- Freeradius-Users - lists.freeradius.org

Simultaneous-Use For Group Using Unlang
by det.explorer＠yahoo.com 10 Nov '11

10 Nov '11

Hi, I was able to implement simultaneous-use checking for a group using exec-program-wait attribute. So a user logging in which belongs to the group will be checked against that attribute. It is working but I worry that with too many connections coming from this group of users, it will exhaust the MySQL connection. Because the program used in exec-program-wait opens new connection to MySQL everytime. And even when the program closes the MySQL connection, the port for the connection will not be freed up immediately. It takes sometimes before the port is released. It stays in the close_wait status for sometime. I'd like to implement this using unlang but not sure where to start. The part that I am having difficulty is on where to create the procedure and how to call the procedure. The rest of the things like the DB query I can reuse from the existing program. I want to implement this using unlang to avoid having to open a new MySQL connection. Any example, I can follow? Thanks a lot! Det

4 3

Freeradius proxy to IAS w/SQL attributes?
by Rob Ansaldo 09 Nov '11

09 Nov '11

We are already running a MS IAS Radius server that uses our AD, but what we would like to do is to use FreeRADIUS to proxy requests to our IAS server and add in some vendor specific attributes that we would set in a MySQL database. The IAS server does not have these attributes, nor do we want to use the IAS server for them. What would be preferred is to set the attributes in the MySQL database based on other business logic. These are 802.1x wireless clients connecting to our wireless controller. I have successfully configured FreeRADIUS to proxy the requests from the wireless controller to our IAS server. Where I am having trouble is applying any sort of custom attributes to the response. I can see that the client username is being queried, a group is being obtained and the attributes for that group are being queried but they never appear in the Access-Accept. The configuration uses the default configuration files, except that I have added my wireless controller to clients.conf, a DEFAULT proxy to the IAS server, uncommented the sql section in radius.conf and added the settings for my MySQL server. Is what I am trying to do possible and if so, how would I go about it? The output of radiusd -X is included below: FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Mar 31 2010 at 00:14:28 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } realm DEFAULT { authhost = testradius.amherst.edu:1812 secret = XXXXXXXXXXXXX } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "XXXXXXXXXXX" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "XXXXXXXXXXX" nastype = "other" } client 192.168.34.0/24 { require_message_authenticator = no secret = "XXXXXXXXXXX" shortname = "aruba" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "mysqlserver" port = "" login = "netradius" password = "XXXXXXXXXXXX" radius_db = "netradius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to netradius@mysqlserver:/netradius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=92, length=188 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201000e01726c616e73616c646f Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x51bfcd6a7df72e82a408f91e1cc3ed4d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 181 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201000e01726c616e73616c646f Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3932 Proxying request 0 to home server 192.168.136.13 port 1812 Sending Access-Request of id 181 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0201000e01726c616e73616c646f Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3932 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=181, length=81 Proxy-State = 0x3932 Session-Timeout = 30 EAP-Message = 0x010200061920 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x28583d08bd7a2d9001fe079e02c7bf2a +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 92 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x010200061920 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=93, length=363 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020200a419800000009a16030100950100009103014ebad5a4f5b5ce32aae5210a38f1 6ee9e0073771c81a170a171b93eee846ab08000056c00ac009c007c008c013c014c011c0 12c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600 320033003800390016001500140013001200110034003a0018001b001a00170019000101 000012000a00080006001700180019000b00020100 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0xee85c434b866b80ee815cc20678212e4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 236 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020200a419800000009a16030100950100009103014ebad5a4f5b5ce32aae5210a38f1 6ee9e0073771c81a170a171b93eee846ab08000056c00ac009c007c008c013c014c011c0 12c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600 320033003800390016001500140013001200110034003a0018001b001a00170019000101 000012000a00080006001700180019000b00020100 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3933 Proxying request 1 to home server 192.168.136.13 port 1812 Sending Access-Request of id 236 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020200a419800000009a16030100950100009103014ebad5a4f5b5ce32aae5210a38f1 6ee9e0073771c81a170a171b93eee846ab08000056c00ac009c007c008c013c014c011c0 12c004c005c002c003c00ec00fc00cc00d002f000500040035000a000900030008000600 320033003800390016001500140013001200110034003a0018001b001a00170019000101 000012000a00080006001700180019000b00020100 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3933 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=236, length=1179 Proxy-State = 0x3933 Session-Timeout = 30 EAP-Message = 0x0103044819c000001081160301107c0200004603014ebad59fb96bf68b162d7fce0db2 16d2dab03ffebd4cf613bd1c198ba50b81e02010010000bab4d6364ee63fed5ce7e1ff82 b36b2c2075f59dd0d4eded34c690c20004000b00038a00038700038430820380308202e9 a003020102020314f67d300d06092a864886f70d0101050500304e310b30090603550406 130255533110300e060355040a130745717569666178312d302b060355040b1324457175 696661782053656375726520436572746966696361746520417574686f72697479301e17 0d3130313032343130343631335a170d3135313032353137333032345a3081eb31293027 0603 EAP-Message = 0x55040513206551752d68556a522d796a6b736a637a4d586d4d4c697450366542743762 4b64310b3009060355040613025553311b3019060355040a13127261646975732e616d68 657273742e65647531133011060355040b130a475438353936333230343131302f060355 040b1328536565207777772e726170696473736c2e636f6d2f7265736f75726365732f63 7073202863293130312f302d060355040b1326446f6d61696e20436f6e74726f6c205661 6c696461746564202d20526170696453534c285229311b30190603550403131272616469 75732e616d68657273742e65647530819f300d06092a864886f70d010101050003818d00 3081 EAP-Message = 0x8902818100ca8f09e01854e64db3274ab932dc7eb0d7d61fe034ba14a1c0051d335401 b218dfe41faf82b7663056d370ac4f752f710f7d4a85cfb460680e84fd99db666589f896 f2a6719e74de786519e185bdb4dc41ba738a84396415f51fdeee7b2b67713e1d9647bf5e 0b652852d1396644e57f8b145a08302d6c9eb35885e9777972630203010001a381cd3081 ca301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4300e 0603551d0f0101ff0404030204f0301d0603551d250416301406082b0601050507030106 082b06010505070302301d0603551d110416301482127261646975732e616d6865727374 2e65 EAP-Message = 0x6475303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e67656f 74727573742e636f6d2f63726c732f73656375726563612e63726c301d0603551d0e0416 0414f472fac38af2db9cf0a3d0fa011298825e9f65c6300d06092a864886f70d01010505 000381810021ebfae45db4e72b012f515e9d00b79d714c25047106377d2f534f8a3d7e70 dad9f3a094c8a6d25b0ee1e5e7901601494b4a84487022e1c005f2f367a65274cf1c79d8 195cde2d4f4967ea5fe0f1d3515e19ca0d8e9b30e65d947f0c18f42554eb491db5399aea c0d54ae4d552965c685054906c96d9ed80632bc064c468d7aa0d000c9c0201020c97008d 3081 EAP-Message = 0x8a3122302006092a864886f70d0109011613646d697277696e40616d68657273742e65 6475310b3009060355040613025553310b3009060355040813024d413110300e06035504 071307416d6865727374311830 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0xd30ac4a82ae9e07a58a9a7c80d62be66 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 93 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x0103044819c000001081160301107c0200004603014ebad59fb96bf68b162d7fce0db2 16d2dab03ffebd4cf613bd1c198ba50b81e02010010000bab4d6364ee63fed5ce7e1ff82 b36b2c2075f59dd0d4eded34c690c20004000b00038a00038700038430820380308202e9 a003020102020314f67d300d06092a864886f70d0101050500304e310b30090603550406 130255533110300e060355040a130745717569666178312d302b060355040b1324457175 696661782053656375726520436572746966696361746520417574686f72697479301e17 0d3130313032343130343631335a170d3135313032353137333032345a3081eb31293027 0603 EAP-Message = 0x55040513206551752d68556a522d796a6b736a637a4d586d4d4c697450366542743762 4b64310b3009060355040613025553311b3019060355040a13127261646975732e616d68 657273742e65647531133011060355040b130a475438353936333230343131302f060355 040b1328536565207777772e726170696473736c2e636f6d2f7265736f75726365732f63 7073202863293130312f302d060355040b1326446f6d61696e20436f6e74726f6c205661 6c696461746564202d20526170696453534c285229311b30190603550403131272616469 75732e616d68657273742e65647530819f300d06092a864886f70d010101050003818d00 3081 EAP-Message = 0x8902818100ca8f09e01854e64db3274ab932dc7eb0d7d61fe034ba14a1c0051d335401 b218dfe41faf82b7663056d370ac4f752f710f7d4a85cfb460680e84fd99db666589f896 f2a6719e74de786519e185bdb4dc41ba738a84396415f51fdeee7b2b67713e1d9647bf5e 0b652852d1396644e57f8b145a08302d6c9eb35885e9777972630203010001a381cd3081 ca301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4300e 0603551d0f0101ff0404030204f0301d0603551d250416301406082b0601050507030106 082b06010505070302301d0603551d110416301482127261646975732e616d6865727374 2e65 EAP-Message = 0x6475303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e67656f 74727573742e636f6d2f63726c732f73656375726563612e63726c301d0603551d0e0416 0414f472fac38af2db9cf0a3d0fa011298825e9f65c6300d06092a864886f70d01010505 000381810021ebfae45db4e72b012f515e9d00b79d714c25047106377d2f534f8a3d7e70 dad9f3a094c8a6d25b0ee1e5e7901601494b4a84487022e1c005f2f367a65274cf1c79d8 195cde2d4f4967ea5fe0f1d3515e19ca0d8e9b30e65d947f0c18f42554eb491db5399aea c0d54ae4d552965c685054906c96d9ed80632bc064c468d7aa0d000c9c0201020c97008d 3081 EAP-Message = 0x8a3122302006092a864886f70d0109011613646d697277696e40616d68657273742e65 6475310b3009060355040613025553310b3009060355040813024d413110300e06035504 071307416d6865727374311830 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=94, length=205 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x16b7be78f6ebd3fe99bfe2d7c3608add +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 203 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Proxying request 2 to home server 192.168.136.13 port 1812 Sending Access-Request of id 203 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020300061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3934 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=203, length=1179 Proxy-State = 0x3934 Session-Timeout = 30 EAP-Message = 0x01040448194016060355040a130f416d686572737420436f6c6c656765310c300a0603 55040b1303534e543110300e06035504031307416d686572737400c43081c1310b300906 035504061302555331173015060355040a130e566572695369676e2c20496e632e313c30 3a060355040b1333436c6173732031205075626c6963205072696d617279204365727469 6669636174696f6e20417574686f72697479202d204732313a3038060355040b13312863 29203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a 656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374 204e EAP-Message = 0x6574776f726b00c43081c1310b300906035504061302555331173015060355040a130e 566572695369676e2c20496e632e313c303a060355040b1333436c617373203420507562 6c6963205072696d6172792043657274696669636174696f6e20417574686f7269747920 2d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e 632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504 0b1316566572695369676e205472757374204e6574776f726b00d43081d1310b30090603 55040613025a41311530130603550408130c5765737465726e2043617065311230100603 5504 EAP-Message = 0x0713094361706520546f776e311a3018060355040a131154686177746520436f6e7375 6c74696e6731283026060355040b131f43657274696669636174696f6e20536572766963 6573204469766973696f6e312430220603550403131b54686177746520506572736f6e61 6c20467265656d61696c204341312b302906092a864886f70d010901161c706572736f6e 616c2d667265656d61696c407468617774652e636f6d00d23081cf310b30090603550406 