- Freeradius-Users - lists.freeradius.org

EAP Submodule failed. PAM module issue.
by HORMAZABAL PI�ONES BARBARA FRANCISCA 22 Sep '20

22 Sep '20

Greetings, I'm a Freeradius newbie and I apologize if I make mistakes with some concepts or get my point across (english is not my first language). Anyway, I'm setting up freeradius in Ubuntu server 18.04 to authenticate users (teachers, students) through their google accounts (we have a couple of domains for each one), so I was adviced to use the PAM-IMAP module. When trying to authenticate however, it fails going through the eap-peap authentication. I read the output and checked that authentication is invalid in the pam module however I do not know how to fix it. This is the output: (0) Received Access-Request Id 11 from 192.168.128.34:39957 to 146.83.124.26:1812 length 401 (0) User-Name = "wifi(a)ucn.cl" (0) NAS-IP-Address = 192.168.128.34 (0) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) NAS-Port = 1 (0) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (0) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1" (0) Acct-Session-Id = "B51015A162BFE948" (0) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027074 (0) WLAN-AKM-Suite = 1027073 (0) WLAN-Group-Mgmt-Cipher = 1027078 (0) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (0) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (0) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (0) Meraki-Device-Name = "AP-V1-Soporte" (0) Framed-MTU = 1400 (0) EAP-Message = 0x0273001001776966694075636e2e636c (0) Message-Authenticator = 0xae977006014c0b9d5e053dcf6096b593 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (0) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (0) auth_log: EXPAND %t (0) auth_log: --> Fri Aug 28 18:49:24 2020 (0) [auth_log] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (0) suffix: Found realm "ucn.cl" (0) suffix: Adding Stripped-User-Name = "wifi" (0) suffix: Adding Realm = "ucn.cl" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap: Peer sent EAP Response (code 2) ID 115 length 16 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_peap to process data (0) eap_peap: Initiating new EAP-TLS session (0) eap_peap: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 116 length 6 (0) eap: EAP session adding &reply:State = 0x21dd954121a98c3d (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 11 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (0) EAP-Message = 0x017400061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x21dd954121a98c3dcbc41c49c2b781e8 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 12 from 192.168.128.34:39957 to 146.83.124.26:1812 length 569 (1) User-Name = "wifi(a)ucn.cl" (1) NAS-IP-Address = 192.168.128.34 (1) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 1 (1) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (1) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 58 / Channel: 1" (1) Acct-Session-Id = "B51015A162BFE948" (1) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027074 (1) WLAN-AKM-Suite = 1027073 (1) WLAN-Group-Mgmt-Cipher = 1027078 (1) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (1) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (1) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (1) Meraki-Device-Name = "AP-V1-Soporte" (1) Framed-MTU = 1400 (1) EAP-Message = 0x027400a619800000009c16030300970100009303035f4989f5fe7058f0113f2253369f4f35c5566c645792b9886416adff683207c000002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d (1) State = 0x21dd954121a98c3dcbc41c49c2b781e8 (1) Message-Authenticator = 0xe979fd0de253104acb886c6a7bb04df5 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (1) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (1) auth_log: EXPAND %t (1) auth_log: --> Fri Aug 28 18:49:24 2020 (1) [auth_log] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (1) suffix: Found realm "ucn.cl" (1) suffix: Adding Stripped-User-Name = "wifi" (1) suffix: Adding Realm = "ucn.cl" (1) suffix: Authentication realm is LOCAL (1) [suffix] = ok (1) eap: Peer sent EAP Response (code 2) ID 116 length 166 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x21dd954121a98c3d (1) eap: Finished EAP session with state 0x21dd954121a98c3d (1) eap: Previous EAP request found for state 0x21dd954121a98c3d, released from the list (1) eap: Peer sent packet with method EAP PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 156 bytes (1) eap_peap: Got complete TLS record (156 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: TLS_accept: before SSL initialization (1) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0097] (1) eap_peap: TLS_accept: SSLv3/TLS read client hello (1) eap_peap: >>> send TLS 1.2 [length 003d] (1) eap_peap: TLS_accept: SSLv3/TLS write server hello (1) eap_peap: >>> send TLS 1.2 [length 0d45] (1) eap_peap: TLS_accept: SSLv3/TLS write certificate (1) eap_peap: >>> send TLS 1.2 [length 024d] (1) eap_peap: TLS_accept: SSLv3/TLS write key exchange (1) eap_peap: >>> send TLS 1.2 [length 0004] (1) eap_peap: TLS_accept: SSLv3/TLS write server done (1) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 117 length 1004 (1) eap: EAP session adding &reply:State = 0x21dd954120a88c3d (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 12 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (1) EAP-Message = 0x017503ec19c000000fe7160303003d020000390303e6bb468a26622401d34769af834e6eb662e6224e5c0e8d88cacb79590bae22cd00c030000011ff01000100000b000403000102001700001603030d450b000d41000d3e000601308205fd308203e5a003020102020101300d06092a864886f70d0101 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x21dd954120a88c3dcbc41c49c2b781e8 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 13 from 192.168.128.34:39957 to 146.83.124.26:1812 length 409 (2) User-Name = "wifi(a)ucn.cl" (2) NAS-IP-Address = 192.168.128.34 (2) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) NAS-Port = 1 (2) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (2) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 59 / Channel: 1" (2) Acct-Session-Id = "B51015A162BFE948" (2) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027074 (2) WLAN-AKM-Suite = 1027073 (2) WLAN-Group-Mgmt-Cipher = 1027078 (2) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (2) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (2) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (2) Meraki-Device-Name = "AP-V1-Soporte" (2) Framed-MTU = 1400 (2) EAP-Message = 0x027500061900 (2) State = 0x21dd954120a88c3dcbc41c49c2b781e8 (2) Message-Authenticator = 0x34512dbcef44c467f7a9576c277cb9de (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (2) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (2) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (2) auth_log: EXPAND %t (2) auth_log: --> Fri Aug 28 18:49:24 2020 (2) [auth_log] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (2) suffix: Found realm "ucn.cl" (2) suffix: Adding Stripped-User-Name = "wifi" (2) suffix: Adding Realm = "ucn.cl" (2) suffix: Authentication realm is LOCAL (2) [suffix] = ok (2) eap: Peer sent EAP Response (code 2) ID 117 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x21dd954120a88c3d (2) eap: Finished EAP session with state 0x21dd954120a88c3d (2) eap: Previous EAP request found for state 0x21dd954120a88c3d, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer ACKed our handshake fragment (2) eap_peap: [eaptls verify] = request (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 118 length 1000 (2) eap: EAP session adding &reply:State = 0x21dd954123ab8c3d (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 13 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (2) EAP-Message = 0x017603e81940209dba66581b0203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010b050003820201005e (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x21dd954123ab8c3dcbc41c49c2b781e8 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 14 from 192.168.128.34:39957 to 146.83.124.26:1812 length 409 (3) User-Name = "wifi(a)ucn.cl" (3) NAS-IP-Address = 192.168.128.34 (3) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) NAS-Port = 1 (3) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (3) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 60 / Channel: 1" (3) Acct-Session-Id = "B51015A162BFE948" (3) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027074 (3) WLAN-AKM-Suite = 1027073 (3) WLAN-Group-Mgmt-Cipher = 1027078 (3) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (3) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (3) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (3) Meraki-Device-Name = "AP-V1-Soporte" (3) Framed-MTU = 1400 (3) EAP-Message = 0x027600061900 (3) State = 0x21dd954123ab8c3dcbc41c49c2b781e8 (3) Message-Authenticator = 0xdf7908d357b2fcfc9280a77d13deeb86 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (3) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (3) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (3) auth_log: EXPAND %t (3) auth_log: --> Fri Aug 28 18:49:24 2020 (3) [auth_log] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (3) suffix: Found realm "ucn.cl" (3) suffix: Adding Stripped-User-Name = "wifi" (3) suffix: Adding Realm = "ucn.cl" (3) suffix: Authentication realm is LOCAL (3) [suffix] = ok (3) eap: Peer sent EAP Response (code 2) ID 118 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x21dd954123ab8c3d (3) eap: Finished EAP session with state 0x21dd954123ab8c3d (3) eap: Previous EAP request found for state 0x21dd954123ab8c3d, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 119 length 1000 (3) eap: EAP session adding &reply:State = 0x21dd954122aa8c3d (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 14 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (3) EAP-Message = 0x017703e81940303140616c756d6e6f732e75636e2e636c3122302006035504030c19456e746964616420636572746966696361646f72612055434e30820222300d06092a864886f70d01010105000382020f003082020a0282020100bac4e13cd8c7fa57371bce6d41f22a26bcad2ffba6e97df5048e2d (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x21dd954122aa8c3dcbc41c49c2b781e8 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 15 from 192.168.128.34:39957 to 146.83.124.26:1812 length 409 (4) User-Name = "wifi(a)ucn.cl" (4) NAS-IP-Address = 192.168.128.34 (4) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) NAS-Port = 1 (4) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (4) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 57 / Channel: 1" (4) Acct-Session-Id = "B51015A162BFE948" (4) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027074 (4) WLAN-AKM-Suite = 1027073 (4) WLAN-Group-Mgmt-Cipher = 1027078 (4) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (4) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (4) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (4) Meraki-Device-Name = "AP-V1-Soporte" (4) Framed-MTU = 1400 (4) EAP-Message = 0x027700061900 (4) State = 0x21dd954122aa8c3dcbc41c49c2b781e8 (4) Message-Authenticator = 0x7747c72fb1b5d7e944b19d7fe7e11405 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (4) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (4) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (4) auth_log: EXPAND %t (4) auth_log: --> Fri Aug 28 18:49:25 2020 (4) [auth_log] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (4) suffix: Found realm "ucn.cl" (4) suffix: Adding Stripped-User-Name = "wifi" (4) suffix: Adding Realm = "ucn.cl" (4) suffix: Authentication realm is LOCAL (4) [suffix] = ok (4) eap: Peer