- Freeradius-Users - lists.freeradius.org

exec program, but post-auth
by Alexandre J. Correa - Onda Internet 04 Nov '08

04 Nov '08

Hello !! Here i use Exec-Program-Wait to validade data AFTER auth OK, i need to execute other script AFTER auth OK to get IP address assigned to user. i´m trying to pass %f to my script but return "?.?.?.?" because at this moment, radius not assigned ip for user... how i can do this ? thanks !! -- Sds. Alexandre Jeronimo Correa Onda Internet - http://www.ondainternet.com.br OPinguim Hosting - http://www.opinguim.net Linux User ID #142329 UNOTEL S/A - http://www.unotel.com.br

4 7

user group problems, my logic or freeradius limitation
by Reynolds, Walter 04 Nov '08

04 Nov '08

I am trying to find a good way to limit who is able to login at specific NAS's. I know I could add all the allowed user names to the Huntgroups file, but this can get tedious as I must do it for each NAS. So I figured the best way was to use groups. The users are not account holders on the system, so I could not user the 'Group' option in huntgroups. I also do not have a database backend so wanted to uses a local file. So in looking I saw that I could do the following: 1. modules/etc_group - Define a local file with a group list 2. Created the group file referenced in etc_group 3. Added a dictionary item for the attribute 4. Add the desired NAS to a huntgroup 5. Set a policy in the users file to be based on the list. Where I am having a problem is if the user is assigned to more than one group. As you can see from the first debug output from below, if a user is a member of the group alone it works fine. But the second debug shows that if a user is a member of more than one group, even if one is the right one, it will not work because one of the groups does not match. The reason I need users in more than one group is if they are affiliated with more than one department. Also will need more than one affiliation for support to be able to troubleshoot connecting on each NAS. In case it matters, the back end authentication is Kerberos on our production service but for this test I just have some local accounts defined in the users file. So, is this a error in my logic/setup or is this a limitation I have with Freeradius. Is there some other way to do this? =============== /usr/local/etc/raddb/modules/etc_group passwd etc_group { filename = /usr/local/etc/raddb/group_file format = "~Etc-Group-Name:*,User-Name" hashsize = 150 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } ================ /usr/local/etc/raddb/group_file wilab:walt,walter wilab2:walter,walter01 nolab:walter01 ================= /usr/local/etc/raddb/dictionary ATTRIBUTE Etc-Group-Name 3000 string ================= /usr/local/etc/raddb/huntgroups ILAB NAS-IP-Address == 10.11.224.36 ================= /usr/local/etc/raddb/users (added line numbers for the debug) 102 DEFAULT Huntgroup-Name == ILAB, Etc-Group-Name != "wilab", Auth-Type := Reject 103 Fall-Through = no 104 105 walt Cleartext-Password := "walter01" 106 walter Cleartext-Password := "walter01" 107 walter01 Cleartext-Password := "walter01" ------------------------------- rad_recv: Access-Request packet from host 10.11.224.36 port 32783, id=111, length=131 User-Name = "walt" User-Password = "walter01" NAS-IP-Address = 10.11.224.36 Service-Type = Login-User Framed-IP-Address = 192.168.135.25 Called-Station-Id = "00:07:E9:D1:8F:C2" NAS-Identifier = "Bluesocket" Acct-Session-Id = "00:07:E9:D1:8F:C2:1225801477" NAS-Port-Type = Wireless-802.11 Tue Nov 4 07:09:21 2008 : Info: +- entering group authorize {...} Tue Nov 4 07:09:21 2008 : Info: ++[preprocess] returns ok Tue Nov 4 07:09:21 2008 : Info: ++[chap] returns noop Tue Nov 4 07:09:21 2008 : Info: ++[mschap] returns noop Tue Nov 4 07:09:21 2008 : Info: [suffix] No '@' in User-Name = "walt", looking up realm NULL Tue Nov 4 07:09:21 2008 : Info: [suffix] No such realm "NULL" Tue Nov 4 07:09:21 2008 : Info: ++[suffix] returns noop Tue Nov 4 07:09:21 2008 : Info: [eap] No EAP-Message, not doing EAP Tue Nov 4 07:09:21 2008 : Info: ++[eap] returns noop Tue Nov 4 07:09:21 2008 : Info: ++[unix] returns notfound Tue Nov 4 07:09:21 2008 : Info: [etc_group] Added Etc-Group-Name: 'wilab' to request_items Tue Nov 4 07:09:21 2008 : Info: ++[etc_group] returns ok Tue Nov 4 07:09:21 2008 : Info: [files] users: Matched entry walt at line 105 Tue Nov 4 07:09:21 2008 : Info: ++[files] returns ok Tue Nov 4 07:09:21 2008 : Info: ++[expiration] returns noop Tue Nov 4 07:09:21 2008 : Info: ++[logintime] returns noop Tue Nov 4 07:09:21 2008 : Info: ++[pap] returns updated Tue Nov 4 07:09:21 2008 : Info: Found Auth-Type = PAP Tue Nov 4 07:09:21 2008 : Info: +- entering group PAP {...} Tue Nov 4 07:09:21 2008 : Info: [pap] login attempt with password "walter01" Tue Nov 4 07:09:21 2008 : Info: [pap] Using clear text password "walter01" Tue Nov 4 07:09:21 2008 : Info: [pap] User authenticated successfully Tue Nov 4 07:09:21 2008 : Info: ++[pap] returns ok Tue Nov 4 07:09:21 2008 : Info: +- entering group post-auth {...} Tue Nov 4 07:09:21 2008 : Info: ++[exec] returns noop Sending Access-Accept of id 111 to 10.11.224.36 port 32783 Tue Nov 4 07:09:21 2008 : Info: Finished request 0. ======================= rad_recv: Access-Request packet from host 10.11.224.36 port 32783, id=112, length=133 User-Name = "walter" User-Password = "walter01" NAS-IP-Address = 10.11.224.36 Service-Type = Login-User Framed-IP-Address = 192.168.135.25 Called-Station-Id = "00:07:E9:D1:8F:C2" NAS-Identifier = "Bluesocket" Acct-Session-Id = "00:07:E9:D1:8F:C2:1225801505" NAS-Port-Type = Wireless-802.11 Tue Nov 4 07:09:49 2008 : Info: +- entering group authorize {...} Tue Nov 4 07:09:49 2008 : Info: ++[preprocess] returns ok Tue Nov 4 07:09:49 2008 : Info: ++[chap] returns noop Tue Nov 4 07:09:49 2008 : Info: ++[mschap] returns noop Tue Nov 4 07:09:49 2008 : Info: [suffix] No '@' in User-Name = "walter", looking up realm NULL Tue Nov 4 07:09:49 2008 : Info: [suffix] No such realm "NULL" Tue Nov 4 07:09:49 2008 : Info: ++[suffix] returns noop Tue Nov 4 07:09:49 2008 : Info: [eap] No EAP-Message, not doing EAP Tue Nov 4 07:09:49 2008 : Info: ++[eap] returns noop Tue Nov 4 07:09:49 2008 : Info: ++[unix] returns notfound Tue Nov 4 07:09:49 2008 : Info: [etc_group] Added Etc-Group-Name: 'wilab2' to request_items Tue Nov 4 07:09:49 2008 : Info: [etc_group] Added Etc-Group-Name: 'wilab' to request_items Tue Nov 4 07:09:49 2008 : Info: ++[etc_group] returns ok Tue Nov 4 07:09:49 2008 : Info: [files] users: Matched entry DEFAULT at line 102 Tue Nov 4 07:09:49 2008 : Info: ++[files] returns ok Tue Nov 4 07:09:49 2008 : Info: ++[expiration] returns noop Tue Nov 4 07:09:49 2008 : Info: ++[logintime] returns noop Tue Nov 4 07:09:49 2008 : Info: [pap] Found existing Auth-Type, not changing it. Tue Nov 4 07:09:49 2008 : Info: ++[pap] returns noop Tue Nov 4 07:09:49 2008 : Info: Found Auth-Type = Reject Tue Nov 4 07:09:49 2008 : Info: Auth-Type = Reject, rejecting user Tue Nov 4 07:09:49 2008 : Info: Failed to authenticate the user. Tue Nov 4 07:09:49 2008 : Info: Using Post-Auth-Type Reject Tue Nov 4 07:09:49 2008 : Info: +- entering group REJECT {...} Tue Nov 4 07:09:49 2008 : Info: [attr_filter.access_reject] expand: %{User-Name} -> walter Tue Nov 4 07:09:49 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Nov 4 07:09:49 2008 : Info: ++[attr_filter.access_reject] returns updated Tue Nov 4 07:09:49 2008 : Info: Delaying reject of request 1 for 1 seconds Tue Nov 4 07:09:49 2008 : Debug: Going to the next request Tue Nov 4 07:09:49 2008 : Debug: Waking up in 0.9 seconds. Tue Nov 4 07:09:50 2008 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 112 to 10.11.224.36 port 32783 Tue Nov 4 07:09:50 2008 : Debug: Waking up in 4.9 seconds. Tue Nov 4 07:09:55 2008 : Info: Cleaning up request 1 ID 112 with timestamp +39 Tue Nov 4 07:09:55 2008 : Debug: Ready to process requests. -- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 3

