctStopTime IS NULL (23) sql_netdb: --> UPDATE radius_accounting SET [...] cisco_device_platform_version = NULLIF('', '') [...] WHERE AcctUniqueId = 'FOOBAR' AND AcctStopTime IS NULL You can see the attribute Local-MDM-TLV-Device-Platform-Version is the empty string in the SQL. I am having success with the foreach statement and a regex. In my default site: accounting { [...] foreach Cisco-AVPair { if ("%{Foreach-Variable-0}" =~ /^mdm-tlv=device-platform-version=(.*?) *$/) { update reply { &Local-MDM-TLV-Device-Platform-Version := "%{1}" } } } [...] } My dictionary looks like: ATTRIBUTE Local-MDM-TLV-Device-Platform-Version 7772 string Am I using the wrong section in my default site for attempting to set a local (internal) attribute? I know that I am using "update reply" in my unlang. That doesn't feel correct for accounting unlang, but I'll need correction or confirmation in that area. Any advice for breaking an array of vendor attributes into local attributes and then updating a database with those local attributes? Thank you for any help or hints! -m

2 1

NAS-Filter-Rule incorrectly encoded as string
by Pablo Nogueira 16 Feb '21

16 Feb '21

Hello, first post here. I'm trying to implement dynamic access lists for 802.1X authenticated users. To do so, I'm using attribute NAS-Filter-Rule, as defined in RFC 4849 and FreeRADIUS Version 3.0.21 as the RADIUS server. To do so, I've modified users file with the following entry user1 Cleartext-Password := "pass1" Service-Type = Framed-User, Nas-filter-Rule = "permit in tcp from any to 10.2.3.4/24", Nas-filter-Rule += 0x00, Nas-filter-Rule += "permit in ip from 192.168.101.5/32 to 192.168.101.1", Nas-filter-Rule += 0x00, Nas-filter-Rule += "deny in ip from any to any", Nas-filter-Rule += 0x00 According to RFC 4849 "The String field is one or more octets. It contains filter rules in the IPFilterRule syntax defined in [RFC3588], Section 4.3, with individual filter rules separated by a NUL (0x00). A NAS-Filter- Rule attribute may contain a partial rule, one rule, or more than one rule. Filter rules may be continued across attribute boundaries, so implementations cannot assume that individual filter rules begin or end on attribute boundaries. The set of NAS-Filter-Rule attributes SHOULD be created by concatenating the individual filter rules, separated by a NUL (0x00) octet. The resulting data should be split on 253-octet boundaries to obtain a set of NAS-Filter-Rule attributes. On reception, the individual filter rules are determined by concatenating the contents of all NAS-Filter-Rule attributes, and then splitting individual filter rules with the NUL octet (0x00) as a delimiter. " In my example above, RADIUS server is sending NAS-Filter-Rule as a string, thus converting 0x00 into strings "0x00". If I remove the 0x00, then rules are not NUL separated which goes against the RFC, share/dictionary/radius/dictionary.rfc4849 defines NAS-Filter-Rule as ATTRIBUTE NAS-Filter-Rule 92 string I've been able to make it work as I think it should adding the following line to my dictionary # override NAS-Filter-Rule to convey NUL character between rules ATTRIBUTE NAS-Filter-Rule 92 octets My question is, is there any other way to force freeradius to send the entry rules as strings with NUL terminated character? Should I report this as an issue (bug) to freeradius developers so that they change the dictionary.rfc4849 entry? I hope my question is clear. Best regards Pablo