sent EAP Response (code 2) ID 119 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x21dd954122aa8c3d (4) eap: Finished EAP session with state 0x21dd954122aa8c3d (4) eap: Previous EAP request found for state 0x21dd954122aa8c3d, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer ACKed our handshake fragment (4) eap_peap: [eaptls verify] = request (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 120 length 1000 (4) eap: EAP session adding &reply:State = 0x21dd954125a58c3d (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 15 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (4) EAP-Message = 0x017803e81940c77251950fa0fe126a12332e02a8771ae735a0577b0809945f2151bb00b8f395f3f54573f94c87a0ad1afb624ea621c50e5cd9581e9bd0b5cc20a6f0c9bdbbbe326850002220a5b201f4bee09362a04c3dea95c4263c7c8ae9852a2a4c882975dc2cf44699206592149806fb22a1c9d191 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x21dd954125a58c3dcbc41c49c2b781e8 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 16 from 192.168.128.34:39957 to 146.83.124.26:1812 length 409 (5) User-Name = "wifi(a)ucn.cl" (5) NAS-IP-Address = 192.168.128.34 (5) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) NAS-Port = 1 (5) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (5) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1" (5) Acct-Session-Id = "B51015A162BFE948" (5) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027074 (5) WLAN-AKM-Suite = 1027073 (5) WLAN-Group-Mgmt-Cipher = 1027078 (5) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (5) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (5) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (5) Meraki-Device-Name = "AP-V1-Soporte" (5) Framed-MTU = 1400 (5) EAP-Message = 0x027800061900 (5) State = 0x21dd954125a58c3dcbc41c49c2b781e8 (5) Message-Authenticator = 0x14679f103d269b881a86323b6d1e8549 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (5) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (5) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (5) auth_log: EXPAND %t (5) auth_log: --> Fri Aug 28 18:49:25 2020 (5) [auth_log] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (5) suffix: Found realm "ucn.cl" (5) suffix: Adding Stripped-User-Name = "wifi" (5) suffix: Adding Realm = "ucn.cl" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) eap: Peer sent EAP Response (code 2) ID 120 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x21dd954125a58c3d (5) eap: Finished EAP session with state 0x21dd954125a58c3d (5) eap: Previous EAP request found for state 0x21dd954125a58c3d, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer ACKed our handshake fragment (5) eap_peap: [eaptls verify] = request (5) eap_peap: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 121 length 101 (5) eap: EAP session adding &reply:State = 0x21dd954124a48c3d (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 16 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (5) EAP-Message = 0x017900651900b69a44dd3c02289e1d59e3c9942f182daeeaf01b0f7a2e2ad802551c3563754923a576bf26f9b0e0c6f3af501b6adccd04f8dd1d542c997d9ddce0870cb079731b1d26fde666eb374bdbbfb958b1467d9eb84423ac0816030300040e000000 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x21dd954124a48c3dcbc41c49c2b781e8 (5) Finished request Waking up in 4.8 seconds. (6) Received Access-Request Id 17 from 192.168.128.34:39957 to 146.83.124.26:1812 length 539 (6) User-Name = "wifi(a)ucn.cl" (6) NAS-IP-Address = 192.168.128.34 (6) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) NAS-Port = 1 (6) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (6) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 58 / Channel: 1" (6) Acct-Session-Id = "B51015A162BFE948" (6) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027074 (6) WLAN-AKM-Suite = 1027073 (6) WLAN-Group-Mgmt-Cipher = 1027078 (6) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (6) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (6) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (6) Meraki-Device-Name = "AP-V1-Soporte" (6) Framed-MTU = 1400 (6) EAP-Message = 0x0279008819800000007e16030300461000004241046788806fbe757cf78d6a08d389fa7e8e550a21e4f195bff23a790c07e11ad380d541a0611f622fa4eb278e6a47fc06503e47e7d0675dfc89ef1975734a5f8cb614030300010116030300280000000000000000b8bf847857e145f1074457e48f47b4 (6) State = 0x21dd954124a48c3dcbc41c49c2b781e8 (6) Message-Authenticator = 0x756e5b4622e8707f399a8f35de7abb61 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (6) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (6) auth_log: EXPAND %t (6) auth_log: --> Fri Aug 28 18:49:25 2020 (6) [auth_log] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (6) suffix: Found realm "ucn.cl" (6) suffix: Adding Stripped-User-Name = "wifi" (6) suffix: Adding Realm = "ucn.cl" (6) suffix: Authentication realm is LOCAL (6) [suffix] = ok (6) eap: Peer sent EAP Response (code 2) ID 121 length 136 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x21dd954124a48c3d (6) eap: Finished EAP session with state 0x21dd954124a48c3d (6) eap: Previous EAP request found for state 0x21dd954124a48c3d, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer indicated complete TLS record size will be 126 bytes (6) eap_peap: Got complete TLS record (126 bytes) (6) eap_peap: [eaptls verify] = length included (6) eap_peap: TLS_accept: SSLv3/TLS write server done (6) eap_peap: <<< recv TLS 1.2 [length 0046] (6) eap_peap: TLS_accept: SSLv3/TLS read client key exchange (6) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (6) eap_peap: <<< recv TLS 1.2 [length 0010] (6) eap_peap: TLS_accept: SSLv3/TLS read finished (6) eap_peap: >>> send TLS 1.2 [length 0001] (6) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (6) eap_peap: >>> send TLS 1.2 [length 0010] (6) eap_peap: TLS_accept: SSLv3/TLS write finished (6) eap_peap: (other): SSL negotiation finished successfully (6) eap_peap: SSL Connection Established (6) eap_peap: [eaptls process] = handled (6) eap: Sending EAP Request (code 1) ID 122 length 57 (6) eap: EAP session adding &reply:State = 0x21dd954127a78c3d (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 17 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (6) EAP-Message = 0x017a0039190014030300010116030300282fa7d91ce14448b5632cba41946bad19f391306bae4b4b64a1293149cc0357f01a76329107706008 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x21dd954127a78c3dcbc41c49c2b781e8 (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 18 from 192.168.128.34:39957 to 146.83.124.26:1812 length 409 (7) User-Name = "wifi(a)ucn.cl" (7) NAS-IP-Address = 192.168.128.34 (7) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) NAS-Port = 1 (7) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (7) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1" (7) Acct-Session-Id = "B51015A162BFE948" (7) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027074 (7) WLAN-AKM-Suite = 1027073 (7) WLAN-Group-Mgmt-Cipher = 1027078 (7) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (7) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (7) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (7) Meraki-Device-Name = "AP-V1-Soporte" (7) Framed-MTU = 1400 (7) EAP-Message = 0x027a00061900 (7) State = 0x21dd954127a78c3dcbc41c49c2b781e8 (7) Message-Authenticator = 0xa6eabb00fc3dbb9f8a77e3e189c08f82 (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (7) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (7) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (7) auth_log: EXPAND %t (7) auth_log: --> Fri Aug 28 18:49:27 2020 (7) [auth_log] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (7) suffix: Found realm "ucn.cl" (7) suffix: Adding Stripped-User-Name = "wifi" (7) suffix: Adding Realm = "ucn.cl" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) eap: Peer sent EAP Response (code 2) ID 122 length 6 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x21dd954127a78c3d (7) eap: Finished EAP session with state 0x21dd954127a78c3d (7) eap: Previous EAP request found for state 0x21dd954127a78c3d, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: Peer ACKed our handshake fragment. handshake is finished (7) eap_peap: [eaptls verify] = success (7) eap_peap: [eaptls process] = success (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state TUNNEL ESTABLISHED (7) eap: Sending EAP Request (code 1) ID 123 length 40 (7) eap: EAP session adding &reply:State = 0x21dd954126a68c3d (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) Sent Access-Challenge Id 18 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (7) EAP-Message = 0x017b00281900170303001d2fa7d91ce14448b6c26c44cc6ab809edad31b8e6e88a368d132b76190a (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x21dd954126a68c3dcbc41c49c2b781e8 (7) Finished request Waking up in 2.6 seconds. (8) Received Access-Request Id 19 from 192.168.128.34:39957 to 146.83.124.26:1812 length 450 (8) User-Name = "wifi(a)ucn.cl" (8) NAS-IP-Address = 192.168.128.34 (8) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) NAS-Port = 1 (8) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (8) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 59 / Channel: 1" (8) Acct-Session-Id = "B51015A162BFE948" (8) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027074 (8) WLAN-AKM-Suite = 1027073 (8) WLAN-Group-Mgmt-Cipher = 1027078 (8) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (8) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (8) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (8) Meraki-Device-Name = "AP-V1-Soporte" (8) Framed-MTU = 1400 (8) EAP-Message = 0x027b002f19001703030024000000000000000160600c8649acac0a4995596f57083fda3fb934048eec7b2d68991701 (8) State = 0x21dd954126a68c3dcbc41c49c2b781e8 (8) Message-Authenticator = 0xb6ce80dae8ccb6105cd97cfbcd9fe078 (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (8) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (8) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (8) auth_log: EXPAND %t (8) auth_log: --> Fri Aug 28 18:49:27 2020 (8) [auth_log] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (8) suffix: Found realm "ucn.cl" (8) suffix: Adding Stripped-User-Name = "wifi" (8) suffix: Adding Realm = "ucn.cl" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) eap: Peer sent EAP Response (code 2) ID 123 length 47 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x21dd954126a68c3d (8) eap: Finished EAP session with state 0x21dd954126a68c3d (8) eap: Previous EAP request found for state 0x21dd954126a68c3d, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state WAITING FOR INNER IDENTITY (8) eap_peap: Identity - wifi(a)ucn.cl (8) eap_peap: Got inner identity 'wifi(a)ucn.cl' (8) eap_peap: Setting default EAP type for tunneled EAP session (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x027b001001776966694075636e2e636c (8) eap_peap: Setting User-Name to wifi(a)ucn.cl (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x027b001001776966694075636e2e636c (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "wifi(a)ucn.cl" (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x027b001001776966694075636e2e636c (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "wifi(a)ucn.cl" (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server inner-tunnel { (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (8) suffix: Found realm "ucn.cl" (8) suffix: Adding Stripped-User-Name = "wifi" (8) suffix: Adding Realm = "ucn.cl" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 123 length 16 (8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Peer