Freeradius-1.0.5_PEAP with EAP-MD5 auth failure
by Prasad Parab 04 Nov '08

04 Nov '08

Hi all/anders, As told, i tried freeradius-2.1.1, but same result. Actaully my setup involves wifi client supporting PEAP ---------> EAP-MD5 |-----> EAP-Token_card l------> EAP-MSCHAPv2 Attached are the conf file eap.conf and debug log file. Wifi client is installed on Windows XP _Service pack 2 OS. SETUP: wifi client(WINXP) <---------> AP <-------------------> freeradius-2.1.1 server. The setup works with PEAP_EAP-Tokencard and PEAP_EAP-MSCHAPv2 But fails only for PEAP_EAP-MD5. Is it because of the supplicant (Win XP). Kindly reply. Regards Prasad On Mon, Nov 3, 2008 at 1:41 PM, Anders Holm <anders.holm(a)sysadmin.ie> wrote: > This is likely to have been fixed in a newer version. Do you see this with a > 2.1.1 installation? > > //anders > > Prasad Parab wrote: > > Hi, > Am using freeradius-1.0.5 for PEAP authentication with EAP-MD5. > Attached is the log of auth failure wirg the same. > Attached also are the configuration files. > Kindly help. > Regards > Prasad > > ________________________________ > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 3

[Q] another Q. : cross-compiling version 1.1.7
by Young-Whan Kim 04 Nov '08

04 Nov '08

I'm compiling for PPC on Intel Debian machine. Compiler package's from montavista. On the compiling, I met "ltdl" problem. So, I added "--enable-ltdl-install" option and then ok. ... I made options like next: ./configure --prefix=/root/local CC=/opt/mvl4/pro/devkit/ppc/7xx/bin/ppc_7xx-gcc CCFLAGS=/usr/src/linux-2.6.10/include/ --enable-ltdl-install --host=ppc But, errors occurred at "rlm_perl" like attatched file.(1.1.7.txt) again. What's a problem? -- from beginner -- P.S. I have to compile freeradius-1.1.7.

1 0

[Q] Cross-Compiling for PPC : version 1.1.7 same 2.1.1 same
by Young-Whan Kim 04 Nov '08

04 Nov '08

Hi~ I did compile freeradius-1.1.7 and 2.1.1. My build machine is : intel debian 3.1 and montavista cross-compiler Options are : ./configure --prefix="/root/local" CC="/opt/mvl4/pro/devkit/ppc/7xx/bin/ppc_7xx-gcc" --host="ppc" First error was about libgdbm.a and wrong format message. So, I got gdbm-xxx.tar.gz package and installed to "/opt/mvl4/pro/devkit/ppc/7xx/target/lib". And then the error disappeared. And now, second error message occurred. /root/ipv6/freeradius-1.1.7/src/main/mainconfig.c:827: warning: Using 'getservbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking /opt/mvl4/pro/devkit/ppc/7xx/bin/../lib/gcc/powerpc-montavista-linux/3.4.3/. ./../../../powerpc-montavista-linux/bin/ld: attempted static link of dynamic object `/opt/mvl4/pro/devkit/ppc/7xx/bin/../target/usr/lib//libltdl.so' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[4]: Leaving directory `/root/ipv6/freeradius-1.1.7/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/root/ipv6/freeradius-1.1.7/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/root/ipv6/freeradius-1.1.7/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/root/ipv6/freeradius-1.1.7' make: *** [all] Error 2 In my thinking, this kinds of errors seems to be happened so often. What can I do for this? -- from beginner -- :-) Thanks.