13025a41311530130603550408130c5765737465726e2043617065311230100603550407 13094361706520546f776e311a3018060355040a131154686177746520436f6e73756c74 696e EAP-Message = 0x6731283026060355040b131f43657274696669636174696f6e20536572766963657320 4469766973696f6e312330210603550403131a54686177746520506572736f6e616c2050 72656d69756d204341312a302806092a864886f70d010901161b706572736f6e616c2d70 72656d69756d407468617774652e636f6d0086308183310b300906035504061302555331 2d302b060355040a132446697273742044617461204469676974616c2043657274696669 636174657320496e632e314530430603550403133c466972737420446174612044696769 74616c2043657274696669636174657320496e632e2043657274696669636174696f6e20 4175 EAP-Message = 0x74686f7269747900ce3081cb310b3009060355040613025a4131153013060355040813 0c5765737465726e204361706531123010060355040713094361706520546f776e311a30 18060355040a13115468617774 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x4e1cd34fa93d0d9d923ab17aca49a1f8 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 94 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x01040448194016060355040a130f416d686572737420436f6c6c656765310c300a0603 55040b1303534e543110300e06035504031307416d686572737400c43081c1310b300906 035504061302555331173015060355040a130e566572695369676e2c20496e632e313c30 3a060355040b1333436c6173732031205075626c6963205072696d617279204365727469 6669636174696f6e20417574686f72697479202d204732313a3038060355040b13312863 29203139393820566572695369676e2c20496e632e202d20466f7220617574686f72697a 656420757365206f6e6c79311f301d060355040b1316566572695369676e205472757374 204e EAP-Message = 0x6574776f726b00c43081c1310b300906035504061302555331173015060355040a130e 566572695369676e2c20496e632e313c303a060355040b1333436c617373203420507562 6c6963205072696d6172792043657274696669636174696f6e20417574686f7269747920 2d204732313a3038060355040b1331286329203139393820566572695369676e2c20496e 632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504 0b1316566572695369676e205472757374204e6574776f726b00d43081d1310b30090603 55040613025a41311530130603550408130c5765737465726e2043617065311230100603 5504 EAP-Message = 0x0713094361706520546f776e311a3018060355040a131154686177746520436f6e7375 6c74696e6731283026060355040b131f43657274696669636174696f6e20536572766963 6573204469766973696f6e312430220603550403131b54686177746520506572736f6e61 6c20467265656d61696c204341312b302906092a864886f70d010901161c706572736f6e 616c2d667265656d61696c407468617774652e636f6d00d23081cf310b30090603550406 13025a41311530130603550408130c5765737465726e2043617065311230100603550407 13094361706520546f776e311a3018060355040a131154686177746520436f6e73756c74 696e EAP-Message = 0x6731283026060355040b131f43657274696669636174696f6e20536572766963657320 4469766973696f6e312330210603550403131a54686177746520506572736f6e616c2050 72656d69756d204341312a302806092a864886f70d010901161b706572736f6e616c2d70 72656d69756d407468617774652e636f6d0086308183310b300906035504061302555331 2d302b060355040a132446697273742044617461204469676974616c2043657274696669 636174657320496e632e314530430603550403133c466972737420446174612044696769 74616c2043657274696669636174657320496e632e2043657274696669636174696f6e20 4175 EAP-Message = 0x74686f7269747900ce3081cb310b3009060355040613025a4131153013060355040813 0c5765737465726e204361706531123010060355040713094361706520546f776e311a30 18060355040a13115468617774 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=95, length=205 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020400061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0xc5c6a339035f71e54aae688feeb3587e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 50 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020400061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3935 Proxying request 3 to home server 192.168.136.13 port 1812 Sending Access-Request of id 50 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020400061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3935 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=50, length=1179 Proxy-State = 0x3935 Session-Timeout = 30 EAP-Message = 0x0105044819406520436f6e73756c74696e6731283026060355040b131f436572746966 69636174696f6e205365727669636573204469766973696f6e3121301f06035504031318 54686177746520506572736f6e616c2042617369632043413128302606092a864886f70d 0109011619706572736f6e616c2d6261736963407468617774652e636f6d0061305f310b 300906035504061302555331173015060355040a130e566572695369676e2c20496e632e 31373035060355040b132e436c6173732033205075626c6963205072696d617279204365 7274696669636174696f6e20417574686f726974790061305f310b300906035504061302 5553 EAP-Message = 0x31173015060355040a130e566572695369676e2c20496e632e31373035060355040b13 2e436c6173732032205075626c6963205072696d6172792043657274696669636174696f 6e20417574686f726974790061305f310b30090603550406130255533117301506035504 0a130e566572695369676e2c20496e632e31373035060355040b132e436c617373203120 5075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269 747900c43081c1310b300906035504061302555331173015060355040a130e5665726953 69676e2c20496e632e313c303a060355040b1333436c6173732033205075626c69632050 7269 EAP-Message = 0x6d6172792043657274696669636174696f6e20417574686f72697479202d204732313a 3038060355040b1331286329203139393820566572695369676e2c20496e632e202d2046 6f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572 695369676e205472757374204e6574776f726b009c308199310b30090603550406130248 553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f 636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b1311 54616e7573697476616e796b6961646f6b31323030060355040313294e65744c6f636b20 557a EAP-Message = 0x6c6574692028436c6173732042292054616e7573697476616e796b6961646f00473045 310b300906035504061302555331183016060355040a130f47544520436f72706f726174 696f6e311c301a06035504031313475445204379626572547275737420526f6f74007730 75310b300906035504061302555331183016060355040a130f47544520436f72706f7261 74696f6e31273025060355040b131e475445204379626572547275737420536f6c757469 6f6e732c20496e632e312330210603550403131a47544520437962657254727573742047 6c6f62616c20526f6f7400c63081c3310b30090603550406130255533114301206035504 0a13 EAP-Message = 0x0b456e74727573742e6e6574313b3039060355040b13327777772e656e74727573742e 6e65742f43505320696e636f72702e206279207265662e20286c696d697473206c696162 2e2931253023060355040b131c State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0xa9b0205ae09d6dcbf0d984f02b528db5 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 95 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x0105044819406520436f6e73756c74696e6731283026060355040b131f436572746966 69636174696f6e205365727669636573204469766973696f6e3121301f06035504031318 54686177746520506572736f6e616c2042617369632043413128302606092a864886f70d 0109011619706572736f6e616c2d6261736963407468617774652e636f6d0061305f310b 300906035504061302555331173015060355040a130e566572695369676e2c20496e632e 31373035060355040b132e436c6173732033205075626c6963205072696d617279204365 7274696669636174696f6e20417574686f726974790061305f310b300906035504061302 5553 EAP-Message = 0x31173015060355040a130e566572695369676e2c20496e632e31373035060355040b13 2e436c6173732032205075626c6963205072696d6172792043657274696669636174696f 6e20417574686f726974790061305f310b30090603550406130255533117301506035504 0a130e566572695369676e2c20496e632e31373035060355040b132e436c617373203120 5075626c6963205072696d6172792043657274696669636174696f6e20417574686f7269 747900c43081c1310b300906035504061302555331173015060355040a130e5665726953 69676e2c20496e632e313c303a060355040b1333436c6173732033205075626c69632050 7269 EAP-Message = 0x6d6172792043657274696669636174696f6e20417574686f72697479202d204732313a 3038060355040b1331286329203139393820566572695369676e2c20496e632e202d2046 6f7220617574686f72697a656420757365206f6e6c79311f301d060355040b1316566572 695369676e205472757374204e6574776f726b009c308199310b30090603550406130248 553111300f06035504071308427564617065737431273025060355040a131e4e65744c6f 636b2048616c6f7a617462697a746f6e73616769204b66742e311a3018060355040b1311 54616e7573697476616e796b6961646f6b31323030060355040313294e65744c6f636b20 557a EAP-Message = 0x6c6574692028436c6173732042292054616e7573697476616e796b6961646f00473045 310b300906035504061302555331183016060355040a130f47544520436f72706f726174 696f6e311c301a06035504031313475445204379626572547275737420526f6f74007730 75310b300906035504061302555331183016060355040a130f47544520436f72706f7261 74696f6e31273025060355040b131e475445204379626572547275737420536f6c757469 6f6e732c20496e632e312330210603550403131a47544520437962657254727573742047 6c6f62616c20526f6f7400c63081c3310b30090603550406130255533114301206035504 0a13 EAP-Message = 0x0b456e74727573742e6e6574313b3039060355040b13327777772e656e74727573742e 6e65742f43505320696e636f72702e206279207265662e20286c696d697473206c696162 2e2931253023060355040b131c State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=96, length=205 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0xa76245ced743bfa8662daf1aff9665db +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 203 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3936 Proxying request 4 to home server 192.168.136.13 port 1812 Sending Access-Request of id 203 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020500061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3936 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=203, length=1046 Proxy-State = 0x3936 Session-Timeout = 30 EAP-Message = 0x010603c51900286329203139393920456e74727573742e6e6574204c696d6974656431 3a303806035504031331456e74727573742e6e6574205365637572652053657276657220 43657274696669636174696f6e20417574686f7269747900b23081af310b300906035504 06130248553110300e0603550408130748756e676172793111300f060355040713084275 64617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a74 6f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961 646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c 6173 EAP-Message = 0x732041292054616e7573697476616e796b6961646f00c43081c1310b30090603550406 1302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355 040b1333436c6173732032205075626c6963205072696d61727920436572746966696361 74696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139 393820566572695369676e2c20496e632e202d20466f7220617574686f72697a65642075 7365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574 776f726b0070306e310b300906035504061302555331183016060355040a130f47544520 436f EAP-Message = 0x72706f726174696f6e31273025060355040b131e475445204379626572547275737420 536f6c7574696f6e732c20496e632e311c301a0603550403131347544520437962657254 7275737420526f6f74009e30819b310b30090603550406130248553111300f0603550407 1308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a6174 62697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e 796b6961646f6b313430320603550403132b4e65744c6f636b20457870726573737a2028 436c6173732043292054616e7573697476616e796b6961646f00723070312b3029060355 040b EAP-Message = 0x1322436f70797269676874202863292031393937204d6963726f736f667420436f7270 2e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312130 1f060355040313184d6963726f736f667420526f6f7420417574686f726974790061305f 31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c6401 1916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f 7420436572746966696361746520417574686f726974790e000000 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0xc1f03aa10216384972892e99f27466b1 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 96 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x010603c51900286329203139393920456e74727573742e6e6574204c696d6974656431 3a303806035504031331456e74727573742e6e6574205365637572652053657276657220 43657274696669636174696f6e20417574686f7269747900b23081af310b300906035504 06130248553110300e0603550408130748756e676172793111300f060355040713084275 64617065737431273025060355040a131e4e65744c6f636b2048616c6f7a617462697a74 6f6e73616769204b66742e311a3018060355040b131154616e7573697476616e796b6961 646f6b313630340603550403132d4e65744c6f636b204b6f7a6a6567797a6f692028436c 6173 EAP-Message = 0x732041292054616e7573697476616e796b6961646f00c43081c1310b30090603550406 1302555331173015060355040a130e566572695369676e2c20496e632e313c303a060355 040b1333436c6173732032205075626c6963205072696d61727920436572746966696361 74696f6e20417574686f72697479202d204732313a3038060355040b1331286329203139 393820566572695369676e2c20496e632e202d20466f7220617574686f72697a65642075 7365206f6e6c79311f301d060355040b1316566572695369676e205472757374204e6574 776f726b0070306e310b300906035504061302555331183016060355040a130f47544520 436f EAP-Message = 0x72706f726174696f6e31273025060355040b131e475445204379626572547275737420 