sent packet with method EAP Identity (1) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: Issuing Challenge (8) eap: Sending EAP Request (code 1) ID 124 length 43 (8) eap: EAP session adding &reply:State = 0xc56f897cc5139321 (8) [eap] = handled (8) } # authenticate = handled (8) } # server inner-tunnel (8) Virtual server sending reply (8) EAP-Message = 0x017c002b1a017c002610ef5df80f43a08b0517f2eebd51c95820667265657261646975732d332e302e3136 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xc56f897cc5139321a7b06bef2a6a6d11 (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: EAP-Message = 0x017c002b1a017c002610ef5df80f43a08b0517f2eebd51c95820667265657261646975732d332e302e3136 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0xc56f897cc5139321a7b06bef2a6a6d11 (8) eap_peap: Got tunneled reply RADIUS code 11 (8) eap_peap: EAP-Message = 0x017c002b1a017c002610ef5df80f43a08b0517f2eebd51c95820667265657261646975732d332e302e3136 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0xc56f897cc5139321a7b06bef2a6a6d11 (8) eap_peap: Got tunneled Access-Challenge (8) eap: Sending EAP Request (code 1) ID 124 length 74 (8) eap: EAP session adding &reply:State = 0x21dd954129a18c3d (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Challenge { ... } # empty sub-section is ignored (8) Sent Access-Challenge Id 19 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (8) EAP-Message = 0x017c004a1900170303003f2fa7d91ce14448b7e5c0c32388ddc8194a591f34dc604c741d5fdbf79a47dce0e95eacb441f26d50b86e8204cf425c95a8be1d58c1239799c5c6e254b47166 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x21dd954129a18c3dcbc41c49c2b781e8 (8) Finished request Waking up in 2.6 seconds. (9) Received Access-Request Id 20 from 192.168.128.34:39957 to 146.83.124.26:1812 length 504 (9) User-Name = "wifi(a)ucn.cl" (9) NAS-IP-Address = 192.168.128.34 (9) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (9) NAS-Port-Type = Wireless-802.11 (9) Service-Type = Framed-User (9) NAS-Port = 1 (9) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (9) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 59 / Channel: 1" (9) Acct-Session-Id = "B51015A162BFE948" (9) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (9) WLAN-Pairwise-Cipher = 1027076 (9) WLAN-Group-Cipher = 1027074 (9) WLAN-AKM-Suite = 1027073 (9) WLAN-Group-Mgmt-Cipher = 1027078 (9) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (9) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (9) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (9) Meraki-Device-Name = "AP-V1-Soporte" (9) Framed-MTU = 1400 (9) EAP-Message = 0x027c00651900170303005a00000000000000024a9bc269a4199bdc550260ada1d90a510ef9fbf7753f11ec5fe5be876f6eeb2e234a0365719abde087d2a48deb5cf395ca9706c7efe83b694fcfaa80a0a1d145c0357c0bf7ff504d9b9ac35051cf54949111 (9) State = 0x21dd954129a18c3dcbc41c49c2b781e8 (9) Message-Authenticator = 0xc9f8565bd068d6ad35c63cd3ec5e16d2 (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (9) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (9) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (9) auth_log: EXPAND %t (9) auth_log: --> Fri Aug 28 18:49:27 2020 (9) [auth_log] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (9) suffix: Found realm "ucn.cl" (9) suffix: Adding Stripped-User-Name = "wifi" (9) suffix: Adding Realm = "ucn.cl" (9) suffix: Authentication realm is LOCAL (9) [suffix] = ok (9) eap: Peer sent EAP Response (code 2) ID 124 length 101 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0xc56f897cc5139321 (9) eap: Finished EAP session with state 0x21dd954129a18c3d (9) eap: Previous EAP request found for state 0x21dd954129a18c3d, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x027c00461a027c00413112edf048489e741053571c93c8bcbb060000000000000000ef518244cd55d743a477d7e0528409c7d7373fb0f1a54f1200776966694075636e2e636c (9) eap_peap: Setting User-Name to wifi(a)ucn.cl (9) eap_peap: Sending tunneled request to inner-tunnel (9) eap_peap: EAP-Message = 0x027c00461a027c00413112edf048489e741053571c93c8bcbb060000000000000000ef518244cd55d743a477d7e0528409c7d7373fb0f1a54f1200776966694075636e2e636c (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "wifi(a)ucn.cl" (9) eap_peap: State = 0xc56f897cc5139321a7b06bef2a6a6d11 (9) Virtual server inner-tunnel received request (9) EAP-Message = 0x027c00461a027c00413112edf048489e741053571c93c8bcbb060000000000000000ef518244cd55d743a477d7e0528409c7d7373fb0f1a54f1200776966694075636e2e636c (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "wifi(a)ucn.cl" (9) State = 0xc56f897cc5139321a7b06bef2a6a6d11 (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (9) suffix: Found realm "ucn.cl" (9) suffix: Adding Stripped-User-Name = "wifi" (9) suffix: Adding Realm = "ucn.cl" (9) suffix: Authentication realm is LOCAL (9) [suffix] = ok (9) update control { (9) &Proxy-To-Realm := LOCAL (9) } # update control = noop (9) eap: Peer sent EAP Response (code 2) ID 124 length 70 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) if (Realm == 'ucn.cl') { (9) if (Realm == 'ucn.cl') -> TRUE (9) if (Realm == 'ucn.cl') { (9) first_files: EXPAND %{Virtual-Server} (9) first_files: --> inner-tunnel (9) first_files: users: Matched entry DEFAULT at line 93 (9) [first_files] = ok (9) } # if (Realm == 'ucn.cl') = ok (9) if (Realm == 'alumnos.ucn.cl') { (9) if (Realm == 'alumnos.ucn.cl') -> FALSE (9) files: EXPAND %{Virtual-Server} (9) files: --> inner-tunnel (9) files: users: Matched entry DEFAULT at line 95 (9) [files] = ok (9) first_files: EXPAND %{Virtual-Server} (9) first_files: --> inner-tunnel (9) first_files: users: Matched entry DEFAULT at line 93 (9) [first_files] = ok (9) second_files: EXPAND %{Virtual-Server} (9) second_files: --> inner-tunnel (9) second_files: users: Matched entry DEFAULT at line 93 (9) [second_files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = pam (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) authenticate { (9) pam: Attribute "User-Password" is required for authentication (9) [pam] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) Post-Auth-Type REJECT { (9) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (9) reply_log: --> /var/log/freeradius/radacct/ 192.168.128.34/reply-detail-20200828 (9) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/reply-detail-20200828 (9) reply_log: WARNING: Skipping empty packet (9) [reply_log] = ok (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> wifi(a)ucn.cl (9) attr_filter.access_reject: Matched entry DEFAULT at line 11 (9) [attr_filter.access_reject] = updated (9) update outer.session-state { (9) No attributes updated (9) } # update outer.session-state = noop (9) } # Post-Auth-Type REJECT = updated (9) } # server inner-tunnel (9) Virtual server sending reply (9) eap_peap: Got tunneled reply code 3 (9) eap_peap: Got tunneled reply RADIUS code 3 (9) eap_peap: Tunneled authentication was rejected (9) eap_peap: FAILURE (9) eap: Sending EAP Request (code 1) ID 125 length 46 (9) eap: EAP session adding &reply:State = 0x21dd954128a08c3d (9) [eap] = handled (9) } # authenticate = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) Challenge { ... } # empty sub-section is ignored (9) Sent Access-Challenge Id 20 from 146.83.124.26:1812 to 192.168.128.34:39957 length 0 (9) EAP-Message = 0x017d002e190017030300232fa7d91ce14448b8ddd68976e03c329bec9e1fd5f358bc7cec4fd90c62fe6eab52678f (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x21dd954128a08c3dcbc41c49c2b781e8 (9) Finished request Waking up in 2.6 seconds. (10) Received Access-Request Id 21 from 192.168.128.34:39957 to 146.83.124.26:1812 length 449 (10) User-Name = "wifi(a)ucn.cl" (10) NAS-IP-Address = 192.168.128.34 (10) Called-Station-Id = "36-18-0A-7B-A4-6E:Red Radius" (10) NAS-Port-Type = Wireless-802.11 (10) Service-Type = Framed-User (10) NAS-Port = 1 (10) Calling-Station-Id = "E4-6F-13-2C-A4-C3" (10) Connect-Info = "CONNECT 54.00 Mbps / 802.11n / RSSI: 56 / Channel: 1" (10) Acct-Session-Id = "B51015A162BFE948" (10) Acct-Multi-Session-Id = "8F5640A8CB689CCA" (10) WLAN-Pairwise-Cipher = 1027076 (10) WLAN-Group-Cipher = 1027074 (10) WLAN-AKM-Suite = 1027073 (10) WLAN-Group-Mgmt-Cipher = 1027078 (10) Attr-26.29671.2 = 0x55434e20416e746f66616761737461202d2053574150202d20776972656c657373 (10) Attr-26.29671.3 = 0x41502d56312d536f706f727465 (10) Attr-26.29671.4 = 0x20414c554d4e4f5320454455524f414d2046554e43494f4e4152494f5320524144495553205445434e49434f53205649 (10) Meraki-Device-Name = "AP-V1-Soporte" (10) Framed-MTU = 1400 (10) EAP-Message = 0x027d002e19001703030023000000000000000376d2d8397dd47c5aa4c12397dc5d81bd6492de176eb0693ea9966a (10) State = 0x21dd954128a08c3dcbc41c49c2b781e8 (10) Message-Authenticator = 0x1cc95b6ddafcd8b2fa3b088b64b138db (10) session-state: No cached attributes (10) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (10) auth_log: --> /var/log/freeradius/radacct/ 192.168.128.34/auth-detail-20200828 (10) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/auth-detail-20200828 (10) auth_log: EXPAND %t (10) auth_log: --> Fri Aug 28 18:49:27 2020 (10) [auth_log] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: Looking up realm "ucn.cl" for User-Name = "wifi(a)ucn.cl" (10) suffix: Found realm "ucn.cl" (10) suffix: Adding Stripped-User-Name = "wifi" (10) suffix: Adding Realm = "ucn.cl" (10) suffix: Authentication realm is LOCAL (10) [suffix] = ok (10) eap: Peer sent EAP Response (code 2) ID 125 length 46 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0xc56f897cc5139321 (10) eap: Finished EAP session with state 0x21dd954128a08c3d (10) eap: Previous EAP request found for state 0x21dd954128a08c3d, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: Continuing EAP-TLS (10) eap_peap: [eaptls verify] = ok (10) eap_peap: Done initial handshake (10) eap_peap: [eaptls process] = ok (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv failure (10) eap_peap: Received EAP-TLV response (10) eap_peap: ERROR: The users session was previously rejected: returning reject (again.) (10) eap_peap: This means you need to read the PREVIOUS messages in the debug output (10) eap_peap: to find out the reason why the user was rejected (10) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (10) eap_peap: what went wrong, and how to fix the problem (10) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (10) eap: Sending EAP Failure (code 4) ID 125 length 4 (10) eap: Failed in EAP select (10) [eap] = invalid (10) } # authenticate = invalid (10) Failed to authenticate the user (10) Using Post-Auth-Type Reject (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (10) Post-Auth-Type REJECT { (10) attr_filter.access_reject: EXPAND %{User-Name} (10) attr_filter.access_reject: --> wifi(a)ucn.cl (10) attr_filter.access_reject: Matched entry DEFAULT at line 11 (10) [attr_filter.access_reject] = updated (10) [eap] = noop (10) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (10) reply_log: --> /var/log/freeradius/radacct/ 192.168.128.34/reply-detail-20200828 (10) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.128.34/reply-detail-20200828 (10) reply_log: EXPAND %t (10) reply_log: --> Fri Aug 28 18:49:27 2020 (10) [reply_log] = ok (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) } # Post-Auth-Type REJECT = updated (10) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (10) Sending delayed response (10) Sent Access-Reject Id 21 from 146.83.124.26:1812 to 192.168.128.34:39957 length 44 (10) EAP-Message = 0x047d0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 Thanks in advance. Bárbara.