2 1

RE: Freeradius-Users Digest, Vol 43, Issue 3
by Young-Whan Kim 03 Nov '08

03 Nov '08

Well, I'm porting to PPC with package by the hands of other people and one of those is freeradius-1.1.7. Ok. I'll do that. By the way, does the configuration file of version 1.1.7 use for 2.1.1? Thanks. -----Original Message----- From: freeradius-users-bounces+cs010101=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+cs010101=gmail.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, November 03, 2008 8:00 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 43, Issue 3 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: [Q] compiling for ppc. (Anders Holm) 2. Re: Freeradius-1.0.5_PEAP with EAP-MD5 auth failure (Anders Holm) ---------------------------------------------------------------------- Message: 1 Date: Mon, 03 Nov 2008 08:10:21 +0000 From: Anders Holm <anders.holm(a)sysadmin.ie> Subject: Re: [Q] compiling for ppc. To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <490EB1ED.80909(a)sysadmin.ie> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Young-Whan Kim wrote: > Hi~~ Happy to meet you. > > I'm trying to compile for PPC. The version is 1.1.7. > Why 1.1.7? Use 2.1.1 if you're going through the trouble of compiling anyway. > /opt/mvl4/pro/devkit/ppc/7xx/bin/../lib/gcc/powerpc-montavista-linux/3.4.3/. > ./../../../powerpc-montavista-linux/bin/ld: attempted static link of dynamic > object `/opt/mvl4/pro/devkit/ppc/7xx/bin/../target/usr/lib/libgdbm.a' > collect2: ld returned 1 exit status > Fairly self-explanatory. Why not start with 2.1.1, and use configure without options and see how far you get, and then take one step at a time until things are where you want them to be. //anders ------------------------------ Message: 2 Date: Mon, 03 Nov 2008 08:11:50 +0000 From: Anders Holm <anders.holm(a)sysadmin.ie> Subject: Re: Freeradius-1.0.5_PEAP with EAP-MD5 auth failure To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <490EB246.6040603(a)sysadmin.ie> Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" This is likely to have been fixed in a newer version. Do you see this with a 2.1.1 installation? //anders Prasad Parab wrote: > Hi, > > Am using freeradius-1.0.5 for PEAP authentication with EAP-MD5. > Attached is the log of auth failure wirg the same. > Attached also are the configuration files. > Kindly help. > > Regards > Prasad > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Unable to authenticate to Open Directory
by Kerry Tobin 03 Nov '08