536f6c7574696f6e732c20496e632e311c301a0603550403131347544520437962657254 7275737420526f6f74009e30819b310b30090603550406130248553111300f0603550407 1308427564617065737431273025060355040a131e4e65744c6f636b2048616c6f7a6174 62697a746f6e73616769204b66742e311a3018060355040b131154616e7573697476616e 796b6961646f6b313430320603550403132b4e65744c6f636b20457870726573737a2028 436c6173732043292054616e7573697476616e796b6961646f00723070312b3029060355 040b EAP-Message = 0x1322436f70797269676874202863292031393937204d6963726f736f667420436f7270 2e311e301c060355040b13154d6963726f736f667420436f72706f726174696f6e312130 1f060355040313184d6963726f736f667420526f6f7420417574686f726974790061305f 31133011060a0992268993f22c6401191603636f6d31193017060a0992268993f22c6401 1916096d6963726f736f6674312d302b060355040313244d6963726f736f667420526f6f 7420436572746966696361746520417574686f726974790e000000 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=97, length=403 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020600cc1980000000c216030100070b00000300000016030100861000008200808a1b 3743f0e9ebae9e03eb4259995bee8be486e256c89884da930bafaddea80e5977d3200c3e fc736cc37af0253c0f451c0dbaad62da4d86d0d486e984ac93a07d6ba582d10456a58633 990b229a0a2f8753e1ed90c25582abaa3b13aa1bde0f62d2ca1464c08ee51d7909424e13 95bad1faa3cb5c2781f137214468e755a09b140301000101160301002001eb6b567e9873 133e723c7e4d915ae4da6de2d8a6eff1400c08a39e5acd1780 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x169fb3e0878ce98035a4ad62f203ba09 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 4 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020600cc1980000000c216030100070b00000300000016030100861000008200808a1b 3743f0e9ebae9e03eb4259995bee8be486e256c89884da930bafaddea80e5977d3200c3e fc736cc37af0253c0f451c0dbaad62da4d86d0d486e984ac93a07d6ba582d10456a58633 990b229a0a2f8753e1ed90c25582abaa3b13aa1bde0f62d2ca1464c08ee51d7909424e13 95bad1faa3cb5c2781f137214468e755a09b140301000101160301002001eb6b567e9873 133e723c7e4d915ae4da6de2d8a6eff1400c08a39e5acd1780 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Proxying request 5 to home server 192.168.136.13 port 1812 Sending Access-Request of id 4 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020600cc1980000000c216030100070b00000300000016030100861000008200808a1b 3743f0e9ebae9e03eb4259995bee8be486e256c89884da930bafaddea80e5977d3200c3e fc736cc37af0253c0f451c0dbaad62da4d86d0d486e984ac93a07d6ba582d10456a58633 990b229a0a2f8753e1ed90c25582abaa3b13aa1bde0f62d2ca1464c08ee51d7909424e13 95bad1faa3cb5c2781f137214468e755a09b140301000101160301002001eb6b567e9873 133e723c7e4d915ae4da6de2d8a6eff1400c08a39e5acd1780 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3937 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=4, length=128 Proxy-State = 0x3937 Session-Timeout = 30 EAP-Message = 0x0107003519800000002b14030100010116030100203fa1776eae054068e95b91fcbc93 ab9c2dcc108bb935737cbaaec2ac9b02f8b8 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0xf1d3aad0ac9e774592581fe36708e1af +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 97 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x0107003519800000002b14030100010116030100203fa1776eae054068e95b91fcbc93 ab9c2dcc108bb935737cbaaec2ac9b02f8b8 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=98, length=205 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020700061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0xf78582f69cfd6d527288a752239639b6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 160 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020700061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3938 Proxying request 6 to home server 192.168.136.13 port 1812 Sending Access-Request of id 160 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020700061900 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3938 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=160, length=103 Proxy-State = 0x3938 Session-Timeout = 30 EAP-Message = 0x0108001c19001703010011d3c155133995bdfcf9bd718c694e962d29 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0xd499b45493aa57f3d8160b571240cc25 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 98 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x0108001c19001703010011d3c155133995bdfcf9bd718c694e962d29 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=99, length=236 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020800251900170301001a81bc8b96254726f40ca774581f6c1dc267ec1a5fb9b5216d a85b State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0xd78e97c33459cad8ddeae7182305e3cc +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 195 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020800251900170301001a81bc8b96254726f40ca774581f6c1dc267ec1a5fb9b5216d a85b State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3939 Proxying request 7 to home server 192.168.136.13 port 1812 Sending Access-Request of id 195 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020800251900170301001a81bc8b96254726f40ca774581f6c1dc267ec1a5fb9b5216d a85b State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3939 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=195, length=132 Proxy-State = 0x3939 Session-Timeout = 6 EAP-Message = 0x010900391900170301002e74abec5460ee0fd6c2381e657c78e34d4145f974ecbbb821 345f725ad1115252a13e27370e55df9a9d2c11355db8 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x84d40babdd39d09df459fd9712ce770b +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 99 to 192.168.34.146 port 32859 Session-Timeout = 6 EAP-Message = 0x010900391900170301002e74abec5460ee0fd6c2381e657c78e34d4145f974ecbbb821 345f725ad1115252a13e27370e55df9a9d2c11355db8 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=100, length=290 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0209005b19001703010050cd672cd8be21bd6ce24558d11eeaa90e17200309a07e91c1 0ae0c4937abe3e4484e26f9e997199f9ea29e21da884deaa61283a6aa4df93505b016545 13a0d586b6aa1e035dfe936cf89bc82f4ec15189 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x71a7d47b1b82d1d5a1ed151f53567f19 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 115 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0209005b19001703010050cd672cd8be21bd6ce24558d11eeaa90e17200309a07e91c1 0ae0c4937abe3e4484e26f9e997199f9ea29e21da884deaa61283a6aa4df93505b016545 13a0d586b6aa1e035dfe936cf89bc82f4ec15189 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313030 Proxying request 8 to home server 192.168.136.13 port 1812 Sending Access-Request of id 115 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0209005b19001703010050cd672cd8be21bd6ce24558d11eeaa90e17200309a07e91c1 0ae0c4937abe3e4484e26f9e997199f9ea29e21da884deaa61283a6aa4df93505b016545 13a0d586b6aa1e035dfe936cf89bc82f4ec15189 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313030 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=115, length=150 Proxy-State = 0x313030 Session-Timeout = 6 EAP-Message = 0x010a004a1900170301003ffd21ea08c07ad1947763447aeeef63892af8eaa8734669d5 73bf776bcc9108ae882db091765458d09d5f92563780245c85bf169f41ec69ff5ca6be70 0fd3bc State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x44f5a893d32333f971b1983721280055 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 100 to 192.168.34.146 port 32859 Session-Timeout = 6 EAP-Message = 0x010a004a1900170301003ffd21ea08c07ad1947763447aeeef63892af8eaa8734669d5 73bf776bcc9108ae882db091765458d09d5f92563780245c85bf169f41ec69ff5ca6be70 0fd3bc State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=101, length=228 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a001d19001703010012927fcf7a04655e0e059c5b56211ccb1348e1 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x537b7044b43c256df0b71232d143ed47 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 64 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a001d19001703010012927fcf7a04655e0e059c5b56211ccb1348e1 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313031 Proxying request 9 to home server 192.168.136.13 port 1812 Sending Access-Request of id 64 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a001d19001703010012927fcf7a04655e0e059c5b56211ccb1348e1 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313031 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.136.13 port 1812, id=64, length=114 Proxy-State = 0x313031 Session-Timeout = 30 EAP-Message = 0x010b00261900170301001b73de8e795cf674bc3a290e2f9f30818e22fbe7fd94e038bb d521ec State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0xf34bce1564797990e334581d6ae71e9a +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Sending Access-Challenge of id 101 to 192.168.34.146 port 32859 Session-Timeout = 30 EAP-Message = 0x010b00261900170301001b73de8e795cf674bc3a290e2f9f30818e22fbe7fd94e038bb d521ec State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.34.146 port 32859, id=102, length=237 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020b00261900170301001b4b1d310c33d238c2a164c40120e6d542a403950d6393dc88 7c1431 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x3a42ba86f6f724b4d1cc2438780f7ad0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "stafftest", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "stafftest" [suffix] Adding Realm = "DEFAULT" [suffix] Proxying request from user stafftest to realm DEFAULT [suffix] Preparing to proxy authentication request to realm "DEFAULT" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [sql] expand: %{User-Name} -> stafftest [sql] sql_set_user escaped user --> 'stafftest' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'stafftest' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'stafftest' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'FacStaffPool' ORDER BY id [sql] User found in group FacStaffPool [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'FacStaffPool' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty section. Using default return values. Sending Access-Request of id 123 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020b00261900170301001b4b1d310c33d238c2a164c40120e6d542a403950d6393dc88 7c1431 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313032 Proxying request 10 to home server 192.168.136.13 port 1812 Sending Access-Request of id 123 to 192.168.136.13 port 1812 User-Name = "stafftest" NAS-IP-Address = 192.168.34.146 NAS-Port = 1 NAS-Identifier = "192.168.34.146" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "E4CE8F1B591A" Called-Station-Id = "000B860F1D00" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020b00261900170301001b4b1d310c33d238c2a164c40120e6d542a403950d6393dc88 7c1431 State = 0x1aa003d2000001370001ac11880d0000000311d6a5b700 Aruba-Essid-Name = "Test-1X" Aruba-Location-Id = "CONV-B-TNG" Aruba-Attr-10 = 0x61757468756e697479 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313032 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 192.168.136.13 port 1812, id=123, length=266 Proxy-State = 0x313032 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "301" EAP-Message = 0x030c0004 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 MS-CHAP-Domain = "\001AMHERS" MS-CHAP2-Success = 0x01533d3838393939453335363334444337333832373832323137393943413738453937 3439423442454532 MS-MPPE-Send-Key = 0x1b6a5631097bd07c20a46d4c76d21279b174ae44a9c0459d3c0fb37b592d72bc MS-MPPE-Recv-Key = 0x131f8eb7e935df8a4380bca8a138eee881d1bdc64348148a5248e7daf4b5d2a2 Message-Authenticator = 0xdaf47d253afc9ed5a5279d8c52c6fde0 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 102 to 192.168.34.146 port 32859 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "301" EAP-Message = 0x030c0004 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 MS-CHAP-Domain = "\001AMHERS" MS-CHAP2-Success = 0x01533d3838393939453335363334444337333832373832323137393943413738453937 3439423442454532 MS-MPPE-Send-Key = 0x1b6a5631097bd07c20a46d4c76d21279b174ae44a9c0459d3c0fb37b592d72bc MS-MPPE-Recv-Key = 0x131f8eb7e935df8a4380bca8a138eee881d1bdc64348148a5248e7daf4b5d2a2 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 92 with timestamp +7 Cleaning up request 1 ID 93 with timestamp +7 Cleaning up request 2 ID 94 with timestamp +7 Cleaning up request 3 ID 95 with timestamp +7 Cleaning up request 4 ID 96 with timestamp +7 Cleaning up request 5 ID 97 with timestamp +7 Cleaning up request 6 ID 98 with timestamp +7 Cleaning up request 7 ID 99 with timestamp +7 Cleaning up request 8 ID 100 with timestamp +7 Cleaning up request 9 ID 101 with timestamp +7 Cleaning up request 10 ID 102 with timestamp +7 Ready to process requests.