2 12

Accounting debugging error
by lingctam 22 Sep '20

22 Sep '20

Dear Colleagues, I have been unable to resolve the following error in debug mode: Invalid packet code 1 sent to a accounting port from client localhost port 21474 : IGNORED Ready to process requests The only answer I have found online suggests a port conflict but no other port other than 1813 would respond to accounting requests. Note: accounting point is set to 0 in sites-enabled/default Thank you for any help.

2 3

EAP-GTC Error - Samsung S20+ connecting to eduroam
by Shaun Hoofe 21 Sep '20

21 Sep '20

Hi, I’ve never needed to post here but this one has really stifled me. I have an end user with a Samsung S20+ and the September 2020 security patch attempting to connect to eduroam, everything looks fine client side (PEAP/MSCHAPv2) which has been verified by myself but Freeradius keeps throwing EAP-GTC errors. All other devices hitting Freeradius are connecting normally without issue. eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed I’ve no idea why its touching EAP-GTC at all… The client is set for MSCHAPv2 so I’m inclined to say that the client is bad and to wait for the next update but it’s difficult to articulate that to end users who have purchased the latest Samsung. Any ideas? Debug as per below. Cheers Shaun Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/server_log including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/extended_logging including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/linelog including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/cui including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/status including configuration file /usr/local/etc/raddb/sites-enabled/eduroam main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "yes" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server eduroam0 { ipaddr = roaming0.ja.net IPv4 address [194.82.174.185] port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam1 { ipaddr = roaming1.ja.net IPv4 address [194.83.56.233] port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server eduroam2 { ipaddr = roaming2.ja.net IPv4 address [194.83.56.249] port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server nps0 { ipaddr = 10.0.38.3 port = 1812 type = "auth" secret = <<< secret >>> response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm harper-adams.ac.uk { } realm live.harper.ac.uk { } realm hkvets.ac.uk { } realm students.hkvets.ac.uk { } home_server_pool eduroam { type = client-port-balance home_server = eduroam0 home_server = eduroam1 home_server = eduroam2 } realm eduroam { auth_pool = eduroam nostrip } home_server_pool nps { type = client-port-balance home_server = nps0 } realm nps { auth_pool = nps } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 10.0.71.71/24 { ipaddr = 10.0.71.71 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.30.120 { ipaddr = 192.168.30.120 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.30.121 { ipaddr = 192.168.30.121 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming0.ja.net { ipaddr = roaming0.ja.net IPv4 address [194.82.174.185] require_message_authenticator = no secret = <<< secret >>> shortname = "roaming0.ja.net" virtual_server = "eduroam" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming1.ja.net { ipaddr = roaming1.ja.net IPv4 address [194.83.56.233] require_message_authenticator = no secret = <<< secret >>> shortname = "roaming1.ja.net" virtual_server = "eduroam" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client roaming2.ja.net { ipaddr = roaming2.ja.net IPv4 address [194.83.56.249] require_message_authenticator = no secret = <<< secret >>> shortname = "roaming2.ja.net" virtual_server = "eduroam" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.10.1 { ipaddr = 192.168.10.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client nps { ipaddr = 10.0.38.3 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = digest # Creating Autz-Type = Status-Server radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_mschap # Instantiating module "keele" from file /usr/local/etc/raddb/radiusd.conf mschap keele { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=mercia.keele.ac.uk --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" passchange { } allow_retry = yes } rlm_mschap (keele): authenticating by calling 'ntlm_auth' # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_linelog # Instantiating module "default_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log linelog default_server_log { filename = "/usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "default_server_log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "eduroam_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log linelog eduroam_server_log { filename = "/usr/local/var/log/radius/radacct/eduroam_server_log/eduroam_server_log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "eduroam_server_log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "inner_tunnel_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log linelog inner_tunnel_server_log { filename = "/usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "accounting_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log linelog accounting_server_log { filename = "/usr/local/var/log/radius/radacct/accounting_server_log/accounting_log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "%S#%{User-Name}#%{Framed-IP-Address}#%{Calling-Station-Id}#" } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_detail # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Instantiating module "on-site-internal-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging linelog on-site-internal-accept-log { filename = "/usr/local/var/log/radius/radacct/on-site-internal-accept-log/on-site-internal-accept-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "on-site-internal-accept-log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "on-site-external-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging linelog on-site-external-accept-log { filename = "/usr/local/var/log/radius/radacct/on-site-external-accept-log/on-site-external-accept-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "on-site-external-accept-log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "on-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging linelog on-site-reject-log { filename = "/usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "on-site-reject-log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "off-site-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging linelog off-site-accept-log { filename = "/usr/local/var/log/radius/radacct/off-site-accept-log/off-site-accept-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "off-site-accept-log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "off-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging linelog off-site-reject-log { filename = "/usr/local/var/log/radius/radacct/off-site-reject-log/off-site-reject-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "off-site-reject-log.%{%{reply:Packet-Type}:-format}" } # Instantiating module "off-site-eduroam-support-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging linelog off-site-eduroam-support-reject-log { filename = "/usr/local/var/log/radius/radacct/off-site-eduroam-support-reject-log/off-site-eduroam-support-reject-log-%Y%m%d" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "off-site-eduroam-support-reject-log.%{%{reply:Packet-Type}:-format}" } # Loaded module rlm_always # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize [/usr/local/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry username(a)harper-adams.ac.uk ... [/usr/local/etc/raddb/mods-config/files/authorize]:184 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ... [/usr/local/etc/raddb/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-harper-adams.ac.uk} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" passchange { } allow_retry = yes } rlm_mschap (mschap): authenticating by calling 'ntlm_auth' # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_unpack # Instantiating module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/usr/local/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server status { # from file /usr/local/etc/raddb/sites-enabled/status # Loading authorize {...} } # server status server eduroam { # from file /usr/local/etc/raddb/sites-enabled/eduroam # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server eduroam /usr/local/etc/raddb/sites-enabled/default[705] Please change %{Realm}} to &Realm} radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "status" ipaddr = 127.0.0.1 port = 18121 client admin { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on status address 127.0.0.1 port 18121 bound to server status Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 54558 Ready to process requests (0) Received Access-Request Id 66 from 192.168.30.121:59063 to 192.168.10.211:1812 length 228 (0) User-Name = '00703070(a)harper-adams.ac.uk' (0) NAS-IP-Address = 192.168.30.121 (0) NAS-Port = 0 (0) NAS-Identifier = '192.168.30.121' (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = '96006F089222' (0) Called-Station-Id = '001A1E01CF58' (0) Service-Type = Framed-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x02010020013030373033303730406861727065722d6164616d732e61632e756b (0) Aruba-Essid-Name = 'eduroam' (0) Aruba-Location-Id = 'CETLfoyer_AP01' (0) Aruba-AP-Group = 'apg-comp' (0) Message-Authenticator = 0xeea556b9e161ae9c916574dcf448efa7 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy eduroam_filter { (0) if (User-Name !~ /@/) { (0) if (User-Name !