03 Nov '08

Still fails when with_ntdomain_hack is enabled... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /private/etc/raddb/proxy.conf Config: including file: /private/etc/raddb/clients.conf Config: including file: /private/etc/raddb/snmp.conf Config: including file: /private/etc/raddb/eap.conf Config: including file: /private/etc/raddb/sql.conf main: prefix = "/" main: localstatedir = "/private/var" main: logdir = "/private/var/log/radius" main: libdir = "//lib" main: radacctdir = "/private/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/private/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/private/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "//sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded opendirectory opendirectory: passwd = "(null)" Module: Instantiated opendirectory (opendirectory) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/private/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/certificates/ directory.domain.wisc.edu.key" tls: certificate_file = "/etc/certificates/ directory.domain.wisc.edu.crt" tls: CA_file = "/etc/certificates/directory.domain.wisc.edu.chcrt" tls: private_key_password = "somepassword" tls: dh_file = "/private/etc/raddb/certs/dh" tls: random_file = "/private/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/private/etc/raddb/huntgroups" preprocess: hints = "/private/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (DOMAIN) Module: Loaded files files: usersfile = "/private/etc/raddb/users" files: acctusersfile = "/private/etc/raddb/acct_users" files: preproxy_usersfile = "/private/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client- IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/private/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/private/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded SQL sql: driver = "rlm_sql_sqlite" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "rootpass" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/private/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User- Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User- Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck .id ,radgroupcheck .GroupName ,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply .id ,radgroupreply .GroupName ,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct- Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP- Address}', AcctSessionTime = '%{Acct-Session- Time}', AcctInputOctets = '%{Acct-Input- Gigawords:-0}' << 32 | '%{Acct- Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output- Gigawords:-0}' << 32 | '%{Acct-Output- Octets:-0}' WHERE AcctSessionId = '%{Acct-Session- Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session- Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User- Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct- Session-Time}', '%{Acct-Authentic}', '', '% {Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input- Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called- Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session- Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User- Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '% {NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '% {Connect-Info}', '', '0', '0', '%{Called- Station-Id}', '%{Calling-Station-Id}', '', '%{Service- Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '% {Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '% {Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input- Octets:-0}', AcctOutputOctets = '%{Acct-Output- Gigawords:-0}' << 32 | '%{Acct- Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate- Cause}', AcctStopDelay = '%{Acct-Delay- Time:-0}', ConnectInfo_stop = '%{Connect- Info}' WHERE AcctSessionId = '%{Acct-Session- Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User- Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '% {Connect-Info}', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output- Gigawords:-0}' << 32 | '%{Acct-Output- Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station- Id}', '%{Acct-Terminate-Cause}', '%{Service- Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User- Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '% {reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 0 rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.7,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.7 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.5,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.5 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.6,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.6 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.7,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.7 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.8,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.8 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.9,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.9 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.10,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.10 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.11,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.11 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.12,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.12 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.13,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.13 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.17,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.17 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.5,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.5 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.6,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.6 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.8,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.8 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.9,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.9 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.10,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.10 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.11,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.11 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.12,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.12 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.13,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.13 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.15,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.15 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.16,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.16 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.17,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.17 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.18,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.18 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.19,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.19 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.20,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.20 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.21,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.21 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.14,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.14 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 101 rlm_sql_sqlite: sqlite3_finalize() = 0 rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.18:1645, id=141, length=139 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0xa48e7da1b96d032d811b5f90484fc061 EAP-Message = 0x020200140142494f4348454d5c6b77746f62696e NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 141 to 10.0.1.18 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6bb3d9d944118f5c965a13576243b4af Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=142, length=143 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x2da99a6709f529936bef6bef51470d96 EAP-Message = 0x020300060319 NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0x6bb3d9d944118f5c965a13576243b4af NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 1 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 142 to 10.0.1.18 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe706dc4d0e0291e0e8e047db207e2891 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=143, length=295 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x4fb6b57e3546a5977704b42f46cb0f1f EAP-Message = 0x0204009e198000000094160301008f0100008b0301490b0141c6e5d85ea44a312e7bb8b465a0f09ac069ae39a5c77145b3c847ae9e20f9ded8ef1fc3f5c5f99ee0fe8c6c809d271ca2d3241944767f351e1a5102b2570018002f00350005000ac009c00ac013c01400320038001300040100002a00000014001200000f62696f6368656d5c6b77746f62696e000a00080006001700180019000b00020100 NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0xe706dc4d0e0291e0e8e047db207e2891 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 158 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 2 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 008f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0652], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 143 to 10.0.1.18 port 1645 EAP-Message = 0x0105040a19c0000006af160301004a020000460301490b013efeec63a498c85ac1c7147569eee59af667636f881667ef1936aaa6c5209210aea17c090ccde6e09055d194628c1dcd085c91d959f9c04c41c235423360002f0016030106520b00064e00064b0003213082031d30820286a003020102020309f4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479301e170d3038313030373137353331385a170d3130313030383137353331385a3081a731 EAP-Message = 0x0b30090603550406130255533112301006035504081309576973636f6e73696e3110300e060355040713074d616469736f6e31283026060355040a131f556e6976657273697479206f6620576973636f6e73696e2d4d616469736f6e31233021060355040b131a4465706172746d656e74206f662042696f6368656d6973747279312330210603550403131a6469726563746f72792e62696f6368656d2e776973632e65647530819f300d06092a864886f70d010101050003818d0030818902818100cca2a234e44460f5581769f32d3db1c9c6a392606f399af6949cf226a89ba21bed5eb7a8232c984d62b482798bccda8c7167b5c94610adab12c3 EAP-Message = 