3 4

Access-Challenge with FreeRadius
by hughdavid 09 Nov '11

09 Nov '11

Hello, I am a new user of FreeRadius (on windows) I have the same question as this post: How to configure freeRADIUS server so it replies with a PAP "access-challenge" message on "access-request" from a client? http://freeradius.1045715.n5.nabble.com/Help-me-with-Access-Challenge-confi… Any help is greatly appreciated! Thanks in advance Best Regards, Zhuoming (zhuoming.huang(a)gmail.com) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Access-Challenge-with-FreeRadius-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

ldap+freeradius
by David N'DAKPAZE 09 Nov '11

09 Nov '11

Hello, Please I 'd to know how to use an ldap as a database of freeradius. I use freeradius-server-2.1.3. Is it possible to use more than one nas in clients.conf ? If yes how to do it? How to configure EAP-TLS ? Thank you for your help. Rato

9 61

Re: Access-Challenge with FreeRadius
by Alan Buxey 09 Nov '11

09 Nov '11

The thread link posted has already git several answers in it...and ends quite clearly. Why are you trying to drag this up again? Some coursework? alan

1 0

Simultaneous-Use Checking with FreeRadius + MYSQL
by Erik 09 Nov '11

09 Nov '11

----------------------------------------- FreeRadius Version: 2.1.10 ----------------------------------------- Hello All, I've been going in circles for days on how to come up with a workaround to get simultaneous-use checking working on my FreeRadius + PEAP MSCHAPv2 deployment. I have read through seemingly all of the posts... I suspect certain areas which might be causing the problem: 1) my NAS does not seem to be sending accounting information. The radacct table is empty & this is also visible in the debugs. There is no area to set up RADIUS accounting on the NAS (it's a cheap netgear) and it doesn't appear to send accounting packets by default. 2) "checkrad.pl" is not being called automatically when no accounting data is being returned by "simul_count_query". I have the NAS type set to "cisco" to trigger checkrad.pl for troubleshooting purposes, but it doesn't seem to do any good. First of all - is it possible to do simultaneous-use checking if the NAS doesn't send radius accounting packets? Can the radius server somehow autonomously keep track of this without packets from the NAS? If not, is there another application which will fulfill this function? Do I need to move to radutmp? Any input and guidance would be greatly appreciated. Details are below. thanks in advance! Erik ========================================== RELEVANT CONFIGURATIONS (some output omitted): ------------------------------------------------------------------------------------ ------------------------------------------ /etc/freeradius/radiusd.conf modules { $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf } ------------------------------------------ /etc/freeradius/sql/mysql/dialup.conf simul_count_query = "SELECT COUNT(*) \ #FROM ${acct_table1} \ #WHERE username = '%{SQL-User-Name}' \ #AND acctstoptime IS NULL" # simul_verify_query = "SELECT radacctid, acctsessionid, username, \ nasipaddress, nasportid, framedipaddress, \ callingstationid, framedprotocol \ FROM ${acct_table1} \ WHERE username = '%{SQL-User-Name}' \ AND acctstoptime IS NULL" ------------------------------------------ /etc/freeradius/sites-available/default authorize { #sql is the first option in the authorize list. sql } accounting { # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. # radutmp # sradutmp } session { # radutmp # # See "Simultaneous Use Checking Queries" in sql.conf sql } post-auth { sql } ------------------------------------------ /etc/freeradius/sites-available/inner-tunnel authorize { #sql is the first option in the authorize list. sql } # *** THERE IS NO ACCOUNTING SECTION*** session { # radutmp # # See "Simultaneous Use Checking Queries" in sql.conf sql } post-auth { sql } ================== MYSQL INFO: ------------------------------------ mysql> SELECT * FROM radgroupcheck; +----+---------------------------+------------------+----+--------+ | id | groupname | attribute | op | value | +----+---------------------------+------------------+----+--------+ | 1 | daloRADIUS-Disabled-Users | Auth-Type | := | Reject | | 3 | sandruid-ap-wifi | Simultaneous-Use | := | 1 | +----+---------------------------+------------------+----+--------+ mysql> SELECT * FROM radusergroup; +----------+------------------+----------+ | username | groupname | priority | +----------+------------------+----------+ | lynnae | sandruid-ap-wifi | 0 | +----------+------------------+----------+ 1 row in set (0.00 sec) mysql> SELECT * FROM nas; +----+---------------+------------------+-------+-------+--------+--------+-----------+-------------+ | id | nasname | shortname | type | ports | secret | server | community | description | +----+---------------+------------------+-------+-------+--------+--------+-----------+-------------+ | 5 | 192.168.2.254 | sandruid-ap-wifi | cisco | 0 | xxxx | NULL | | | +----+---------------+------------------+-------+-------+--------+--------+-----------+-------------+ 5 rows in set (0.00 sec) ================== freeradius -X DEBUG: ------------------------------------ Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=118, length=149 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200000b016c796e6e6165 Message-Authenticator = 0x8c1acd761b639cf66ea60d2d7f512b4b # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 118 to 192.168.2.254 port 2060 EAP-Message = 0x010100160410e2f76fece48e6e2f4257c55e4d843858 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9156e36f0d908f26ca869d55 Finished request 157. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=119, length=162 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100060319 State = 0x9157e73c9156e36f0d908f26ca869d55 Message-Authenticator = 0x3662b294c2a55a1a6a4a428d5d35c2ea # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 119 to 192.168.2.254 port 2060 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9055fe6f0d908f26ca869d55 Finished request 158. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=120, length=356 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200c81980000000be16030100b9010000b503014eb96cde36b927c58e37146cce91cc535a6cceef3b8b365f9f7b526d985674c6000048c014c00a00390038c00fc0050035c012c00800160013c00dc003000ac013c00900330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000 State = 0x9157e73c9055fe6f0d908f26ca869d55 Message-Authenticator = 0x58c13369bc0531e540918c6bcb3ec054 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 200 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 190 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00b9], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 02ac], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 120 to 192.168.2.254 port 2060 EAP-Message = 0x0103040019c00000050216030100310200002d03014eb96cd031034c50878f40ccde3ec71c2bf95397b94f9fc063d800c4c8543e33000039000005ff0100010016030102ac0b0002a80002a50002a23082029e30820186020900ba602d424ee828d3300d06092a864886f70d01010505003011310f300d060355040313067562756e7475301e170d3131303930363232333030395a170d3231303930333232333030395a3011310f300d060355040313067562756e747530820122300d06092a864886f70d01010105000382010f003082010a0282010100d8caabd35a6bf19d2a5b06c9df870fa04b710184efaa79762f6d2ece6126e7e0a79cbe5e2b EAP-Message = 0x8ada5c5e816ecea3840944040ee02305a09715f224801793c8d9265d0a1be4fdc666d1913dddb400341390ff579a75fac7860a458fd9d8445a9be140fe8143d8965779fb012ab699b1ab3c7513a40a2c2781dd061171c3850832a1fd01ec9bce0cdbbe94b25da3c27c10d79da9b316d2f8a63534b2369453b07cf5a14eada2eb01b7a00f479e618feedd4b2ab2dfe526fa45e8d0d797f6ac98e45df382f560308018a1c71bd9bb983047852db765a85cff42de810a094eebc958f307e2ef7995f69ff92ada392bef1e7da1e44126b0de749b16c4c645a49cc494730203010001300d06092a864886f70d010105050003820101008d044ec666f3055f91 EAP-Message = 0x2f64a62addb6bafde8746bcaf0d398f287e6a5ef2ab0e1b3501a9d96924aa46c3d7ddfcacad68497a1b9209af095df62462d02192aa1b11e87520837fa12bfe836f405b71424a973a9ed85c70f0cd769d6f177b63af672cbf4e82101a598579a1b9824f038a74c93e3e39f1ce93b84f1195e9b7165c89052370847e9274836535a3818a6c60d064c8dd6f4b3c78e35ab5d707a81d6e5e80763da0be8c3653a46444a3d7435b88570d62165157fb679769dcd740fc1f36f4c08187cc3eb077238bf12bab3dbfbba681a180f29e7ab2e419cb5881c2f8caeaf71984eb6a068cf5bb143f2ed407ecc845e8e0a6e04fc5e86164e84a3bfdf54160301020d0c EAP-Message = 0x0002090080de63877f5ef98ff1ae9d37718a63c89acf13780489524343e6498e734475060fffc46408e77f4021506a063624393308ff58ddf742be1ff813f9f6e1f08261374e51a8e829a6845b8f6253a74dad0c471a3a3445bf0f408db087aa6e88d96490fe375677d9c356f4e2cef235a61b37efa4ca5f2473c1d5c75515a4a0987f3e9b0001020080c3cbfcfa065b6a956d98a8196f32e524fef9bcd90fbe3830f0b02663705fa45bb6eb6632c8258cca123163ad2b5746c4e597ca25685d3f9c56ee64edf871ec56b7d7e6b94b7d67adf6dd8f3bbcccad25a05e8c41406027e1e6459df0387ee4f55d8ed9c61fa56e344dd1224577bfd65a832e83 EAP-Message = 0x5c20a25f6b1f80f4cbe3d650 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9354fe6f0d908f26ca869d55 Finished request 159. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=121, length=162 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020300061900 State = 0x9157e73c9354fe6f0d908f26ca869d55 Message-Authenticator = 0x7fc90e410524d7826b376a1391760fa9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 121 to 192.168.2.254 port 2060 EAP-Message = 0x01040112190057010011f1609cfe2fda9cb118e3fcbfb7c4d390cab430a2ced912018992b28ad8c010d4f5404304128996c2ca020da6d662b74f4a1bd67224754c6c01d03b934f906d98608d3bbef927db99d9732cf3e1e4c4a9f2b98460e26ec7271f7931727575efa3332866f4bc1eafabef8fb4e5a44ae23559787695e88c743728df1e2451bcba22c15f78206758ff9856a69f60aec28a219aacba2a870c717b9facedf6c61786176fb6f27e8f482bdff8de46e496b7ba94761441791053429639438efa89e3b32a4d73a321729114b83d3a8ea2213aaee4641b8b50d4608b82f0c349c3f629af1badc84b8f777b95b831161fa68c653486a74cac EAP-Message = 0x30ee27a67e3b9b7cc910134516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9253fe6f0d908f26ca869d55 Finished request 160. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=122, length=364 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020400d01980000000c6160301008610000082008018689ae4a8f52df5785b79e717bc67f68621f527174b6b5393d1dc4e2487e1cbb18ec0ec67288a81385e234080d150b98cc81c52017495484a046b6cded6bfbc7da09cd4616c1dea539343470fb24dde135acada9517638269f02b7d4b06205934d49449e7357a30e397a648af3d2f0a8bac7e530b544ff1e9df8e7e3aa357a714030100010116030100305ef69b7e3eba1c4cfdfbd73c39ea32c801e076a3f79c753950ab03e82d937937ec91ec8edda3823d2fc0487854fd994f State = 0x9157e73c9253fe6f0d908f26ca869d55 Message-Authenticator = 0x5f0a331b39ab99f4c09a28139714ec92 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 122 to 192.168.2.254 port 2060 EAP-Message = 0x010500411900140301000101160301003068692cc43c639c3be14d995f0aa394ff34f50e4bd6ce5518ae5d56436b6ad7e3394992cc8b975b61cefc5d27a9e148e8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9552fe6f0d908f26ca869d55 Finished request 161. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=123, length=162 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020500061900 State = 0x9157e73c9552fe6f0d908f26ca869d55 Message-Authenticator = 0xaef5497d9e086a476ff8842b93bf4ed8 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 123 to 192.168.2.254 port 2060 EAP-Message = 0x0106002b190017030100207a68818b0219bcaf564d36a844a8c1ede5fe9524fd56adf41092e879f17ae0b3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9451fe6f0d908f26ca869d55 Finished request 162. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=124, length=236 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02060050190017030100203b93320a17f41554a43fba3feca2938482da372060063c1e79e814e8bb7f52f617030100205ec652417c1a7fd7b5f04adda23f3c7ab0c964a6d124c19883efb97b15b4214e State = 0x9157e73c9451fe6f0d908f26ca869d55 Message-Authenticator = 0x7f4879d7969ab3029d282075490d5058 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - lynnae [peap] Got inner identity 'lynnae' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0206000b016c796e6e6165 server { PEAP: Setting User-Name to lynnae Sending tunneled request EAP-Message = 0x0206000b016c796e6e6165 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lynnae" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010700201a0107001b10a49f4b340cb74751d41eab71dea1c3656c796e6e6165 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb0b5cb7cb0c46c5e8b7890586a66df5 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010700201a0107001b10a49f4b340cb74751d41eab71dea1c3656c796e6e6165 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb0b5cb7cb0c46c5e8b7890586a66df5 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 124 to 192.168.2.254 port 2060 EAP-Message = 0x0107004b190017030100404bb93a159a1c6d5bb5237d89e435ce74303486a45960d329c8428887d26c3b7c4b02086ec9719bb16228a893b0bc411d2d0c714900f86713ea810d5abcdff4ec Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c9750fe6f0d908f26ca869d55 Finished request 163. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=125, length=300 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x02070090190017030100200ad8c74abf696c3e28f1105016b9135fdbc9774b4de57cbeb2bc8255627527ad1703010060bb7a27cab3edffb2b489d65cc6890be1037a4c145325ebd5b7916ef97bb95f9fe6d7287532542d2b4b3d134a8e0d0dc6e30a406768e6f56c2221dc012fb9b8b336f3a923770fc669b7f1057a0ebbb6d4c433d9a31569b04e3f7141147c50ca9d State = 0x9157e73c9750fe6f0d908f26ca869d55 Message-Authenticator = 0x2b81c4d7dc683889d77dc4b66c5aa4c3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700411a0207003c31831e0af9085ee3ef21b1cf05b6f1023600000000000000005f21df5f4a1fe749346f35f30ee425be58039c49d4f4f0d1006c796e6e6165 server { PEAP: Setting User-Name to lynnae Sending tunneled request EAP-Message = 0x020700411a0207003c31831e0af9085ee3ef21b1cf05b6f1023600000000000000005f21df5f4a1fe749346f35f30ee425be58039c49d4f4f0d1006c796e6e6165 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lynnae" State = 0xcb0b5cb7cb0c46c5e8b7890586a66df5 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: lynnae [mschap] Told to do MS-CHAPv2 for lynnae with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800331a0307002e533d41304337333331334131393842343535453932393139314536373931423133323236343832444536 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb0b5cb7ca0346c5e8b7890586a66df5 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d41304337333331334131393842343535453932393139314536373931423133323236343832444536 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcb0b5cb7ca0346c5e8b7890586a66df5 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 125 to 192.168.2.254 port 2060 EAP-Message = 0x0108005b19001703010050d4ef871ef051eee9064cbccd470060a8b87bb932e68b1bccbb4e785482d44706047401c585a1bff2b413de10675f0879a882c7eab49a9e6021420798515a86b6038a8492a06e6a9f4aa3d52247dcbdb3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c965ffe6f0d908f26ca869d55 Finished request 164. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=126, length=236 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0208005019001703010020c7a82ee86578ced416e7b235e6a7dc0e820e535a79e74b51e898a5ee2987a19617030100207ccbea411a1626f94f5346f51111cc82a43507e66fdd3085253b682bd18f3e12 State = 0x9157e73c965ffe6f0d908f26ca869d55 Message-Authenticator = 0x99343416c2852adf5b655e9243d67783 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020800061a03 server { PEAP: Setting User-Name to lynnae Sending tunneled request EAP-Message = 0x020800061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "lynnae" State = 0xcb0b5cb7ca0346c5e8b7890586a66df5 server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 8 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lynnae' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lynnae' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'lynnae' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'sandruid-ap-wifi' ORDER BY id [sql] User found in group sandruid-ap-wifi [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'sandruid-ap-wifi' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok # Executing section session from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group session {...} [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' [sql] expand: SELECT COUNT(*) #FROM radacct #WHERE username = '%{SQL-User-Name}' #AND acctstoptime IS NULL -> SELECT COUNT(*) #FROM radacct #WHERE username = 'lynnae' #AND acctstoptime IS NULL rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT COUNT(*) #FROM radacct #WHERE username = 'lynnae' #AND acctstoptime IS NULL [sql] expand: SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL -> SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = 'lynnae' AND acctstoptime IS NULL rlm_sql_mysql: query: SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = 'lynnae' AND acctstoptime IS NULL rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group post-auth {...} [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lynnae', '', 'Access-Accept', '2011-11-08 10:54:24') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lynnae', '', 'Access-Accept', '2011-11-08 10:54:24') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lynnae', '', 'Access-Accept', '2011-11-08 10:54:24') rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x64d23cb7d938395e60b2bc98eb9667b1 MS-MPPE-Recv-Key = 0x1cf788005312432f10b9b54e6ada00ca EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "lynnae" [peap] Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x64d23cb7d938395e60b2bc98eb9667b1 MS-MPPE-Recv-Key = 0x1cf788005312432f10b9b54e6ada00ca EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "lynnae" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 126 to 192.168.2.254 port 2060 EAP-Message = 0x0109002b190017030100203b08dfc30d197b615b6fd93ace4064321d2d342373d79450163e1d77d966c2f1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9157e73c995efe6f0d908f26ca869d55 Finished request 165. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.2.254 port 2060, id=127, length=236 User-Name = "lynnae" NAS-IP-Address = 192.168.2.254 NAS-Port = 0 Called-Station-Id = "30-46-9A-0E-B4-DF:druid" Calling-Station-Id = "7C-61-93-9E-3A-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0209005019001703010020bed5ff20d6475746ddae396e91ec11a0c3fbfd81efa0edbe1c567395bf43547b170301002007b4740b564efd19a9e3400e8847bf04f4260b75a7e9983f4d5f6d60fe05273b State = 0x9157e73c995efe6f0d908f26ca869d55 Message-Authenticator = 0xc7bf139807bb5c02c88262210dea9c27 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "lynnae", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> lynnae [sql] sql_set_user escaped user --> 'lynnae' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lynnae', '', 'Access-Accept', '2011-11-08 10:54:24') [sql] expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lynnae', '', 'Access-Accept', '2011-11-08 10:54:24') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'lynnae', '', 'Access-Accept', '2011-11-08 10:54:24') rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 127 to 192.168.2.254 port 2060