~ /@/) -> FALSE (0) if ("%{User-Name}" =~ /@$/) { (0) EXPAND %{User-Name} (0) --> 00703070(a)harper-adams.ac.uk (0) if ("%{User-Name}" =~ /@$/) -> FALSE (0) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (0) EXPAND %{User-Name} (0) --> 00703070(a)harper-adams.ac.uk (0) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (0) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (0) EXPAND %{User-Name} (0) --> 00703070(a)harper-adams.ac.uk (0) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (0) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (0) EXPAND %{User-Name} (0) --> 00703070(a)harper-adams.ac.uk (0) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (0) } # policy eduroam_filter = notfound (0) [preprocess] = ok (0) policy operator-name.authorize { (0) if ("%{client:Operator-Name}") { (0) EXPAND %{client:Operator-Name} (0) --> 1harper-adams.ac.uk (0) if ("%{client:Operator-Name}") -> TRUE (0) if ("%{client:Operator-Name}") { (0) update request { (0) EXPAND %{client:Operator-Name} (0) --> 1harper-adams.ac.uk (0) &Operator-Name = 1harper-adams.ac.uk (0) } # update request = noop (0) } # if ("%{client:Operator-Name}") = noop (0) } # policy operator-name.authorize = noop (0) policy cui.authorize { (0) if ("%{client:add_cui}" == 'yes') { (0) EXPAND %{client:add_cui} (0) --> yes (0) if ("%{client:add_cui}" == 'yes') -> TRUE (0) if ("%{client:add_cui}" == 'yes') { (0) update request { (0) &Chargeable-User-Identity := 0x00 (0) } # update request = noop (0) } # if ("%{client:add_cui}" == 'yes') = noop (0) } # policy cui.authorize = noop (0) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (0) EXPAND %{User-Name} (0) --> 00703070(a)harper-adams.ac.uk (0) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (0) else { (0) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (0) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (0) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (0) auth_log: EXPAND %t (0) auth_log: --> Mon Sep 7 19:55:28 2020 (0) [auth_log] = ok (0) } # else = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (0) suffix: Found realm "harper-adams.ac.uk" (0) suffix: Adding Stripped-User-Name = "00703070" (0) suffix: Adding Realm = "harper-adams.ac.uk" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (0) EXPAND %{User-Name} (0) --> 00703070(a)harper-adams.ac.uk (0) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (0) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (0) [noop] = noop (0) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (0) ... skipping elsif for request 0: Preceding "if" was taken (0) ... skipping elsif for request 0: Preceding "if" was taken (0) ... skipping elsif for request 0: Preceding "if" was taken (0) ... skipping else for request 0: Preceding "if" was taken (0) eap: Peer sent code Response (2) ID 1 length 32 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) authenticate { (0) eap: Peer sent method Identity (1) (0) eap: Calling eap_peap to process EAP data (0) eap_peap: Flushing SSL sessions (of #0) (0) eap_peap: Initiate (0) eap_peap: Start returned 1 (0) eap: EAP session adding &reply:State = 0x5d232d885d2134dd (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Sent Access-Challenge Id 66 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (0) EAP-Message = 0x010200061920 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x5d232d885d2134dd60443f4cd8d35175 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 36 from 192.168.30.121:59063 to 192.168.10.211:1812 length 365 (1) User-Name = '00703070(a)harper-adams.ac.uk' (1) NAS-IP-Address = 192.168.30.121 (1) NAS-Port = 0 (1) NAS-Identifier = '192.168.30.121' (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = '96006F089222' (1) Called-Station-Id = '001A1E01CF58' (1) Service-Type = Framed-User (1) Framed-MTU = 1100 (1) EAP-Message = 0x0202009719800000008d16030100880100008403033d6bb98ca56f708bfefc5724df297400c611b45f02b6135a065b604a87f97e4d000028c02bc02fc02cc030cca9cca8c009c013c00ac014c007c011009c009d002f003c0035003d0005000a0100003300170000ff01000100000a00080006001d0017 (1) State = 0x5d232d885d2134dd60443f4cd8d35175 (1) Aruba-Essid-Name = 'eduroam' (1) Aruba-Location-Id = 'CETLfoyer_AP01' (1) Aruba-AP-Group = 'apg-comp' (1) Message-Authenticator = 0x221852c8ef612ff7a655f72f18256d56 (1) session-state: No cached attributes (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) policy eduroam_filter { (1) if (User-Name !~ /@/) { (1) if (User-Name !~ /@/) -> FALSE (1) if ("%{User-Name}" =~ /@$/) { (1) EXPAND %{User-Name} (1) --> 00703070(a)harper-adams.ac.uk (1) if ("%{User-Name}" =~ /@$/) -> FALSE (1) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (1) EXPAND %{User-Name} (1) --> 00703070(a)harper-adams.ac.uk (1) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (1) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (1) EXPAND %{User-Name} (1) --> 00703070(a)harper-adams.ac.uk (1) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (1) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (1) EXPAND %{User-Name} (1) --> 00703070(a)harper-adams.ac.uk (1) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (1) } # policy eduroam_filter = notfound (1) [preprocess] = ok (1) policy operator-name.authorize { (1) if ("%{client:Operator-Name}") { (1) EXPAND %{client:Operator-Name} (1) --> 1harper-adams.ac.uk (1) if ("%{client:Operator-Name}") -> TRUE (1) if ("%{client:Operator-Name}") { (1) update request { (1) EXPAND %{client:Operator-Name} (1) --> 1harper-adams.ac.uk (1) &Operator-Name = 1harper-adams.ac.uk (1) } # update request = noop (1) } # if ("%{client:Operator-Name}") = noop (1) } # policy operator-name.authorize = noop (1) policy cui.authorize { (1) if ("%{client:add_cui}" == 'yes') { (1) EXPAND %{client:add_cui} (1) --> yes (1) if ("%{client:add_cui}" == 'yes') -> TRUE (1) if ("%{client:add_cui}" == 'yes') { (1) update request { (1) &Chargeable-User-Identity := 0x00 (1) } # update request = noop (1) } # if ("%{client:add_cui}" == 'yes') = noop (1) } # policy cui.authorize = noop (1) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (1) EXPAND %{User-Name} (1) --> 00703070(a)harper-adams.ac.uk (1) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (1) else { (1) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (1) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (1) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (1) auth_log: EXPAND %t (1) auth_log: --> Mon Sep 7 19:55:28 2020 (1) [auth_log] = ok (1) } # else = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (1) suffix: Found realm "harper-adams.ac.uk" (1) suffix: Adding Stripped-User-Name = "00703070" (1) suffix: Adding Realm = "harper-adams.ac.uk" (1) suffix: Authentication realm is LOCAL (1) [suffix] = ok (1) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (1) EXPAND %{User-Name} (1) --> 00703070(a)harper-adams.ac.uk (1) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (1) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (1) [noop] = noop (1) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (1) ... skipping elsif for request 1: Preceding "if" was taken (1) ... skipping elsif for request 1: Preceding "if" was taken (1) ... skipping elsif for request 1: Preceding "if" was taken (1) ... skipping else for request 1: Preceding "if" was taken (1) eap: Peer sent code Response (2) ID 2 length 151 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x5d232d885d2134dd (1) eap: Finished EAP session with state 0x5d232d885d2134dd (1) eap: Previous EAP request found for state 0x5d232d885d2134dd, released from the list (1) eap: Peer sent method PEAP (25) (1) eap: EAP PEAP (25) (1) eap: Calling eap_peap to process EAP data (1) eap_peap: processing EAP-TLS (1) eap_peap: TLS Length 141 (1) eap_peap: Length Included (1) eap_peap: eaptls_verify returned 11 (1) eap_peap: (other): before/accept initialization (1) eap_peap: TLS_accept: before/accept initialization (1) eap_peap: <<< TLS 1.2 [length 0088] (1) eap_peap: TLS_accept: SSLv3 read client hello A (1) eap_peap: >>> TLS 1.2 [length 0059] (1) eap_peap: TLS_accept: SSLv3 write server hello A (1) eap_peap: >>> TLS 1.2 [length 098e] (1) eap_peap: TLS_accept: SSLv3 write certificate A (1) eap_peap: >>> TLS 1.2 [length 014d] (1) eap_peap: TLS_accept: SSLv3 write key exchange A (1) eap_peap: >>> TLS 1.2 [length 0004] (1) eap_peap: TLS_accept: SSLv3 write server done A (1) eap_peap: TLS_accept: SSLv3 flush data (1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A (1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) eap_peap: eaptls_process returned 13 (1) eap_peap: FR_TLS_HANDLED (1) eap: EAP session adding &reply:State = 0x5d232d885c2034dd (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Sent Access-Challenge Id 36 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (1) EAP-Message = 0x010303ec19c000000b4c16030300590200005503035f5682202fb7a02869ff5572887e4559c92fea1887530f7a4ce236db46270e3e205c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08cc02f00000dff01000100000b000403000102160303098e0b00098a000987000430 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x5d232d885c2034dd60443f4cd8d35175 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 101 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220 (2) User-Name = '00703070(a)harper-adams.ac.uk' (2) NAS-IP-Address = 192.168.30.121 (2) NAS-Port = 0 (2) NAS-Identifier = '192.168.30.121' (2) NAS-Port-Type = Wireless-802.11 (2) Calling-Station-Id = '96006F089222' (2) Called-Station-Id = '001A1E01CF58' (2) Service-Type = Framed-User (2) Framed-MTU = 1100 (2) EAP-Message = 0x020300061900 (2) State = 0x5d232d885c2034dd60443f4cd8d35175 (2) Aruba-Essid-Name = 'eduroam' (2) Aruba-Location-Id = 'CETLfoyer_AP01' (2) Aruba-AP-Group = 'apg-comp' (2) Message-Authenticator = 0x4a33f9c19d7d272caf3b88dd8235def4 (2) session-state: No cached attributes (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) authorize { (2) policy eduroam_filter { (2) if (User-Name !~ /@/) { (2) if (User-Name !