0x5d6e4a169057cacdca0c241f7664b4ee357d2c195a77ff58a109372cfed1b47c5f55cd3aecd5614cde8a5e5af7189832b523df01f3b19a045d0820752335dbe76c5001bd86b90203010001a381ae3081ab300e0603551d0f0101ff0404030204f0301d0603551d0e0416041470ebf51284bbf75477107119daa2431c45e66da8303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e67656f74727573742e636f6d2f63726c732f73656375726563612e63726c301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d250416301406082b0601050507030106082b0601050507030230 EAP-Message = 0x0d06092a864886f70d0101050500038181009ef534fbfd107c74a784add2cd43b697dc7419168de8d3fa40618c2dbd7e1f47476212609fb0abbb792dac5fe1c99efed42c5c9ccee72ce50bde41fa3451d395e1d74254655d2033badfa8999590a4ae14b0ee3448e8687ce1f19472e6d3edfa92827c061f246a8e99e42ef3429f0bb64d4f6f174628e1d4d95d2903f57719580003243082032030820289a003020102020435def4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b13244571756966617820536563757265204365727469666963617465 EAP-Message = 0x20417574686f72697479301e170d3938303832323136 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x114f5ffc05ee4ad37ad8ba841de21409 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=144, length=143 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0xe3e8142bda7d07ce675f9d322f1a897c EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0x114f5ffc05ee4ad37ad8ba841de21409 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 144 to 10.0.1.18 port 1645 EAP-Message = 0x010602b51900343135315a170d3138303832323136343135315a304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c15db158670862eea09a2d1f086d911468980a1efeda046f13846221c3d17cce9f05e0b801f04e34ece28a950464acf16b535f05b3cb6780bf42028efedd0109ece100144ffcfbf00cdd43ba5b2be11f80709915579316f10f976ab7c268231ccc4d5930ac511e3baf2bd6ee63457bc5d95f50d2e350 EAP-Message = 0x0f3a88e7bf14fde0c7b90203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479310d300b0603550403130443524c31301a0603551d1004133011810f32303138303832323136343135315a300b0603551d0f040403020106301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d0e0416041448e668f92bd2b295d747d82320104f3398909fd4300c0603551d1304053003 EAP-Message = 0x0101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d01010505000381810058ce29eafcf7deb5ce02b917b585d1b9e3e095cc25310d00a6926e7fb692639e5095d19a6fe411de63856e98eea8ff5ac8d355b2667157dec021eb3d2aa72349010486427bfcee7fa21652b56767d340db3b2658b228773dae147761d6fa2a6627a00dfaa7735cea70f1942165445ffafcef2968a9a28779ef79ef4fac07773816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac8a03590947a4a133d475214f94e56b Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=145, length=345 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0xed28b544c87f25f497e3613d6cb3bcdf EAP-Message = 0x020600d01980000000c616030100861000008200803e724edfea2cb04f67fddde42c96a923f9bb9c846153512105f5b523fd7dc8c92b75aae9c15a683335c64c42be8fbbf7af7db81e269ef9cc8591991fdc329e00df2cac96b6971724cf15f0e017dd4971d3426f5fd381c71bcaad5aa273ce539e364b5b8232e62e0138f8dcb890f5c6431a042373e6b8b575ab0ae28d675073c11403010001011603010030663ab180a032a44019f082c7b7bbbe08b4ab0289d3f756b3db9c008ff833b677dcd0f13b8a3f8dff843fee6ff5ade45f NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0xac8a03590947a4a133d475214f94e56b NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 145 to 10.0.1.18 port 1645 EAP-Message = 0x0107004119001403010001011603010030228059fa6d5d5315500d985707e3971e2ed6528447523cb9eddbe62cd59ade513573cb6c65ca62c4aae4ade497822162 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x047026473879d59c947bc8c63927aeb7 Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=146, length=143 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x9f2bc68db89048165ba1634281fc72b4 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0x047026473879d59c947bc8c63927aeb7 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 5 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 146 to 10.0.1.18 port 1645 EAP-Message = 0x0108002b1900170301002064dace269cb899183bd8d95224eb94f32b5e6a26066dad7788f53605a5aded03 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed196022f86e5afdd435936327716839 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=147, length=196 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x79803d7a760259e31ef05817b9324ee7 EAP-Message = 0x0208003b19001703010030097b27b79776f3439411c7d9eb0b461d0be1c00ed19d5af243e1b1b5cefd44bd953e77adc0dc20396a887f50aa4e9cda NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0xed196022f86e5afdd435936327716839 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 59 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - DOMAIN\testuser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800140142494f4348454d5c6b77746f62696e PEAP: Got tunneled identity of DOMAIN\testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to DOMAIN\testuser PEAP: Sending tunneled request EAP-Message = 0x020800140142494f4348454d5c6b77746f62696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\testuser" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 20 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010900291a0109002410f6a2c9810fb7ed8edb009ef517c57b9842494f4348454d5c6b77746f62696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x676e7eabb3df0b7fd51756e198fb33e1 PEAP: Processing from tunneled session code 0x3d0b40 11 EAP-Message = 0x010900291a0109002410f6a2c9810fb7ed8edb009ef517c57b9842494f4348454d5c6b77746f62696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x676e7eabb3df0b7fd51756e198fb33e1 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 147 to 10.0.1.18 port 1645 EAP-Message = 0x0109004b19001703010040f2f081f7c672f75e88cc3c28924709ccce0b2ffc36eafc0eedb192a5ff797eb09cc69b304b0a73c0fa7dd1cd0955a7fde7dfd368453e179f886b4a19743253ab Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf04e08db6dfd07d6ea4469559541778b Finished request 6 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=148, length=244 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x04fa6f71fd593d68468ba675d8a6a6fd EAP-Message = 0x0209006b190017030100608ba86381a989f629a0152db4af2e5e1b230358e0e52f2b7804c6b7015e455a85fdd3af9b7582e3874bad298f2563d3dbd7d92f2ae857e1f6d7855e911ee79990791c3f0401b495543bbe55e9d71a4dde69abf394de19514ebdb952c36cf00363 NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0xf04e08db6dfd07d6ea4469559541778b NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 107 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 7 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0209004a1a02090045319e7f822007891eede62836fae693e7380000000000000000e678940c9d90daad8c447247c5f2a5735a81f065a4f51c5a0042494f4348454d5c6b77746f62696e PEAP: Setting User-Name to DOMAIN\testuser PEAP: Adding old state with 67 6e PEAP: Sending tunneled request EAP-Message = 0x0209004a1a02090045319e7f822007891eede62836fae693e7380000000000000000e678940c9d90daad8c447247c5f2a5735a81f065a4f51c5a0042494f4348454d5c6b77746f62696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\testuser" State = 0x676e7eabb3df0b7fd51756e198fb33e1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 74 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 7 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: No NT-Password configured. Trying DirectoryService Authentication. rlm_mschap: getUserNodeRef(): dsGetRecordList() status = 0, recCount=0 rlm_osx_od: ds_mschap_auth: getUserNodeRef failed modcall[authenticate]: module "mschap" returns fail for request 7 modcall: leaving group MS-CHAP (returns fail) for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: leaving group authenticate (returns reject) for request 7 auth: Failed to validate the user. Login incorrect: [testuser] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 3 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x3d26b0 3 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 148 to 10.0.1.18 port 1645 EAP-Message = 0x010a002b1900170301002013b0843f143878e3e3c72c2dc0b637942564e4cd356299644f344050eec64b82 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3ac5dbc0d187f8eac944d43bec2c0ee6 Finished request 7 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=149, length=180 User-Name = "DOMAIN\\testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0xf76349f84857f1b818b035805e606323 EAP-Message = 0x020a002b19001703010020c497d0e05f02c157dc32f289f96a454aa43f4a825a3fd48ca82f1e2473e949f7 NAS-Port-Type = Wireless-802.11 NAS-Port = 25054 State = 0x3ac5dbc0d187f8eac944d43bec2c0ee6 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "DOMAIN\testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN \testuser" rlm_realm: Found realm "DOMAIN" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm DOMAIN rlm_realm: Adding Realm = "DOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "DOMAIN" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 8 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. Login incorrect: [testuser] (from client DomainWireless port 25054 cli 001f.5bbe.f006) Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 141 with timestamp 490b013e Cleaning up request 1 ID 142 with timestamp 490b013e Cleaning up request 2 ID 143 with timestamp 490b013e Cleaning up request 3 ID 144 with timestamp 490b013e Cleaning up request 4 ID 145 with timestamp 490b013e Sending Access-Reject of id 149 to 10.0.1.18 port 1645 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 146 with timestamp 490b0141 Cleaning up request 6 ID 147 with timestamp 490b0141 Cleaning up request 7 ID 148 with timestamp 490b0141 Cleaning up request 8 ID 149 with timestamp 490b0141 Nothing to do. Sleeping until we see a request. Kerry Tobin > > > Message: 1 > Date: Thu, 30 Oct 2008 15:14:02 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Freeradius-Users Digest, Vol 42, Issue 169 > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <6pV6Kdh8.1225376042.7408230.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > >> rlm_mschap: NT Domain delimeter found, should we have enabled >> with_ntdomain_hack > > You need to enable with_ntdomain_hack in mschap module. ntdomain realm > works for pap requests. > > Ivan Kalik > Kalik Informatika ISP