3 7

Problem: FreeRadius Authentication using LDAP
by suggestme 08 Nov '11

08 Nov '11

Hi, I have configured FreeRadius to authenticate against LDAP. I have installed and configured FreeRadius in FreeBSD Server and LDAP is already set up in another server. I configured as below: (Changes on file are shown on bold letter) */usr/local/etc/raddb/modules/ldap :* ldap { # Define the LDAP server and the base domain name server = *"localhost"* basedn = *"dc=example,dc=com"* # Define which attribute from an LDAP "ldapsearch" query # is the password. Create a filter to extract the password # from the "ldapsearch" output password_attribute = "userPassword" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # The following are RADIUS defaults start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } */usr/local/etc/raddb/sites-enabled/default :* authorize { ... ... # # The ldap module will set Auth-Type to LDAP if it has not # already been set Ldap ... ... } Auth-Type LDAP { ldap } Also, same type of modifications has been done on : */usr/local/etc/raddb/sites-enabled/inner-tunnel* Also, change has been made to users file adding LDAP user authentication. But when I run radiusd -X command to run freeradius on debug mode, it gives following error: /usr/local/etc/raddb/modules/ldap[29]: Failed to link to module 'rlm_ldap': file not found /usr/local/etc/raddb/sites-enabled/inner-tunnel[237]: Failed to load module "ldap". /usr/local/etc/raddb/sites-enabled/inner-tunnel[237]: Failed to parse "ldap" entry. I don't know what to do? I would appreciate anyone's idea. Should I need to configure anything if I have freeradius server on one machine and LDAP server on another machine. They are not on same machine/host. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problem-FreeRadius-Authentication-u… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

RE: NAS in sql and returning specific VSAs
by Vincent, Fabien 08 Nov '11

08 Nov '11

Sorry, CTRL+Enter is not a good keyboard on Monday Morning ;) So, I return to the NAS some VSAs depending LDAP Group like this : if (Ldap-Group == "MyGroup") { update reply { # Rules for Cisco Routeurs Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=15" # Rule for 3Com Access Service-Type += Login-User Login-Service += Telnet Login-Service += 3com-50 H3C-Exec_Privilege = 3 3Com-User-Access-Level = 3Com-Manager #AV-Pair for F5 BigIP LTM Access (see /usr/share/freeradius/dictionnary.f5) F5-LTM-User-Role = Manager F5-LTM-User-Info-1 = myGroup F5-LTM-User-Partition = Common F5-LTM-User-Shell = bpsh Etc . Is there any to check a NAS attribute to split replies, with sort of VSAs groups for each NAS type, in post-auth ? I have the following nas table : mysql> describe nas; +-------------+--------------+------+-----+---------------+----------------+ | Field | Type | Null | Key | Default | Extra | +-------------+--------------+------+-----+---------------+----------------+ | id | int(10) | NO | PRI | NULL | auto_increment | | nasname | varchar(128) | NO | MUL | NULL | | | shortname | varchar(32) | YES | | NULL | | | type | varchar(30) | YES | | other | | | ports | int(5) | YES | | NULL | | | secret | varchar(60) | NO | | secret | | | server | varchar(64) | YES | | NULL | | | community | varchar(50) | YES | | NULL | | | description | varchar(200) | YES | | RADIUS Client | | +-------------+--------------+------+-----+---------------+----------------+ Thanks in advance for your help ! Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits Niveau 3 - Infrastructure & Produits <mailto:fabien.vincent@coreye.fr> fabien.vincent(a)coreye.fr coreye Parc de la Haute Borne 22, rue Hergé 59650 Villeneuve d'Ascq <http://www.pictime.com/> www.pictime.com De : Vincent, Fabien Envoyé : lundi 7 novembre 2011 10:31 À : 'freeradius-users(a)lists.freeradius.org' Objet : NAS in sql and returning specific VSAs Hi all, I have one question about Free Radius and NAS in sql database. I return to the NAS some VSAs depending LDAP User-Group like this : Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits Niveau 3 - Infrastructure & Produits <mailto:fabien.vincent@coreye.fr> fabien.vincent(a)coreye.fr coreye Parc de la Haute Borne 22, rue Hergé 59650 Villeneuve d'Ascq <http://www.pictime.com/> www.pictime.com