~ /@/) -> FALSE (2) if ("%{User-Name}" =~ /@$/) { (2) EXPAND %{User-Name} (2) --> 00703070(a)harper-adams.ac.uk (2) if ("%{User-Name}" =~ /@$/) -> FALSE (2) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (2) EXPAND %{User-Name} (2) --> 00703070(a)harper-adams.ac.uk (2) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (2) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (2) EXPAND %{User-Name} (2) --> 00703070(a)harper-adams.ac.uk (2) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (2) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (2) EXPAND %{User-Name} (2) --> 00703070(a)harper-adams.ac.uk (2) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (2) } # policy eduroam_filter = notfound (2) [preprocess] = ok (2) policy operator-name.authorize { (2) if ("%{client:Operator-Name}") { (2) EXPAND %{client:Operator-Name} (2) --> 1harper-adams.ac.uk (2) if ("%{client:Operator-Name}") -> TRUE (2) if ("%{client:Operator-Name}") { (2) update request { (2) EXPAND %{client:Operator-Name} (2) --> 1harper-adams.ac.uk (2) &Operator-Name = 1harper-adams.ac.uk (2) } # update request = noop (2) } # if ("%{client:Operator-Name}") = noop (2) } # policy operator-name.authorize = noop (2) policy cui.authorize { (2) if ("%{client:add_cui}" == 'yes') { (2) EXPAND %{client:add_cui} (2) --> yes (2) if ("%{client:add_cui}" == 'yes') -> TRUE (2) if ("%{client:add_cui}" == 'yes') { (2) update request { (2) &Chargeable-User-Identity := 0x00 (2) } # update request = noop (2) } # if ("%{client:add_cui}" == 'yes') = noop (2) } # policy cui.authorize = noop (2) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (2) EXPAND %{User-Name} (2) --> 00703070(a)harper-adams.ac.uk (2) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (2) else { (2) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (2) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (2) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (2) auth_log: EXPAND %t (2) auth_log: --> Mon Sep 7 19:55:28 2020 (2) [auth_log] = ok (2) } # else = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (2) suffix: Found realm "harper-adams.ac.uk" (2) suffix: Adding Stripped-User-Name = "00703070" (2) suffix: Adding Realm = "harper-adams.ac.uk" (2) suffix: Authentication realm is LOCAL (2) [suffix] = ok (2) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (2) EXPAND %{User-Name} (2) --> 00703070(a)harper-adams.ac.uk (2) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (2) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (2) [noop] = noop (2) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (2) ... skipping elsif for request 2: Preceding "if" was taken (2) ... skipping elsif for request 2: Preceding "if" was taken (2) ... skipping elsif for request 2: Preceding "if" was taken (2) ... skipping else for request 2: Preceding "if" was taken (2) eap: Peer sent code Response (2) ID 3 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x5d232d885c2034dd (2) eap: Finished EAP session with state 0x5d232d885c2034dd (2) eap: Previous EAP request found for state 0x5d232d885c2034dd, released from the list (2) eap: Peer sent method PEAP (25) (2) eap: EAP PEAP (25) (2) eap: Calling eap_peap to process EAP data (2) eap_peap: processing EAP-TLS (2) eap_peap: Received TLS ACK (2) eap_peap: Received TLS ACK (2) eap_peap: ACK handshake fragment handler (2) eap_peap: eaptls_verify returned 1 (2) eap_peap: eaptls_process returned 13 (2) eap_peap: FR_TLS_HANDLED (2) eap: EAP session adding &reply:State = 0x5d232d885f2734dd (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) Sent Access-Challenge Id 101 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (2) EAP-Message = 0x010403e81940c62d385a960250f6b378ff612d4e0358d9e5148a4625e6eb2f327082ccac93595352448e797948d8e21b0e9ce3a327425387a40fd951a553641188a18a0043138afb9919c64efc9d62007450b116f5a314ea1febd84785af8dd231b48cbd10608dfaf8ba002ab346f2a6298790750a64a3 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x5d232d885f2734dd60443f4cd8d35175 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 246 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220 (3) User-Name = '00703070(a)harper-adams.ac.uk' (3) NAS-IP-Address = 192.168.30.121 (3) NAS-Port = 0 (3) NAS-Identifier = '192.168.30.121' (3) NAS-Port-Type = Wireless-802.11 (3) Calling-Station-Id = '96006F089222' (3) Called-Station-Id = '001A1E01CF58' (3) Service-Type = Framed-User (3) Framed-MTU = 1100 (3) EAP-Message = 0x020400061900 (3) State = 0x5d232d885f2734dd60443f4cd8d35175 (3) Aruba-Essid-Name = 'eduroam' (3) Aruba-Location-Id = 'CETLfoyer_AP01' (3) Aruba-AP-Group = 'apg-comp' (3) Message-Authenticator = 0xf2cc65af35bb01ad9e3dad5a7462c71d (3) session-state: No cached attributes (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (3) authorize { (3) policy eduroam_filter { (3) if (User-Name !~ /@/) { (3) if (User-Name !~ /@/) -> FALSE (3) if ("%{User-Name}" =~ /@$/) { (3) EXPAND %{User-Name} (3) --> 00703070(a)harper-adams.ac.uk (3) if ("%{User-Name}" =~ /@$/) -> FALSE (3) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (3) EXPAND %{User-Name} (3) --> 00703070(a)harper-adams.ac.uk (3) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (3) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (3) EXPAND %{User-Name} (3) --> 00703070(a)harper-adams.ac.uk (3) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (3) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (3) EXPAND %{User-Name} (3) --> 00703070(a)harper-adams.ac.uk (3) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (3) } # policy eduroam_filter = notfound (3) [preprocess] = ok (3) policy operator-name.authorize { (3) if ("%{client:Operator-Name}") { (3) EXPAND %{client:Operator-Name} (3) --> 1harper-adams.ac.uk (3) if ("%{client:Operator-Name}") -> TRUE (3) if ("%{client:Operator-Name}") { (3) update request { (3) EXPAND %{client:Operator-Name} (3) --> 1harper-adams.ac.uk (3) &Operator-Name = 1harper-adams.ac.uk (3) } # update request = noop (3) } # if ("%{client:Operator-Name}") = noop (3) } # policy operator-name.authorize = noop (3) policy cui.authorize { (3) if ("%{client:add_cui}" == 'yes') { (3) EXPAND %{client:add_cui} (3) --> yes (3) if ("%{client:add_cui}" == 'yes') -> TRUE (3) if ("%{client:add_cui}" == 'yes') { (3) update request { (3) &Chargeable-User-Identity := 0x00 (3) } # update request = noop (3) } # if ("%{client:add_cui}" == 'yes') = noop (3) } # policy cui.authorize = noop (3) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (3) EXPAND %{User-Name} (3) --> 00703070(a)harper-adams.ac.uk (3) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (3) else { (3) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (3) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (3) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (3) auth_log: EXPAND %t (3) auth_log: --> Mon Sep 7 19:55:28 2020 (3) [auth_log] = ok (3) } # else = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (3) suffix: Found realm "harper-adams.ac.uk" (3) suffix: Adding Stripped-User-Name = "00703070" (3) suffix: Adding Realm = "harper-adams.ac.uk" (3) suffix: Authentication realm is LOCAL (3) [suffix] = ok (3) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (3) EXPAND %{User-Name} (3) --> 00703070(a)harper-adams.ac.uk (3) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (3) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (3) [noop] = noop (3) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (3) ... skipping elsif for request 3: Preceding "if" was taken (3) ... skipping elsif for request 3: Preceding "if" was taken (3) ... skipping elsif for request 3: Preceding "if" was taken (3) ... skipping else for request 3: Preceding "if" was taken (3) eap: Peer sent code Response (2) ID 4 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x5d232d885f2734dd (3) eap: Finished EAP session with state 0x5d232d885f2734dd (3) eap: Previous EAP request found for state 0x5d232d885f2734dd, released from the list (3) eap: Peer sent method PEAP (25) (3) eap: EAP PEAP (25) (3) eap: Calling eap_peap to process EAP data (3) eap_peap: processing EAP-TLS (3) eap_peap: Received TLS ACK (3) eap_peap: Received TLS ACK (3) eap_peap: ACK handshake fragment handler (3) eap_peap: eaptls_verify returned 1 (3) eap_peap: eaptls_process returned 13 (3) eap_peap: FR_TLS_HANDLED (3) eap: EAP session adding &reply:State = 0x5d232d885e2634dd (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) Sent Access-Challenge Id 246 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (3) EAP-Message = 0x0105038e1900f6e330ad8b0cf435a181bda481ba3081b7310b3009060355040613024742311330110603550408130a5368726f7073686972653110300e060355040713074e6577706f72743120301e060355040a1317486172706572204164616d7320556e69766572736974793130302e06092a864886 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x5d232d885e2634dd60443f4cd8d35175 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 93 from 192.168.30.121:59063 to 192.168.10.211:1812 length 350 (4) User-Name = '00703070(a)harper-adams.ac.uk' (4) NAS-IP-Address = 192.168.30.121 (4) NAS-Port = 0 (4) NAS-Identifier = '192.168.30.121' (4) NAS-Port-Type = Wireless-802.11 (4) Calling-Station-Id = '96006F089222' (4) Called-Station-Id = '001A1E01CF58' (4) Service-Type = Framed-User (4) Framed-MTU = 1100 (4) EAP-Message = 0x0205008819800000007e1603030046100000424104ea56d436078e56e2ae2b44a72fce084ff89022001433c236008ea69f4edb350f1ca370aa1f2747dde6eca44f4c0da3dc9a19cacbdb7a2dd9dd517c8db718015114030300010116030300280000000000000000710ce2eedf52a18519e02d3291cf76 (4) State = 0x5d232d885e2634dd60443f4cd8d35175 (4) Aruba-Essid-Name = 'eduroam' (4) Aruba-Location-Id = 'CETLfoyer_AP01' (4) Aruba-AP-Group = 'apg-comp' (4) Message-Authenticator = 0x3910c0df262016725b161488467b1bde (4) session-state: No cached attributes (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) authorize { (4) policy eduroam_filter { (4) if (User-Name !~ /@/) { (4) if (User-Name !