2 3

Accounting Packet not sent
by Michael Fischer 16 Feb '21

16 Feb '21

Hi! My goal is to authenticate WiFi-Users via FreeRadius with an eDirectory backend. FreeRadius should then send an accounting packet to a FortiGate firewall where a SSO agent is running. The authentication part is working find, a user can connect to the WiFi. As far as I understood it, I should configure FreeRadius to write a detail file which is then parsed an an accounting package sent to the Fortigate firewall. I configured a realm in proxy.conf: realm Fortigate { accthost = 172.16.1.253 secret = *********** } And I enabled the site "copy-accounting-to-home-server" with the following configuration: server copy-acct-to-home-server { listen { type = detail filename = ${radacctdir}/detail-* load_factor = 10 } preacct { preprocess suffix files update control { Proxy-To-Realm := 'Fortigate' } } accounting { ok } pre-proxy { } post-proxy { } } Reading the detail file seems to work fine, but no accounting package is sent to the FortiGate firewall (I even checked using Wireshark). See a part of the debug-log here: (9) Login OK: [fimi] (from client private-network-1 port 0 cli F4-60- E2-B3-96-5C) (9) Sent Access-Accept Id 107 from 172.16.1.104:1812 to 192.168.251.51:39578 length 0 (9) Class := 0x54657374 (9) MS-MPPE-Recv-Key = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea (9) MS-MPPE-Send-Key = 0x1120b9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 (9) EAP-Message = 0x03d10004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name += "fimi" (9) Finished request Waking up in 4.8 seconds. detail (/var/log/radius/radacct/detail-*): Polling for detail file detail (/var/log/radius/radacct/detail-*): Renaming /var/log/radius/radacct/detail-192.168.251.51-20210216 -> /var/log/radius/radacct/detail.work detail (/var/log/radius/radacct/detail-*): Read packet from /var/log/radius/radacct/detail.work Packet-Type = Access-Accept Class = 0x54657374 User-Name = "fimi" MS-MPPE-Recv-Key = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea MS-MPPE-Send-Key = 0x1120b9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 EAP-MSK = 0x28765691676b5035b99c8aa3b2b5bb8c1e9b4b3e32a457239e11df0cdac127ea1120b 9224c29ff96b3ed507b19eabd80bb1c7728772cbe8305a876cede81c224 EAP-EMSK = 0xd3a64e1f290603568302a9f6c13c3ae00eaea0f45caeff1503b5609e2faf9b06be114 12f1243564b0a08b8df5d58cc33235989699b860f0171b9b73a29bb0e36 EAP-Session-Id = 0x19c2bce2a85918a3ba9ea0068fd39acacb8173753f6c2a19ac67249b606157c82923f 2dacd82dc178f0df970ea5031e0e57b82ad5100de437f43b4f8303af37cae EAP-Message = 0x03d10004 Message-Authenticator = 0x00000000000000000000000000000000 Packet-Original-Timestamp = "Feb 16 2021 14:22:24 CET" Packet-Transmit-Counter = 1 Waking up in 4.6 seconds. See full debug-log attached. I would really appreciate your help! Thanks, Mike

2 3

Multiple sqlippool with different Module-Success-Message values
by Zoltán Kristofóri 16 Feb '21

16 Feb '21

Hello Everyone! First of all I am glad to be here! But i got stuck on a problem. I am calling two different sqlippool module for IP address allocation (IPv4 and IPv6). My problem is that I need send both module result message to the linelog module. It should be easy because the sqlippool module writes the control:Module-Success-Message. But as far as I can see the Module-Success-Message field is not updated the second time. site configuration: post-auth { ... sqlippool_v4 log_sqlippool .. sqlippool_v6 log_sqlippool } sqlippool module configuration: sqlippool sqlippool_v4 { ... messages { exists = "Existing IPv4: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IPv4: %{reply:${..attribute_name}} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" ... sqlippool sqlippool_v6 { ... messages { exists = "Existing IPv6: %{reply:${..attribute_name}} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" success = "Allocated IPv6: %{reply:${..attribute_name}} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name})" ... linelog module configuration: ... linelog log_sqlippoolv4 { format = "%{control:Module-Success-Message}" filename = syslog permissions = 0600 } Also i can see the problem in debug mode: (1) sqlippool_v4: EXPAND Allocated IPv4: %{reply:Framed-IP-Address} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) sqlippool_v4: --> Allocated IPv4: 10.1.1.1 from xpool (did cli xxx port 134219438 user x) (1) [sqlippool_v4] = ok (1) log_sqlippool: EXPAND %{control:Module-Success-Message} (1) log_sqlippool: --> Allocated IPv4: 10.1.1.1 from xpool (did cli xxx port 134219438 user x) (1) [log_sqlippool] = ok ... (1) sqlippool_v6: EXPAND Allocated IPv6: %{reply:Framed-IPv6-Prefix} from %{control:Pool-Name} (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} user %{User-Name}) (1) sqlippool_v6: --> Allocated IPv6: 2000:::/64 from xpool (did cli xxx port 134219438 user x) (1) [sqlippool_v6] = ok (1) log_sqlippool: EXPAND %{control:Module-Success-Message} (1) log_sqlippool: --> Allocated IPv4: 10.1.1.1 from xpool (did cli xxx port 134219438 user x) (1) [log_sqlippool] = ok Can someone please clarify what am i doing wrong here? Regards!

1 1

user-name with MAC@ format is not accepted
by Hassan, Hazem (Nokia - EG/Cairo) 14 Feb '21

14 Feb '21

Hi , For the matter of getting FreeRadius ready to test , I tried to use some test users (hazem1 , Graham and MAC@) .. hazem1 and Graham went normal but when I edited the user files (adding new user with the given MAC= 64:20:9F:19:5F:53 and adding some AVPs) , it returns the below errors when run "radiusd -X" >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>............................................. tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize /etc/raddb/mods-config/files/authorize[97]: Entry does not begin with a user name Failed reading /etc/raddb/mods-config/files/authorize /etc/raddb/mods-enabled/files[9]: Instantiation failed for module "files" Any idea? Thanks, Hazem

1 3