3 4

No such virtual server NULL
by Vincent, Fabien 08 Nov '11

08 Nov '11

Hi all, Im using FreeRadius to authenticate admin users on Firewall / Load Balancer webui. Actually my configuration works well, but I just tried to had a new Load Balancer with Radius Auth, but Ive a strange message : Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.50.251 port 27705, id=236, length=94 User-Name = "myuser" User-Password = "pass" NAS-IP-Address = 10.10.10.10 NAS-Identifier = "httpd" NAS-Port = 26680 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.0.1" server NULL { No such virtual server NULL Invalid user: [myuser] (from client NAS-SHORTNAME port 26680 cli 192.168.0.1) } # server NULL Using Post-Auth-Type Reject No such virtual server NULL Delaying reject of request 2 for 1 seconds Going to the next request What is this message ? No such virtual server NULL Why this works for existing configuration and adding a new NAS to sql database is giving this result ? Thanks in advance for your help ! Fabien VINCENT Ingénieur Réseaux & Sécurité / ASSR Produits Niveau 3 - Infrastructure & Produits <mailto:fabien.vincent@coreye.fr> fabien.vincent(a)coreye.fr

2 2

advice about ldap groupfilter query
by Juan remon 08 Nov '11

08 Nov '11

Hello My name is Remon and I would like to know your opinion about the next problem and my ldap module configuration: I have an authentication system base on: freeradius-2.1.7 and OpenLdap 2.3.30. Our users are authenticated against LDAP and it is getting back a role (student or Employee). Recently I have changed the ldap topology and after that we are having a lot of problems. the radius log show us a lot of lines like: Error: Discarding duplicate request from client xxxxxxx port 32841 - ID: 112 due to unfinished request 421 Error: rlm_ldap: All ldap connections are in use I read some post about this problem, and they say that the problem could be a slow connection with Ldap or a indexing problem of the ldap, My question is, if the reason of this problem could be my ldap module configuration and the type of filter that I use for searching the users in the diferents groups or only depend on ldap server configuration? First of all, my new ldap structure is like: dc=company, dc=com--------------------------------------ou--------------------------------------------ou=radius (groupOfNames, radiusprofile) | | | cn=student | |ou=groups (groupOfNames) vlan-parameters cn=users |- cn=student member (user1,......) | cn= employee | |- cn=employee vlan-parameters |- user1 member (user2,......) |- user2 |- ....... My server version is freeradius-sderver-2.1.7 My ldap module configuration is: server = "xxx.xxx.xxx.xxx" identity = "cn=xxxx,dc=yyy,dc=zz" password = sssss basedn = "dc=yyy,dc=zz" filter = "(uid=%{Stripped-User-Name})" groupmembership_filter = "(&(objectClass=groupOfNames)(member=%{control:LDAP-UserDn}))" access_attr = "uid" password_attribute = Cleartext-Password ldap_connections_number = 200 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no I send you the output when a user "student13" is authenticated : Tue Nov 8 10:05:54 2011 : Info: FreeRADIUS Version 2.1.7, for host i686-pc-linux-gnu, built on Feb 11 2010 at 17:23:35 Tue Nov 8 10:05:54 2011 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Tue Nov 8 10:05:54 2011 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Tue Nov 8 10:05:54 2011 : Info: PARTICULAR PURPOSE. Tue Nov 8 10:05:54 2011 : Info: You may redistribute copies of FreeRADIUS under the terms of the Tue Nov 8 10:05:54 2011 : Info: GNU General Public License v2. Tue Nov 8 10:05:54 2011 : Info: Starting - reading configuration files ... Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/radiusd.conf Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/proxy.conf Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/clients.conf Tue Nov 8 10:05:54 2011 : Debug: including files in directory /usr/local/etc/raddb/modules/ Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/policy Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/unix Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/echo Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/smbpasswd Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/acct_unique Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/files Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.log Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/checkval Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/etc_group Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/pam Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/ippool Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/chap Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/detail Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/krb5 Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/passwd Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/inner-eap Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/detail.example.com Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/logintime Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/expiration Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2ip Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_filter Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/smsotp Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/mschap Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/counter Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/pap Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/digest Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/expr Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/preprocess Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/sradutmp Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/otp Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/wimax Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/realm Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/radutmp Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/perl Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/cui Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/mac2vlan Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/linelog Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/always Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/exec Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/sql_log Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/ldap Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/modules/attr_rewrite Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/eap.conf Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/policy.conf Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/default Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/control-socket Tue Nov 8 10:05:54 2011 : Debug: including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel Tue Nov 8 10:05:54 2011 : Debug: group = freerad Tue Nov 8 10:05:54 2011 : Debug: user = freerad Tue Nov 8 10:05:54 2011 : Debug: including dictionary file /usr/local/etc/raddb/dictionary Tue Nov 8 10:05:54 2011 : Debug: main { Tue Nov 8 10:05:54 2011 : Debug: prefix = "/usr/local" Tue Nov 8 10:05:54 2011 : Debug: localstatedir = "/usr/local/var" Tue Nov 8 10:05:54 2011 : Debug: logdir = "/usr/local/var/log/radius" Tue Nov 8 10:05:54 2011 : Debug: libdir = "/usr/local/lib" Tue Nov 8 10:05:54 2011 : Debug: radacctdir = "/usr/local/var/log/radius/radacct" Tue Nov 8 10:05:54 2011 : Debug: hostname_lookups = no Tue Nov 8 10:05:54 2011 : Debug: max_request_time = 30 Tue Nov 8 10:05:54 2011 : Debug: cleanup_delay = 5 Tue Nov 8 10:05:54 2011 : Debug: max_requests = 1024 Tue Nov 8 10:05:54 2011 : Debug: allow_core_dumps = no Tue Nov 8 10:05:54 2011 : Debug: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" Tue Nov 8 10:05:54 2011 : Debug: checkrad = "/usr/local/sbin/checkrad" Tue Nov 8 10:05:54 2011 : Debug: debug_level = 0 Tue Nov 8 10:05:54 2011 : Debug: proxy_requests = yes Tue Nov 8 10:05:54 2011 : Debug: log { Tue Nov 8 10:05:54 2011 : Debug: stripped_names = no Tue Nov 8 10:05:54 2011 : Debug: auth = yes Tue Nov 8 10:05:54 2011 : Debug: auth_badpass = no Tue Nov 8 10:05:54 2011 : Debug: auth_goodpass = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: security { Tue Nov 8 10:05:54 2011 : Debug: max_attributes = 200 Tue Nov 8 10:05:54 2011 : Debug: reject_delay = 1 Tue Nov 8 10:05:54 2011 : Debug: status_server = yes Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: radiusd: #### Loading Realms and Home Servers #### Tue Nov 8 10:05:54 2011 : Debug: proxy server { Tue Nov 8 10:05:54 2011 : Debug: retry_delay = 5 Tue Nov 8 10:05:54 2011 : Debug: retry_count = 3 Tue Nov 8 10:05:54 2011 : Debug: default_fallback = yes Tue Nov 8 10:05:54 2011 : Debug: dead_time = 120 Tue Nov 8 10:05:54 2011 : Debug: wake_all_if_all_dead = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: realm LOCAL { Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: realm NULL { Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: home_server radius_proxy { Tue Nov 8 10:05:54 2011 : Debug: ipaddr = xxx.xxx.xxx.xxx Tue Nov 8 10:05:54 2011 : Debug: port = 1812 Tue Nov 8 10:05:54 2011 : Debug: type = "auth+acct" Tue Nov 8 10:05:54 2011 : Debug: secret = "xxxxxxx" Tue Nov 8 10:05:54 2011 : Debug: response_window = 20 Tue Nov 8 10:05:54 2011 : Debug: max_outstanding = 65536 Tue Nov 8 10:05:54 2011 : Debug: zombie_period = 40 Tue Nov 8 10:05:54 2011 : Debug: status_check = "none" Tue Nov 8 10:05:54 2011 : Debug: ping_interval = 30 Tue Nov 8 10:05:54 2011 : Debug: check_interval = 30 Tue Nov 8 10:05:54 2011 : Debug: num_answers_to_alive = 3 Tue Nov 8 10:05:54 2011 : Debug: num_pings_to_alive = 3 Tue Nov 8 10:05:54 2011 : Debug: revive_interval = 60 Tue Nov 8 10:05:54 2011 : Debug: status_check_timeout = 4 Tue Nov 8 10:05:54 2011 : Debug: irt = 2 Tue Nov 8 10:05:54 2011 : Debug: mrt = 16 Tue Nov 8 10:05:54 2011 : Debug: mrc = 5 Tue Nov 8 10:05:54 2011 : Debug: mrd = 30 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: home_server radius_24 { Tue Nov 8 10:05:54 2011 : Debug: ipaddr = xxx.xxx.xxx.xxx Tue Nov 8 10:05:54 2011 : Debug: port = 1812 Tue Nov 8 10:05:54 2011 : Debug: type = "auth+acct" Tue Nov 8 10:05:54 2011 : Debug: secret = "xxxxxxx" Tue Nov 8 10:05:54 2011 : Debug: response_window = 20 Tue Nov 8 10:05:54 2011 : Debug: max_outstanding = 65536 Tue Nov 8 10:05:54 2011 : Debug: zombie_period = 40 Tue Nov 8 10:05:54 2011 : Debug: status_check = "none" Tue Nov 8 10:05:54 2011 : Debug: ping_interval = 30 Tue Nov 8 10:05:54 2011 : Debug: check_interval = 30 Tue Nov 8 10:05:54 2011 : Debug: num_answers_to_alive = 3 Tue Nov 8 10:05:54 2011 : Debug: num_pings_to_alive = 3 Tue Nov 8 10:05:54 2011 : Debug: revive_interval = 60 Tue Nov 8 10:05:54 2011 : Debug: status_check_timeout = 4 Tue Nov 8 10:05:54 2011 : Debug: irt = 2 Tue Nov 8 10:05:54 2011 : Debug: mrt = 16 Tue Nov 8 10:05:54 2011 : Debug: mrc = 5 Tue Nov 8 10:05:54 2011 : Debug: mrd = 30 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: home_server_pool radius_29 { Tue Nov 8 10:05:54 2011 : Debug: type = fail-over Tue Nov 8 10:05:54 2011 : Debug: home_server = radius_24 