~ /@/) -> FALSE (4) if ("%{User-Name}" =~ /@$/) { (4) EXPAND %{User-Name} (4) --> 00703070(a)harper-adams.ac.uk (4) if ("%{User-Name}" =~ /@$/) -> FALSE (4) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (4) EXPAND %{User-Name} (4) --> 00703070(a)harper-adams.ac.uk (4) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (4) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (4) EXPAND %{User-Name} (4) --> 00703070(a)harper-adams.ac.uk (4) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (4) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (4) EXPAND %{User-Name} (4) --> 00703070(a)harper-adams.ac.uk (4) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (4) } # policy eduroam_filter = notfound (4) [preprocess] = ok (4) policy operator-name.authorize { (4) if ("%{client:Operator-Name}") { (4) EXPAND %{client:Operator-Name} (4) --> 1harper-adams.ac.uk (4) if ("%{client:Operator-Name}") -> TRUE (4) if ("%{client:Operator-Name}") { (4) update request { (4) EXPAND %{client:Operator-Name} (4) --> 1harper-adams.ac.uk (4) &Operator-Name = 1harper-adams.ac.uk (4) } # update request = noop (4) } # if ("%{client:Operator-Name}") = noop (4) } # policy operator-name.authorize = noop (4) policy cui.authorize { (4) if ("%{client:add_cui}" == 'yes') { (4) EXPAND %{client:add_cui} (4) --> yes (4) if ("%{client:add_cui}" == 'yes') -> TRUE (4) if ("%{client:add_cui}" == 'yes') { (4) update request { (4) &Chargeable-User-Identity := 0x00 (4) } # update request = noop (4) } # if ("%{client:add_cui}" == 'yes') = noop (4) } # policy cui.authorize = noop (4) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (4) EXPAND %{User-Name} (4) --> 00703070(a)harper-adams.ac.uk (4) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (4) else { (4) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (4) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (4) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (4) auth_log: EXPAND %t (4) auth_log: --> Mon Sep 7 19:55:28 2020 (4) [auth_log] = ok (4) } # else = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (4) suffix: Found realm "harper-adams.ac.uk" (4) suffix: Adding Stripped-User-Name = "00703070" (4) suffix: Adding Realm = "harper-adams.ac.uk" (4) suffix: Authentication realm is LOCAL (4) [suffix] = ok (4) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (4) EXPAND %{User-Name} (4) --> 00703070(a)harper-adams.ac.uk (4) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (4) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (4) [noop] = noop (4) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (4) ... skipping elsif for request 4: Preceding "if" was taken (4) ... skipping elsif for request 4: Preceding "if" was taken (4) ... skipping elsif for request 4: Preceding "if" was taken (4) ... skipping else for request 4: Preceding "if" was taken (4) eap: Peer sent code Response (2) ID 5 length 136 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x5d232d885e2634dd (4) eap: Finished EAP session with state 0x5d232d885e2634dd (4) eap: Previous EAP request found for state 0x5d232d885e2634dd, released from the list (4) eap: Peer sent method PEAP (25) (4) eap: EAP PEAP (25) (4) eap: Calling eap_peap to process EAP data (4) eap_peap: processing EAP-TLS (4) eap_peap: TLS Length 126 (4) eap_peap: Length Included (4) eap_peap: eaptls_verify returned 11 (4) eap_peap: <<< TLS 1.2 [length 0046] (4) eap_peap: TLS_accept: SSLv3 read client key exchange A (4) eap_peap: <<< TLS 1.2 [length 0001] (4) eap_peap: <<< TLS 1.2 [length 0010] (4) eap_peap: TLS_accept: SSLv3 read finished A (4) eap_peap: >>> TLS 1.2 [length 0001] (4) eap_peap: TLS_accept: SSLv3 write change cipher spec A (4) eap_peap: >>> TLS 1.2 [length 0010] (4) eap_peap: TLS_accept: SSLv3 write finished A (4) eap_peap: TLS_accept: SSLv3 flush data TLS: adding session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c to cache (4) eap_peap: (other): SSL negotiation finished successfully SSL Connection Established (4) eap_peap: eaptls_process returned 13 (4) eap_peap: FR_TLS_HANDLED (4) eap: EAP session adding &reply:State = 0x5d232d88592534dd (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) Sent Access-Challenge Id 93 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (4) EAP-Message = 0x0106003919001403030001011603030028dbf9a5fe6b58c9af4878bf5aad50c37591306f56a34e452abe46d4816656f7c59a7d672a722fba90 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x5d232d88592534dd60443f4cd8d35175 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 254 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220 (5) User-Name = '00703070(a)harper-adams.ac.uk' (5) NAS-IP-Address = 192.168.30.121 (5) NAS-Port = 0 (5) NAS-Identifier = '192.168.30.121' (5) NAS-Port-Type = Wireless-802.11 (5) Calling-Station-Id = '96006F089222' (5) Called-Station-Id = '001A1E01CF58' (5) Service-Type = Framed-User (5) Framed-MTU = 1100 (5) EAP-Message = 0x020600061900 (5) State = 0x5d232d88592534dd60443f4cd8d35175 (5) Aruba-Essid-Name = 'eduroam' (5) Aruba-Location-Id = 'CETLfoyer_AP01' (5) Aruba-AP-Group = 'apg-comp' (5) Message-Authenticator = 0xc6d5fb9e7db34af2acf0e6c12d84368a (5) session-state: No cached attributes (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) authorize { (5) policy eduroam_filter { (5) if (User-Name !~ /@/) { (5) if (User-Name !~ /@/) -> FALSE (5) if ("%{User-Name}" =~ /@$/) { (5) EXPAND %{User-Name} (5) --> 00703070(a)harper-adams.ac.uk (5) if ("%{User-Name}" =~ /@$/) -> FALSE (5) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (5) EXPAND %{User-Name} (5) --> 00703070(a)harper-adams.ac.uk (5) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (5) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (5) EXPAND %{User-Name} (5) --> 00703070(a)harper-adams.ac.uk (5) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (5) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (5) EXPAND %{User-Name} (5) --> 00703070(a)harper-adams.ac.uk (5) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (5) } # policy eduroam_filter = notfound (5) [preprocess] = ok (5) policy operator-name.authorize { (5) if ("%{client:Operator-Name}") { (5) EXPAND %{client:Operator-Name} (5) --> 1harper-adams.ac.uk (5) if ("%{client:Operator-Name}") -> TRUE (5) if ("%{client:Operator-Name}") { (5) update request { (5) EXPAND %{client:Operator-Name} (5) --> 1harper-adams.ac.uk (5) &Operator-Name = 1harper-adams.ac.uk (5) } # update request = noop (5) } # if ("%{client:Operator-Name}") = noop (5) } # policy operator-name.authorize = noop (5) policy cui.authorize { (5) if ("%{client:add_cui}" == 'yes') { (5) EXPAND %{client:add_cui} (5) --> yes (5) if ("%{client:add_cui}" == 'yes') -> TRUE (5) if ("%{client:add_cui}" == 'yes') { (5) update request { (5) &Chargeable-User-Identity := 0x00 (5) } # update request = noop (5) } # if ("%{client:add_cui}" == 'yes') = noop (5) } # policy cui.authorize = noop (5) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (5) EXPAND %{User-Name} (5) --> 00703070(a)harper-adams.ac.uk (5) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (5) else { (5) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (5) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (5) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (5) auth_log: EXPAND %t (5) auth_log: --> Mon Sep 7 19:55:28 2020 (5) [auth_log] = ok (5) } # else = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (5) suffix: Found realm "harper-adams.ac.uk" (5) suffix: Adding Stripped-User-Name = "00703070" (5) suffix: Adding Realm = "harper-adams.ac.uk" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (5) EXPAND %{User-Name} (5) --> 00703070(a)harper-adams.ac.uk (5) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (5) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (5) [noop] = noop (5) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (5) ... skipping elsif for request 5: Preceding "if" was taken (5) ... skipping elsif for request 5: Preceding "if" was taken (5) ... skipping elsif for request 5: Preceding "if" was taken (5) ... skipping else for request 5: Preceding "if" was taken (5) eap: Peer sent code Response (2) ID 6 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x5d232d88592534dd (5) eap: Finished EAP session with state 0x5d232d88592534dd (5) eap: Previous EAP request found for state 0x5d232d88592534dd, released from the list (5) eap: Peer sent method PEAP (25) (5) eap: EAP PEAP (25) (5) eap: Calling eap_peap to process EAP data (5) eap_peap: processing EAP-TLS (5) eap_peap: Received TLS ACK (5) eap_peap: Received TLS ACK (5) eap_peap: ACK handshake is finished (5) eap_peap: eaptls_verify returned 3 (5) eap_peap: eaptls_process returned 3 (5) eap_peap: FR_TLS_SUCCESS (5) eap_peap: Session established. Decoding tunneled attributes (5) eap_peap: PEAP state TUNNEL ESTABLISHED (5) eap: EAP session adding &reply:State = 0x5d232d88582434dd (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) Sent Access-Challenge Id 254 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (5) EAP-Message = 0x010700281900170303001ddbf9a5fe6b58c9b06dc36a69e0eb76f60129709c828fc278149f06d1b9 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x5d232d88582434dd60443f4cd8d35175 (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 236 from 192.168.30.121:59063 to 192.168.10.211:1812 length 277 (6) User-Name = '00703070(a)harper-adams.ac.uk' (6) NAS-IP-Address = 192.168.30.121 (6) NAS-Port = 0 (6) NAS-Identifier = '192.168.30.121' (6) NAS-Port-Type = Wireless-802.11 (6) Calling-Station-Id = '96006F089222' (6) Called-Station-Id = '001A1E01CF58' (6) Service-Type = Framed-User (6) Framed-MTU = 1100 (6) EAP-Message = 0x0207003f190017030300340000000000000001f7d1c2bc51c0f6614a1bc2831a5e10b3a0532248f7cde8cd0675872eafaf1768f108ad5c3b6a73038f8c63bf (6) State = 0x5d232d88582434dd60443f4cd8d35175 (6) Aruba-Essid-Name = 'eduroam' (6) Aruba-Location-Id = 'CETLfoyer_AP01' (6) Aruba-AP-Group = 'apg-comp' (6) Message-Authenticator = 0x8a17b53039a0230e8b09c960ea038aea (6) session-state: No cached attributes (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) authorize { (6) policy eduroam_filter { (6) if (User-Name !~ /@/) { (6) if (User-Name !