2 1

Using counter module
by Romain Mercier 03 Nov '08

03 Nov '08

Hi ! I would like to use the counter module (not the sql_counter module) of FreeRadius 2.0.5 and I have questions about it : 1 - If it's possible, how can I display the value of a counter into the reply message ? 2 - I have created a counter based on the Acct-Output-Octets, so when a user reached the threshold, the Reply-Message is remplaced by : "Your maximum daily usage time has been reached". I would like to modify it depending on the threshold reached (I will place 2 or 3 differents counters) because it's in English, I display this Reply-Message on my error page and because the threshold is not depending on time :) Is it possible and how can I do it ? Thank you for your help -- Romain Mercier Université d'Angers Service Systèmes et Réseaux @ : romain.mercier(a)univ-angers.fr

2 1

Re: Unable to authenticate to Open Directory
by Kerry Tobin 03 Nov '08

03 Nov '08

Just for reference, here is a copy of the log when it works (without including a domain)... Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /private/etc/raddb/proxy.conf Config: including file: /private/etc/raddb/clients.conf Config: including file: /private/etc/raddb/snmp.conf Config: including file: /private/etc/raddb/eap.conf Config: including file: /private/etc/raddb/sql.conf main: prefix = "/" main: localstatedir = "/private/var" main: logdir = "/private/var/log/radius" main: libdir = "//lib" main: radacctdir = "/private/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/private/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/private/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "//sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = no Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded opendirectory opendirectory: passwd = "(null)" Module: Instantiated opendirectory (opendirectory) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/private/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/certificates/ directory.domain.wisc.edu.key" tls: certificate_file = "/etc/certificates/ directory.domain.wisc.edu.crt" tls: CA_file = "/etc/certificates/directory.domain.wisc.edu.chcrt" tls: private_key_password = "somepassword" tls: dh_file = "/private/etc/raddb/certs/dh" tls: random_file = "/private/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "mschapv2" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/private/etc/raddb/huntgroups" preprocess: hints = "/private/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (DOMAIN) Module: Loaded files files: usersfile = "/private/etc/raddb/users" files: acctusersfile = "/private/etc/raddb/acct_users" files: preproxy_usersfile = "/private/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client- IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/private/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/private/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded SQL sql: driver = "rlm_sql_sqlite" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "rootpass" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/private/var/log/radius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User- Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User- Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck .id ,radgroupcheck .GroupName ,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply .id ,radgroupreply .GroupName ,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct- Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP- Address}', AcctSessionTime = '%{Acct-Session- Time}', AcctInputOctets = '%{Acct-Input- Gigawords:-0}' << 32 | '%{Acct- Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output- Gigawords:-0}' << 32 | '%{Acct-Output- Octets:-0}' WHERE AcctSessionId = '%{Acct-Session- Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session- Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User- Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct- Session-Time}', '%{Acct-Authentic}', '', '% {Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input- Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called- Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP- Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session- Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User- Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '% {NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '% {Connect-Info}', '', '0', '0', '%{Called- Station-Id}', '%{Calling-Station-Id}', '', '%{Service- Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '% {Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '% {Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input- Octets:-0}', AcctOutputOctets = '%{Acct-Output- Gigawords:-0}' << 32 | '%{Acct- Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate- Cause}', AcctStopDelay = '%{Acct-Delay- Time:-0}', ConnectInfo_stop = '%{Connect- Info}' WHERE AcctSessionId = '%{Acct-Session- Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct- Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User- Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS- Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '% {Connect-Info}', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output- Gigawords:-0}' << 32 | '%{Acct-Output- Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station- Id}', '%{Acct-Terminate-Cause}', '%{Service- Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User- Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '% {reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 0 rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.7,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.7 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.5,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.5 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.6,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.6 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.7,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.7 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.8,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.8 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.9,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.9 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.10,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.10 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.11,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.11 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.12,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.12 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.13,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.13 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.17,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.2.17 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.5,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.5 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.6,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.6 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.8,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.8 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.9,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.9 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.10,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.10 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.11,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.11 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.12,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.12 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.13,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.13 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.15,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.15 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.16,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.16 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.17,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.17 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.18,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.18 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.19,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.19 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.20,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.20 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.21,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.21 