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: radiusd: #### Loading Clients #### Tue Nov 8 10:05:54 2011 : Debug: client localhost { Tue Nov 8 10:05:54 2011 : Debug: ipaddr = 127.0.0.1 Tue Nov 8 10:05:54 2011 : Debug: require_message_authenticator = no Tue Nov 8 10:05:54 2011 : Debug: secret = "xxxxxx" Tue Nov 8 10:05:54 2011 : Debug: shortname = "localhost" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: radiusd: #### Instantiating modules #### Tue Nov 8 10:05:54 2011 : Debug: instantiate { Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_exec, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_exec Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating exec Tue Nov 8 10:05:54 2011 : Debug: exec { Tue Nov 8 10:05:54 2011 : Debug: wait = no Tue Nov 8 10:05:54 2011 : Debug: input_pairs = "request" Tue Nov 8 10:05:54 2011 : Debug: shell_escape = yes Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_expr, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_expr Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating expr Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_expiration, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_expiration Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating expiration Tue Nov 8 10:05:54 2011 : Debug: expiration { Tue Nov 8 10:05:54 2011 : Debug: reply-message = "Password Has Expired " Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_logintime, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_logintime Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating logintime Tue Nov 8 10:05:54 2011 : Debug: logintime { Tue Nov 8 10:05:54 2011 : Debug: reply-message = "You are calling outside your allowed timespan " Tue Nov 8 10:05:54 2011 : Debug: minimum-timeout = 60 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: radiusd: #### Loading Virtual Servers #### Tue Nov 8 10:05:54 2011 : Debug: server wifi2 { Tue Nov 8 10:05:54 2011 : Debug: modules { Tue Nov 8 10:05:54 2011 : Debug: Module: Checking authenticate {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_pap, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_pap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating pap Tue Nov 8 10:05:54 2011 : Debug: pap { Tue Nov 8 10:05:54 2011 : Debug: encryption_scheme = "auto" Tue Nov 8 10:05:54 2011 : Debug: auto_header = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_unix, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_unix Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating unix Tue Nov 8 10:05:54 2011 : Debug: unix { Tue Nov 8 10:05:54 2011 : Debug: radwtmp = "/usr/local/var/log/radius/radwtmp" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_ldap, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_ldap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating ldap Tue Nov 8 10:05:54 2011 : Debug: ldap { Tue Nov 8 10:05:54 2011 : Debug: server = "xxx.xxx.xxx.xxx" Tue Nov 8 10:05:54 2011 : Debug: port = 389 Tue Nov 8 10:05:54 2011 : Debug: password = "xxxxxx" Tue Nov 8 10:05:54 2011 : Debug: identity = "cn=admin,dc=company,dc=com" Tue Nov 8 10:05:54 2011 : Debug: net_timeout = 50 Tue Nov 8 10:05:54 2011 : Debug: timeout = 50 Tue Nov 8 10:05:54 2011 : Debug: timelimit = 10 Tue Nov 8 10:05:54 2011 : Debug: tls_mode = no Tue Nov 8 10:05:54 2011 : Debug: start_tls = no Tue Nov 8 10:05:54 2011 : Debug: tls_require_cert = "allow" Tue Nov 8 10:05:54 2011 : Debug: tls { Tue Nov 8 10:05:54 2011 : Debug: start_tls = no Tue Nov 8 10:05:54 2011 : Debug: require_cert = "allow" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: basedn = "dc=company,dc=com" Tue Nov 8 10:05:54 2011 : Debug: filter = "(uid=%{Stripped-User-Name})" Tue Nov 8 10:05:54 2011 : Debug: base_filter = "(objectclass=radiusprofile)" Tue Nov 8 10:05:54 2011 : Debug: password_attribute = "Cleartext-Password" Tue Nov 8 10:05:54 2011 : Debug: auto_header = no Tue Nov 8 10:05:54 2011 : Debug: access_attr = "uid" Tue Nov 8 10:05:54 2011 : Debug: access_attr_used_for_allow = yes Tue Nov 8 10:05:54 2011 : Debug: groupname_attribute = "cn" Tue Nov 8 10:05:54 2011 : Debug: groupmembership_filter = "(&(objectClass=groupOfNames)(member=%{control:LDAP-UserDn}))" Tue Nov 8 10:05:54 2011 : Debug: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" Tue Nov 8 10:05:54 2011 : Debug: ldap_debug = 0 Tue Nov 8 10:05:54 2011 : Debug: ldap_connections_number = 200 Tue Nov 8 10:05:54 2011 : Debug: compare_check_items = no Tue Nov 8 10:05:54 2011 : Debug: do_xlat = yes Tue Nov 8 10:05:54 2011 : Debug: set_auth_type = yes Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: Registering ldap_groupcmp for Ldap-Group Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: Registering ldap_xlat with xlat_name ldap Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusClass mapped to RADIUS Class Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type Tue Nov 8 10:05:54 2011 : Debug: rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id Tue Nov 8 10:05:54 2011 : Debug: conns: 0x8174a38 Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_eap, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_eap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap Tue Nov 8 10:05:54 2011 : Debug: eap { Tue Nov 8 10:05:54 2011 : Debug: default_eap_type = "tls" Tue Nov 8 10:05:54 2011 : Debug: timer_expire = 60 Tue Nov 8 10:05:54 2011 : Debug: ignore_unknown_eap_types = no Tue Nov 8 10:05:54 2011 : Debug: cisco_accounting_username_bug = no Tue Nov 8 10:05:54 2011 : Debug: max_sessions = 2048 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_md5 Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-md5 Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_leap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-leap Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_gtc Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-gtc Tue Nov 8 10:05:54 2011 : Debug: gtc { Tue Nov 8 10:05:54 2011 : Debug: challenge = "Password: " Tue Nov 8 10:05:54 2011 : Debug: auth_type = "PAP" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_tls Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-tls Tue Nov 8 10:05:54 2011 : Debug: tls { Tue Nov 8 10:05:54 2011 : Debug: rsa_key_exchange = no Tue Nov 8 10:05:54 2011 : Debug: dh_key_exchange = yes Tue Nov 8 10:05:54 2011 : Debug: rsa_key_length = 512 Tue Nov 8 10:05:54 2011 : Debug: dh_key_length = 512 Tue Nov 8 10:05:54 2011 : Debug: verify_depth = 0 Tue Nov 8 10:05:54 2011 : Debug: pem_file_type = yes Tue Nov 8 10:05:54 2011 : Debug: private_key_file = "/usr/local/etc/raddb/eduroam_CA/10076494/radius.es_privatekey.pem" Tue Nov 8 10:05:54 2011 : Debug: certificate_file = "/usr/local/etc/raddb/eduroam_CA/10076494/10076494.crt" Tue Nov 8 10:05:54 2011 : Debug: CA_file = "/usr/local/etc/raddb/eduroam_CA/10076494/TERENASSL_PATH.pem" Tue Nov 8 10:05:54 2011 : Debug: dh_file = "/usr/local/etc/raddb/eduroam_CA/10076494/dh" Tue Nov 8 10:05:54 2011 : Debug: random_file = "/usr/local/etc/raddb/eduroam_CA/10076494/random" Tue Nov 8 10:05:54 2011 : Debug: fragment_size = 1024 Tue Nov 8 10:05:54 2011 : Debug: include_length = yes Tue Nov 8 10:05:54 2011 : Debug: check_crl = no Tue Nov 8 10:05:54 2011 : Debug: cipher_list = "DEFAULT" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_ttls Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-ttls Tue Nov 8 10:05:54 2011 : Debug: ttls { Tue Nov 8 10:05:54 2011 : Debug: default_eap_type = "md5" Tue Nov 8 10:05:54 2011 : Debug: copy_request_to_tunnel = no Tue Nov 8 10:05:54 2011 : Debug: use_tunneled_reply = yes Tue Nov 8 10:05:54 2011 : Debug: virtual_server = "wifi2" Tue Nov 8 10:05:54 2011 : Debug: include_length = yes Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_peap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-peap Tue Nov 8 10:05:54 2011 : Debug: peap { Tue Nov 8 10:05:54 2011 : Debug: default_eap_type = "mschapv2" Tue Nov 8 10:05:54 2011 : Debug: copy_request_to_tunnel = no Tue Nov 8 10:05:54 2011 : Debug: use_tunneled_reply = yes Tue Nov 8 10:05:54 2011 : Debug: proxy_tunneled_request_as_eap = yes Tue Nov 8 10:05:54 2011 : Debug: virtual_server = "inner-tunnel" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating eap-mschapv2 Tue Nov 8 10:05:54 2011 : Debug: mschapv2 { Tue Nov 8 10:05:54 2011 : Debug: with_ntdomain_hack = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking authorize {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_detail, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_detail Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating auth_log Tue Nov 8 10:05:54 2011 : Debug: detail auth_log { Tue Nov 8 10:05:54 2011 : Debug: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" Tue Nov 8 10:05:54 2011 : Debug: header = "%t" Tue Nov 8 10:05:54 2011 : Debug: detailperm = 384 Tue Nov 8 10:05:54 2011 : Debug: dirperm = 493 Tue Nov 8 10:05:54 2011 : Debug: locking = no Tue Nov 8 10:05:54 2011 : Debug: log_packet_header = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_preprocess, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_preprocess Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating preprocess Tue Nov 8 10:05:54 2011 : Debug: preprocess { Tue Nov 8 10:05:54 2011 : Debug: huntgroups = "/usr/local/etc/raddb/huntgroups" Tue Nov 8 10:05:54 2011 : Debug: hints = "/usr/local/etc/raddb/hints" Tue Nov 8 10:05:54 2011 : Debug: with_ascend_hack = no Tue Nov 8 10:05:54 2011 : Debug: ascend_channels_per_line = 23 Tue Nov 8 10:05:54 2011 : Debug: with_ntdomain_hack = no Tue Nov 8 10:05:54 2011 : Debug: with_specialix_jetstream_hack = no Tue Nov 8 10:05:54 2011 : Debug: with_cisco_vsa_hack = no Tue Nov 8 10:05:54 2011 : Debug: with_alvarion_vsa_hack = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_realm, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_realm Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating suffix Tue Nov 8 10:05:54 2011 : Debug: realm suffix { Tue Nov 8 10:05:54 2011 : Debug: format = "suffix" Tue Nov 8 10:05:54 2011 : Debug: delimiter = "@" Tue Nov 8 10:05:54 2011 : Debug: ignore_default = no Tue Nov 8 10:05:54 2011 : Debug: ignore_null = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_files, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_files Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating files Tue Nov 8 10:05:54 2011 : Debug: files { Tue Nov 8 10:05:54 2011 : Debug: usersfile = "/usr/local/etc/raddb/users" Tue Nov 8 10:05:54 2011 : Debug: acctusersfile = "/usr/local/etc/raddb/acct_users" Tue Nov 8 10:05:54 2011 : Debug: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" Tue Nov 8 10:05:54 2011 : Debug: compat = "no" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking preacct {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_acct_unique, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_acct_unique Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating acct_unique Tue Nov 8 10:05:54 2011 : Debug: acct_unique { Tue Nov 8 10:05:54 2011 : Debug: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking accounting {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating detail Tue Nov 8 10:05:54 2011 : Debug: detail { Tue Nov 8 10:05:54 2011 : Debug: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" Tue Nov 8 10:05:54 2011 : Debug: header = "%t" Tue Nov 8 10:05:54 2011 : Debug: detailperm = 384 Tue Nov 8 10:05:54 2011 : Debug: dirperm = 493 Tue Nov 8 10:05:54 2011 : Debug: locking = no Tue Nov 8 10:05:54 2011 : Debug: log_packet_header = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_always, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_always Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating ok Tue Nov 8 10:05:54 2011 : Debug: always ok { Tue Nov 8 10:05:54 2011 : Debug: rcode = "ok" Tue Nov 8 10:05:54 2011 : Debug: simulcount = 0 Tue Nov 8 10:05:54 2011 : Debug: mpp = no Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking session {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_radutmp, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_radutmp Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating radutmp Tue Nov 8 10:05:54 2011 : Debug: radutmp { Tue Nov 8 10:05:54 2011 : Debug: filename = "/usr/local/var/log/radius/radutmp" Tue Nov 8 10:05:54 2011 : Debug: username = "%{User-Name}" Tue Nov 8 10:05:54 2011 : Debug: case_sensitive = yes Tue Nov 8 10:05:54 2011 : Debug: check_with_nas = yes Tue Nov 8 10:05:54 2011 : Debug: perm = 384 Tue Nov 8 10:05:54 2011 : Debug: callerid = yes Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking post-proxy {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking post-auth {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_attr_filter Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating attr_filter.access_reject Tue Nov 8 10:05:54 2011 : Debug: attr_filter attr_filter.access_reject { Tue Nov 8 10:05:54 2011 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.access_reject" Tue Nov 8 10:05:54 2011 : Debug: key = "%{User-Name}" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: } # modules Tue Nov 8 10:05:54 2011 : Debug: } # server Tue Nov 8 10:05:54 2011 : Debug: server inner-tunnel { Tue Nov 8 10:05:54 2011 : Debug: modules { Tue Nov 8 10:05:54 2011 : Debug: Module: Checking authenticate {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_chap, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_chap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating chap Tue Nov 8 10:05:54 2011 : Debug: (Loaded rlm_mschap, checking if it's valid) Tue Nov 8 10:05:54 2011 : Debug: Module: Linked to module rlm_mschap Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating mschap Tue Nov 8 10:05:54 2011 : Debug: mschap { Tue Nov 8 10:05:54 2011 : Debug: use_mppe = yes Tue Nov 8 10:05:54 2011 : Debug: require_encryption = no Tue Nov 8 10:05:54 2011 : Debug: require_strong = no Tue Nov 8 10:05:54 2011 : Debug: with_ntdomain_hack = yes Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking authorize {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking session {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking post-proxy {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking post-auth {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: } # modules Tue Nov 8 10:05:54 2011 : Debug: } # server Tue Nov 8 10:05:54 2011 : Debug: server { Tue Nov 8 10:05:54 2011 : Debug: modules { Tue Nov 8 10:05:54 2011 : Debug: Module: Checking authenticate {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking authorize {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking preacct {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking accounting {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Instantiating attr_filter.accounting_response Tue Nov 8 10:05:54 2011 : Debug: attr_filter attr_filter.accounting_response { Tue Nov 8 10:05:54 2011 : Debug: attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" Tue Nov 8 10:05:54 2011 : Debug: key = "%{User-Name}" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Module: Checking session {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking post-proxy {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: Module: Checking post-auth {...} for more modules to load Tue Nov 8 10:05:54 2011 : Debug: } # modules Tue Nov 8 10:05:54 2011 : Debug: } # server Tue Nov 8 10:05:54 2011 : Debug: radiusd: #### Opening IP addresses and Ports #### Tue Nov 8 10:05:54 2011 : Debug: listen { Tue Nov 8 10:05:54 2011 : Debug: type = "auth" Tue Nov 8 10:05:54 2011 : Debug: ipaddr = * Tue Nov 8 10:05:54 2011 : Debug: port = 0 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: listen { Tue Nov 8 10:05:54 2011 : Debug: type = "acct" Tue Nov 8 10:05:54 2011 : Debug: ipaddr = * Tue Nov 8 10:05:54 2011 : Debug: port = 0 Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: listen { Tue Nov 8 10:05:54 2011 : Debug: type = "control" Tue Nov 8 10:05:54 2011 : Debug: listen { Tue Nov 8 10:05:54 2011 : Debug: socket = "/usr/local/var/run/radiusd/radiusd.sock" Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: } Tue Nov 8 10:05:54 2011 : Debug: Listening on authentication address * port 1812 Tue Nov 8 10:05:54 2011 : Debug: Listening on accounting address * port 1813 Tue Nov 8 10:05:54 2011 : Debug: Listening on command file /usr/local/var/run/radiusd/radiusd.sock Tue Nov 8 10:05:54 2011 : Debug: Listening on proxy address * port 1814 Tue Nov 8 10:05:54 2011 : Debug: Ready to process requests. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx port 32928, id=80, length=61 User-Name = "student13" User-Password = "xxxxxxx" NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port = 10 Tue Nov 8 10:06:21 2011 : Info: +- entering group authorize {...} Tue Nov 8 10:06:21 2011 : Info: ++[preprocess] returns ok Tue Nov 8 10:06:21 2011 : Info: ++[chap] returns noop Tue Nov 8 10:06:21 2011 : Info: ++[mschap] returns noop Tue Nov 8 10:06:21 2011 : Info: [suffix] No '@' in User-Name = "student13", looking up realm NULL Tue Nov 8 10:06:21 2011 : Info: [suffix] Found realm "NULL" Tue Nov 8 10:06:21 2011 : Info: [suffix] Adding Stripped-User-Name = "student13" Tue Nov 8 10:06:21 2011 : Info: [suffix] Adding Realm = "NULL" Tue Nov 8 10:06:21 2011 : Info: [suffix] Authentication realm is LOCAL. Tue Nov 8 10:06:21 2011 : Info: ++[suffix] returns ok Tue Nov 8 10:06:21 2011 : Info: [eap] No EAP-Message, not doing EAP Tue Nov 8 10:06:21 2011 : Info: ++[eap] returns noop Tue Nov 8 10:06:21 2011 : Info: ++[unix] returns notfound Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: Entering ldap_groupcmp() Tue Nov 8 10:06:21 2011 : Info: [files] expand: dc=company,dc=com -> dc=company,dc=com Tue Nov 8 10:06:21 2011 : Info: [files] expand: (uid=%{Stripped-User-Name}) -> (uid=student13) Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: attempting LDAP reconnection Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: (re)connect to xxx.xxx.xxx.xxx:389, authentication 0 Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: bind as cn=xxxxx,dc=company,dc=com/pppp to xxx.xxx.xxx.xxx:389 Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: waiting for bind result ... Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: Bind was successful Tue Nov 8 10:06:21 2011 : Debug: rlm_ldap: performing search in dc=company,dc=com, with filter (uid=student13) Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 8 10:06:22 2011 : Info: [files] expand: (&(objectClass=groupOfNames)(member=%{control:LDAP-UserDn})) -> (&(objectClass=groupOfNames)(member=cn\3dstudent13\2ccn\3dusers\2cdc\3dcompany\2cdc\3dcom)) Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: performing search in dc=company,dc=com, with filter (&(cn=student13)(&(objectClass=groupOfNames)(member=cn\3dstudent13\2ccn\3dusers\2cdc\3dcompany\2cdc\3dcom))) Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap::ldap_groupcmp: User found in group student Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 8 10:06:22 2011 : Info: [files] users: Matched entry DEFAULT at line 5 Tue Nov 8 10:06:22 2011 : Info: ++[files] returns ok Tue Nov 8 10:06:22 2011 : Info: [ldap] performing user authorization for student13 Tue Nov 8 10:06:22 2011 : Info: [ldap] expand: (uid=%{Stripped-User-Name}) -> (uid=student13) Tue Nov 8 10:06:22 2011 : Info: [ldap] expand: dc=company,dc=com -> dc=company,dc=com Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Nov 8 10:06:22 2011 : Debug: rlm_ldap: performing search in dc=company,dc=com, with filter (uid=student13) Tue Nov 8 10:06:23 2011 : Info: [ldap] checking if remote access for student13 is allowed by uid Tue Nov 8 10:06:23 2011 : Info: [ldap] looking for check items in directory... Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x555463443354631374445413844464334304134353244313042453044433445 Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: sambaLmPassword -> LM-Password == 0x4323314245313638353037463743464341414433423433354235313430344545 Tue Nov 8 10:06:23 2011 : Info: [ldap] looking for reply items in directory... Tue Nov 8 10:06:23 2011 : Debug: WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Tue Nov 8 10:06:23 2011 : Info: [ldap] Setting Auth-Type = LDAP Tue Nov 8 10:06:23 2011 : Info: [ldap] user student13 authorized to use remote access Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 8 10:06:23 2011 : Info: ++[ldap] returns ok Tue Nov 8 10:06:23 2011 : Info: ++[expiration] returns noop Tue Nov 8 10:06:23 2011 : Info: ++[logintime] returns noop Tue Nov 8 10:06:23 2011 : Info: [pap] Normalizing NT-Password from hex encoding Tue Nov 8 10:06:23 2011 : Info: [pap] Normalizing LM-Password from hex encoding Tue Nov 8 10:06:23 2011 : Info: [pap] Found existing Auth-Type, not changing it. Tue Nov 8 10:06:23 2011 : Info: ++[pap] returns noop Tue Nov 8 10:06:23 2011 : Info: Found Auth-Type = LDAP Tue Nov 8 10:06:23 2011 : Info: +- entering group LDAP {...} Tue Nov 8 10:06:23 2011 : Info: [ldap] login attempt by "student13" with password "xxxxxx" Tue Nov 8 10:06:23 2011 : Info: [ldap] user DN: cn=student13,cn=users,dc=company,dc=com Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: (re)connect to xxx.xxx.xxx.xxx:389, authentication 1 Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: bind as cn=student13,cn=users,dc=company,dc=com/xxxxxx to xxx.xxx.xxx.xxx:389 Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: waiting for bind result ... Tue Nov 8 10:06:23 2011 : Debug: rlm_ldap: Bind was successful Tue Nov 8 10:06:23 2011 : Info: [ldap] user student13 authenticated succesfully Tue Nov 8 10:06:23 2011 : Info: ++[ldap] returns ok Tue Nov 8 10:06:23 2011 : Auth: Login OK: [student13] (from client radius port 10) Tue Nov 8 10:06:23 2011 : Info: +- entering group post-auth {...} Tue Nov 8 10:06:23 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 80 to xxx.xxx.xxx.xxx port 32928 Aruba-User-Role = "student" Tue Nov 8 10:06:23 2011 : Info: Finished request 0. Tue Nov 8 10:06:23 2011 : Debug: Going to the next request Tue Nov 8 10:06:23 2011 : Debug: Waking up in 4.9 seconds. Tue Nov 8 10:06:28 2011 : Info: Cleaning up request 0 ID 80 with timestamp +27 Tue Nov 8 10:06:28 2011 : Debug: Ready to process requests. Thank you in advance Remon

2 1