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.1.14,shortname=DomainWireless,secret=somesecret rlm_sql (sql): Adding client 10.0.1.14 (DomainWireless) to clients list rlm_sql_sqlite: sqlite3_step = 101 rlm_sql_sqlite: sqlite3_finalize() = 0 rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.0.1.18:1645, id=150, length=123 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x21a70099d67ed895b6d58202f8cf33b8 EAP-Message = 0x0202000c016b77746f62696e NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 150 to 10.0.1.18 port 1645 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4a2a0a2e5a86cf597090ff098e667925 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=151, length=135 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x6e8db458b814fef228cdbb484d169e43 EAP-Message = 0x020300060319 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x4a2a0a2e5a86cf597090ff098e667925 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 1 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 151 to 10.0.1.18 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x591c749deb8d973b0b860c325be1e762 Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=152, length=247 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0xfe9b3bd973921b51a3919768a9544a99 EAP-Message = 0x0204007619800000006c1603010067010000630301490b0b124aaaaa38210b473f8640fc3cf6510a59c107fa80e45e729c84601032000018002f00350005000ac009c00ac013c0140032003800130004010000220000000c000a0000076b77746f62696e000a00080006001700180019000b00020100 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x591c749deb8d973b0b860c325be1e762 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 2 rlm_eap: EAP packet type response id 4 length 118 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 2 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0067], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0652], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 152 to 10.0.1.18 port 1645 EAP-Message = 0x0105040a19c0000006af160301004a020000460301490b0b0f79a2dc33063949421fe0733bced640cdaa2a664068bda36c257afc922089edfd639d7e5ae6a5d9ccca6b64f066bafedba2d2fae7eaa732818695b2886b002f0016030106520b00064e00064b0003213082031d30820286a003020102020309f4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479301e170d3038313030373137353331385a170d3130313030383137353331385a3081a731 EAP-Message = 0x0b30090603550406130255533112301006035504081309576973636f6e73696e3110300e060355040713074d616469736f6e31283026060355040a131f556e6976657273697479206f6620576973636f6e73696e2d4d616469736f6e31233021060355040b131a4465706172746d656e74206f662042696f6368656d6973747279312330210603550403131a6469726563746f72792e62696f6368656d2e776973632e65647530819f300d06092a864886f70d010101050003818d0030818902818100cca2a234e44460f5581769f32d3db1c9c6a392606f399af6949cf226a89ba21bed5eb7a8232c984d62b482798bccda8c7167b5c94610adab12c3 EAP-Message = 0x5d6e4a169057cacdca0c241f7664b4ee357d2c195a77ff58a109372cfed1b47c5f55cd3aecd5614cde8a5e5af7189832b523df01f3b19a045d0820752335dbe76c5001bd86b90203010001a381ae3081ab300e0603551d0f0101ff0404030204f0301d0603551d0e0416041470ebf51284bbf75477107119daa2431c45e66da8303a0603551d1f04333031302fa02da02b8629687474703a2f2f63726c2e67656f74727573742e636f6d2f63726c732f73656375726563612e63726c301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d250416301406082b0601050507030106082b0601050507030230 EAP-Message = 0x0d06092a864886f70d0101050500038181009ef534fbfd107c74a784add2cd43b697dc7419168de8d3fa40618c2dbd7e1f47476212609fb0abbb792dac5fe1c99efed42c5c9ccee72ce50bde41fa3451d395e1d74254655d2033badfa8999590a4ae14b0ee3448e8687ce1f19472e6d3edfa92827c061f246a8e99e42ef3429f0bb64d4f6f174628e1d4d95d2903f57719580003243082032030820289a003020102020435def4cf300d06092a864886f70d0101050500304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b13244571756966617820536563757265204365727469666963617465 EAP-Message = 0x20417574686f72697479301e170d3938303832323136 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4481a86ff249a39acb99677008e7640c Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=153, length=135 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x300263e09617853187428735b5f0a7a4 EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x4481a86ff249a39acb99677008e7640c NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 3 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 3 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 153 to 10.0.1.18 port 1645 EAP-Message = 0x010602b51900343135315a170d3138303832323136343135315a304e310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f7269747930819f300d06092a864886f70d010101050003818d0030818902818100c15db158670862eea09a2d1f086d911468980a1efeda046f13846221c3d17cce9f05e0b801f04e34ece28a950464acf16b535f05b3cb6780bf42028efedd0109ece100144ffcfbf00cdd43ba5b2be11f80709915579316f10f976ab7c268231ccc4d5930ac511e3baf2bd6ee63457bc5d95f50d2e350 EAP-Message = 0x0f3a88e7bf14fde0c7b90203010001a38201093082010530700603551d1f046930673065a063a061a45f305d310b30090603550406130255533110300e060355040a130745717569666178312d302b060355040b1324457175696661782053656375726520436572746966696361746520417574686f72697479310d300b0603550403130443524c31301a0603551d1004133011810f32303138303832323136343135315a300b0603551d0f040403020106301f0603551d2304183016801448e668f92bd2b295d747d82320104f3398909fd4301d0603551d0e0416041448e668f92bd2b295d747d82320104f3398909fd4300c0603551d1304053003 EAP-Message = 0x0101ff301a06092a864886f67d074100040d300b1b0556332e3063030206c0300d06092a864886f70d01010505000381810058ce29eafcf7deb5ce02b917b585d1b9e3e095cc25310d00a6926e7fb692639e5095d19a6fe411de63856e98eea8ff5ac8d355b2667157dec021eb3d2aa72349010486427bfcee7fa21652b56767d340db3b2658b228773dae147761d6fa2a6627a00dfaa7735cea70f1942165445ffafcef2968a9a28779ef79ef4fac07773816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5d94317e82482ee07e077c7a806d4655 Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=154, length=337 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x7e2872804be87cb5c24fe79702856c86 EAP-Message = 0x020600d01980000000c6160301008610000082008076d2ab064c7dfbc8fe01377fc52003057f9f35f5e1684cda34a84aa202c7d19fa6def52cddec20eaf610dcb432ba43d6c34dd785d060bbc2387ff4356b4ebc9e63fdd8015132e4c823109a05f0cdf064cd8b84f3c3a98c7ff9ed6190d305d46a4bf84bca1c4853beade13b5ebf7498b6e32c6de431da31203f960fcd0cce91741403010001011603010030a023c37a60d970f43574b78b177863fa654636bad6554c5958b52df7a2716d17f111a049f8f61040a9aecfb1f01025f3 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x5d94317e82482ee07e077c7a806d4655 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 4 rlm_eap: EAP packet type response id 6 length 208 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 4 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 154 to 10.0.1.18 port 1645 EAP-Message = 0x01070041190014030100010116030100308f4e0a54a4e126298fe8c058330f25b8b731580ee4057fc1674d10b8afaf62959fc9114339a9505d8684e14f6b9fab2f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb061ad88ae044e6291277650b7657920 Finished request 4 Going to the next request Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 150 with timestamp 490b0b0f Cleaning up request 1 ID 151 with timestamp 490b0b0f Cleaning up request 2 ID 152 with timestamp 490b0b0f Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 153 with timestamp 490b0b10 Cleaning up request 4 ID 154 with timestamp 490b0b10 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.0.1.18:1645, id=155, length=135 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0xed4dd7ada864c069682d62e4c66ff599 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0xb061ad88ae044e6291277650b7657920 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 5 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 5 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 155 to 10.0.1.18 port 1645 EAP-Message = 0x0108002b19001703010020b4352c9800616cfdf05642f275727036c70820cfd76a8acb862937e3451bc166 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x495a2a86b4a66263e9ac633eb6a300f1 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=156, length=172 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x8da931deaef5a23772da110067910fba EAP-Message = 0x0208002b19001703010020d6d53eb955487c8c34f6727e49477111cd1d6bfd26f2009ebe3fa20478345ee8 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x495a2a86b4a66263e9ac633eb6a300f1 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - testuser rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0208000c016b77746f62696e PEAP: Got tunneled identity of testuser PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to testuser PEAP: Sending tunneled request EAP-Message = 0x0208000c016b77746f62696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 6 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010900211a0109001c103f2d9656bb43c33d8482d9678ce3a4836b77746f62696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7451159cd4fc6d6145041f37015cb62a PEAP: Processing from tunneled session code 0x3cfb10 11 EAP-Message = 0x010900211a0109001c103f2d9656bb43c33d8482d9678ce3a4836b77746f62696e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7451159cd4fc6d6145041f37015cb62a PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 156 to 10.0.1.18 port 1645 EAP-Message = 0x0109004b190017030100400becdb075ca506f4c7a8b1f6ef169639bbf89df30e6dfcb409cf185bae6c163aa8c17da4e7f9fe5f27b3df78233e556b9a6aab83a548ab9c64a988653c8fd0c5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x08c676252f67b7cf64a343e62ed932f0 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=157, length=236 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x31c1a65ee1f701ce20a9e3ad53505fec EAP-Message = 0x0209006b190017030100609b4e7a540cbfbde54f7d8911273d4af32fb066522788be221fb4c9972784310c90425251130fac2a277ec4dacfa3d912036e54a01cba805f4b8c590a6a3fc8041623368987eab3d2bcc10e079c9e1958263e1178b0d8e2aecb2001f30b293c9e NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x08c676252f67b7cf64a343e62ed932f0 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 107 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 7 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020900421a0209003d311d8a59247ccad005f9e47537587d898700000000000000004300be800e43b82cd1989672cf3c1edf846c6d969689a0e9006b77746f62696e PEAP: Setting User-Name to testuser PEAP: Adding old state with 74 51 PEAP: Sending tunneled request EAP-Message = 0x020900421a0209003d311d8a59247ccad005f9e47537587d898700000000000000004300be800e43b82cd1989672cf3c1edf846c6d969689a0e9006b77746f62696e FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" State = 0x7451159cd4fc6d6145041f37015cb62a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 66 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 7 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password rlm_mschap: No NT-Password configured. Trying DirectoryService Authentication. ?rlm_mschap:username_string = testuser, shortUserName=testuser (length = 7) ?rlm_mschap: stepbuf server challenge:? 3f2d9656bb43c33d8482d9678ce3a483 ?rlm_mschap: stepbuf peer challenge:?? 1d8a59247ccad005f9e47537587d8987 ?rlm_mschap stepbuf p24:?? 4300be800e43b82cd1989672cf3c1edf846c6d969689a0e9 rlm_mschap: dsDoDirNodeAuth returns stepbuff: S=DB62FA32A5AF20F567740F16CE228D01B89521CB (len=66) modcall[authenticate]: module "mschap" returns ok for request 7 modcall: leaving group MS-CHAP (returns ok) for request 7 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 PEAP: Got tunneled reply RADIUS code 11 MS-CHAP2-Success = 0x09533d44423632464133324135414632304635363737343046313643453232384430314238393532314342000000102c3d0007000000d9040701d40407010000000000d881 EAP-Message = 0x010a00331a0309002e533d44423632464133324135414632304635363737343046313643453232384430314238393532314342 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6cb06a5aa4c91ddfcdae1d8189c2fcbb PEAP: Processing from tunneled session code 0x3d27d0 11 MS-CHAP2-Success = 0x09533d44423632464133324135414632304635363737343046313643453232384430314238393532314342000000102c3d0007000000d9040701d40407010000000000d881 EAP-Message = 0x010a00331a0309002e533d44423632464133324135414632304635363737343046313643453232384430314238393532314342 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6cb06a5aa4c91ddfcdae1d8189c2fcbb PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 157 to 10.0.1.18 port 1645 EAP-Message = 0x010a005b19001703010050be148087de289c86c93160779f7f6be95172100fc8f4edd137fa1b566732ffb2c3a926a2c8f17d5a9e6e42e22d0a6cd48d67cec692aa245282e5bf5920a5c7080b11928d54a09a1a1a6bb26bb9595e4a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x38a8a1783e50d956e286c47ecdc1b7d1 Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=158, length=172 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x1bb337b5caa1f7333e459d2b33b4291f EAP-Message = 0x020a002b19001703010020204036769ed5dbe464e3334da06804a15a469833fba472047c60a28bf037eb91 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0x38a8a1783e50d956e286c47ecdc1b7d1 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 8 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00061a03 PEAP: Setting User-Name to testuser PEAP: Adding old state with 6c b0 PEAP: Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testuser" State = 0x6cb06a5aa4c91ddfcdae1d8189c2fcbb Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 8 rlm_eap: EAP packet type response id 10 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 8 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 127.0.0.1 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Login OK: [testuser] (from client localhost port 0) PEAP: Got tunneled reply RADIUS code 2 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testuser" PEAP: Processing from tunneled session code 0x3d0790 2 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testuser" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 8 modcall: leaving group authenticate (returns handled) for request 8 Sending Access-Challenge of id 158 to 10.0.1.18 port 1645 EAP-Message = 0x010b002b19001703010020fc461ad563c5f166e5e7949ec4b5663c719cbcebd2a71c694eafd473ea4c04be Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd259d1069cc2d2bee25600aa1139b2c9 Finished request 8 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.0.1.18:1645, id=159, length=172 User-Name = "testuser" Framed-MTU = 1400 Called-Station-Id = "0012.014d.d511" Calling-Station-Id = "001f.5bbe.f006" Service-Type = Login-User Message-Authenticator = 0x6c710ad694578ce636eb66fca6ef90c8 EAP-Message = 0x020b002b19001703010020e4d27f5ec66f0babcfba34fefe7ec5f1b979d4e86701aa0e70e5218d27883366 NAS-Port-Type = Wireless-802.11 NAS-Port = 25057 State = 0xd259d1069cc2d2bee25600aa1139b2c9 NAS-IP-Address = 10.0.1.18 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "DOMAIN" returns noop for request 9 rlm_eap: EAP packet type response id 11 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 9 rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. rlm_opendirectory: The host 10.0.1.18 does not have an access group. rlm_opendirectory: no access control groups, all users allowed. modcall[authorize]: module "opendirectory" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 Login OK: [testuser] (from client DomainWireless port 25057 cli 001f. 5bbe.f006) Sending Access-Accept of id 159 to 10.0.1.18 port 1645 MS-MPPE-Recv-Key = 0x2b4538f01f984b67a1f7663d4ed1de76f2378883e9bc80f1d52edc595071fa42 MS-MPPE-Send-Key = 0x704ed16dcbe365fb60a510bf5c5bf1419e7feb27e49d36ea8e1c75b06708c78c EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testuser" Finished request 9 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 155 with timestamp 490b0b17 Cleaning up request 6 ID 156 with timestamp 490b0b17 Cleaning up request 7 ID 157 with timestamp 490b0b17 Cleaning up request 8 ID 158 with timestamp 490b0b17 Cleaning up request 9 ID 159 with timestamp 490b0b17 Nothing to do. Sleeping until we see a request. Kerry Tobin > > > Message: 1 > Date: Thu, 30 Oct 2008 15:14:02 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Freeradius-Users Digest, Vol 42, Issue 169 > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <6pV6Kdh8.1225376042.7408230.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > >> rlm_mschap: NT Domain delimeter found, should we have enabled >> with_ntdomain_hack > > You need to enable with_ntdomain_hack in mschap module. ntdomain realm > works for pap requests. > > Ivan Kalik > Kalik Informatika ISP

1 0

Help freeradius+avpairs+account+proxy
by Siumafua Moala 03 Nov '08

03 Nov '08

Hello, I have a freeradius server with mysql backend for accounting. I want to use it 1. assign ip to pppoe customers 2. use cisco av-pairs to assign vrf (for MPLS vpn) 3. keep accounting records on the mysql backend 4. proxy only the authication part to our billing radius server. configure the items 1-3 above on a standalone server is ok. Proxying everything to another radius server is ok. It would be easier of course to proxying everything to our billing radius server but they will charge a lot of money for it. appreciate if anyone could point me in the right direction. Regards, S. Moala

2 1