~ /@/) -> FALSE (6) if ("%{User-Name}" =~ /@$/) { (6) EXPAND %{User-Name} (6) --> 00703070(a)harper-adams.ac.uk (6) if ("%{User-Name}" =~ /@$/) -> FALSE (6) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (6) EXPAND %{User-Name} (6) --> 00703070(a)harper-adams.ac.uk (6) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (6) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (6) EXPAND %{User-Name} (6) --> 00703070(a)harper-adams.ac.uk (6) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (6) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (6) EXPAND %{User-Name} (6) --> 00703070(a)harper-adams.ac.uk (6) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (6) } # policy eduroam_filter = notfound (6) [preprocess] = ok (6) policy operator-name.authorize { (6) if ("%{client:Operator-Name}") { (6) EXPAND %{client:Operator-Name} (6) --> 1harper-adams.ac.uk (6) if ("%{client:Operator-Name}") -> TRUE (6) if ("%{client:Operator-Name}") { (6) update request { (6) EXPAND %{client:Operator-Name} (6) --> 1harper-adams.ac.uk (6) &Operator-Name = 1harper-adams.ac.uk (6) } # update request = noop (6) } # if ("%{client:Operator-Name}") = noop (6) } # policy operator-name.authorize = noop (6) policy cui.authorize { (6) if ("%{client:add_cui}" == 'yes') { (6) EXPAND %{client:add_cui} (6) --> yes (6) if ("%{client:add_cui}" == 'yes') -> TRUE (6) if ("%{client:add_cui}" == 'yes') { (6) update request { (6) &Chargeable-User-Identity := 0x00 (6) } # update request = noop (6) } # if ("%{client:add_cui}" == 'yes') = noop (6) } # policy cui.authorize = noop (6) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (6) EXPAND %{User-Name} (6) --> 00703070(a)harper-adams.ac.uk (6) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (6) else { (6) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (6) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (6) auth_log: EXPAND %t (6) auth_log: --> Mon Sep 7 19:55:28 2020 (6) [auth_log] = ok (6) } # else = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (6) suffix: Found realm "harper-adams.ac.uk" (6) suffix: Adding Stripped-User-Name = "00703070" (6) suffix: Adding Realm = "harper-adams.ac.uk" (6) suffix: Authentication realm is LOCAL (6) [suffix] = ok (6) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (6) EXPAND %{User-Name} (6) --> 00703070(a)harper-adams.ac.uk (6) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (6) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (6) [noop] = noop (6) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (6) ... skipping elsif for request 6: Preceding "if" was taken (6) ... skipping elsif for request 6: Preceding "if" was taken (6) ... skipping elsif for request 6: Preceding "if" was taken (6) ... skipping else for request 6: Preceding "if" was taken (6) eap: Peer sent code Response (2) ID 7 length 63 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x5d232d88582434dd (6) eap: Finished EAP session with state 0x5d232d88582434dd (6) eap: Previous EAP request found for state 0x5d232d88582434dd, released from the list (6) eap: Peer sent method PEAP (25) (6) eap: EAP PEAP (25) (6) eap: Calling eap_peap to process EAP data (6) eap_peap: processing EAP-TLS (6) eap_peap: eaptls_verify returned 7 (6) eap_peap: Done initial handshake (6) eap_peap: eaptls_process returned 7 (6) eap_peap: FR_TLS_OK (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY (6) eap_peap: Identity - 00703070(a)harper-adams.ac.uk (6) eap_peap: Got inner identity '00703070(a)harper-adams.ac.uk' (6) eap_peap: Setting default EAP type for tunneled EAP session (6) eap_peap: Got tunneled request (6) eap_peap: EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b (6) eap_peap: Setting User-Name to 00703070(a)harper-adams.ac.uk (6) eap_peap: Sending tunneled request to inner-tunnel (6) eap_peap: EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b (6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_peap: User-Name = '00703070(a)harper-adams.ac.uk' (6) eap_peap: NAS-IP-Address = 192.168.30.121 (6) eap_peap: NAS-Port = 0 (6) eap_peap: NAS-Identifier = '192.168.30.121' (6) eap_peap: NAS-Port-Type = Wireless-802.11 (6) eap_peap: Calling-Station-Id = '96006F089222' (6) eap_peap: Called-Station-Id = '001A1E01CF58' (6) eap_peap: Service-Type = Framed-User (6) eap_peap: Framed-MTU = 1100 (6) eap_peap: Aruba-Essid-Name = 'eduroam' (6) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01' (6) eap_peap: Aruba-AP-Group = 'apg-comp' (6) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST' (6) eap_peap: Operator-Name = '1harper-adams.ac.uk' (6) eap_peap: Chargeable-User-Identity := 0x00 (6) Virtual server inner-tunnel received request (6) EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) User-Name = '00703070(a)harper-adams.ac.uk' (6) NAS-IP-Address = 192.168.30.121 (6) NAS-Port = 0 (6) NAS-Identifier = '192.168.30.121' (6) NAS-Port-Type = Wireless-802.11 (6) Calling-Station-Id = '96006F089222' (6) Called-Station-Id = '001A1E01CF58' (6) Service-Type = Framed-User (6) Framed-MTU = 1100 (6) Aruba-Essid-Name = 'eduroam' (6) Aruba-Location-Id = 'CETLfoyer_AP01' (6) Aruba-AP-Group = 'apg-comp' (6) Event-Timestamp = 'Sep 7 2020 19:55:28 BST' (6) Operator-Name = '1harper-adams.ac.uk' (6) Chargeable-User-Identity := 0x00 (6) server inner-tunnel { (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) [chap] = noop (6) [mschap] = noop (6) suffix: Checking for suffix after "@" (6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (6) suffix: Found realm "harper-adams.ac.uk" (6) suffix: Adding Stripped-User-Name = "00703070" (6) suffix: Adding Realm = "harper-adams.ac.uk" (6) suffix: Authentication realm is LOCAL (6) [suffix] = ok (6) update control { (6) &Proxy-To-Realm := LOCAL (6) } # update control = noop (6) eap: Peer sent code Response (2) ID 7 length 32 (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (6) authenticate { (6) eap: Peer sent method Identity (1) (6) eap: Calling eap_mschapv2 to process EAP data (6) eap_mschapv2: Issuing Challenge (6) eap: EAP session adding &reply:State = 0xcef5e17acefdfb91 (6) [eap] = handled (6) } # authenticate = handled (6) } # server inner-tunnel (6) Virtual server sending reply (6) EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xcef5e17acefdfb9195ed82a9e621722d (6) eap_peap: Got tunneled reply code 11 (6) eap_peap: EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d (6) eap_peap: Got tunneled reply RADIUS code 11 (6) eap_peap: EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38 (6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d (6) eap_peap: Got tunneled Access-Challenge (6) eap: EAP session adding &reply:State = 0x5d232d885b2b34dd (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) Sent Access-Challenge Id 236 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (6) EAP-Message = 0x010800491900170303003edbf9a5fe6b58c9b1f544c668c8ce20a13bbdddec520dff4b916704c39eb5cd65054c4d14c94d5a4c2febf9467b7a0fb1cb9210743e34f5fc43aa84eb3dbd (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x5d232d885b2b34dd60443f4cd8d35175 (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 109 from 192.168.30.121:59063 to 192.168.10.211:1812 length 251 (7) User-Name = '00703070(a)harper-adams.ac.uk' (7) NAS-IP-Address = 192.168.30.121 (7) NAS-Port = 0 (7) NAS-Identifier = '192.168.30.121' (7) NAS-Port-Type = Wireless-802.11 (7) Calling-Station-Id = '96006F089222' (7) Called-Station-Id = '001A1E01CF58' (7) Service-Type = Framed-User (7) Framed-MTU = 1100 (7) EAP-Message = 0x020800251900170303001a00000000000000025abd5dd6bbbaa0d2d85ec8fd3fc775e655b6 (7) State = 0x5d232d885b2b34dd60443f4cd8d35175 (7) Aruba-Essid-Name = 'eduroam' (7) Aruba-Location-Id = 'CETLfoyer_AP01' (7) Aruba-AP-Group = 'apg-comp' (7) Message-Authenticator = 0xaf7a8dee6f40dcbd4932d108769f58b3 (7) session-state: No cached attributes (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (7) authorize { (7) policy eduroam_filter { (7) if (User-Name !~ /@/) { (7) if (User-Name !~ /@/) -> FALSE (7) if ("%{User-Name}" =~ /@$/) { (7) EXPAND %{User-Name} (7) --> 00703070(a)harper-adams.ac.uk (7) if ("%{User-Name}" =~ /@$/) -> FALSE (7) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (7) EXPAND %{User-Name} (7) --> 00703070(a)harper-adams.ac.uk (7) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (7) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (7) EXPAND %{User-Name} (7) --> 00703070(a)harper-adams.ac.uk (7) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (7) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (7) EXPAND %{User-Name} (7) --> 00703070(a)harper-adams.ac.uk (7) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (7) } # policy eduroam_filter = notfound (7) [preprocess] = ok (7) policy operator-name.authorize { (7) if ("%{client:Operator-Name}") { (7) EXPAND %{client:Operator-Name} (7) --> 1harper-adams.ac.uk (7) if ("%{client:Operator-Name}") -> TRUE (7) if ("%{client:Operator-Name}") { (7) update request { (7) EXPAND %{client:Operator-Name} (7) --> 1harper-adams.ac.uk (7) &Operator-Name = 1harper-adams.ac.uk (7) } # update request = noop (7) } # if ("%{client:Operator-Name}") = noop (7) } # policy operator-name.authorize = noop (7) policy cui.authorize { (7) if ("%{client:add_cui}" == 'yes') { (7) EXPAND %{client:add_cui} (7) --> yes (7) if ("%{client:add_cui}" == 'yes') -> TRUE (7) if ("%{client:add_cui}" == 'yes') { (7) update request { (7) &Chargeable-User-Identity := 0x00 (7) } # update request = noop (7) } # if ("%{client:add_cui}" == 'yes') = noop (7) } # policy cui.authorize = noop (7) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (7) EXPAND %{User-Name} (7) --> 00703070(a)harper-adams.ac.uk (7) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (7) else { (7) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (7) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (7) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (7) auth_log: EXPAND %t (7) auth_log: --> Mon Sep 7 19:55:28 2020 (7) [auth_log] = ok (7) } # else = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (7) suffix: Found realm "harper-adams.ac.uk" (7) suffix: Adding Stripped-User-Name = "00703070" (7) suffix: Adding Realm = "harper-adams.ac.uk" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (7) EXPAND %{User-Name} (7) --> 00703070(a)harper-adams.ac.uk (7) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (7) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (7) [noop] = noop (7) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (7) ... skipping elsif for request 7: Preceding "if" was taken (7) ... skipping elsif for request 7: Preceding "if" was taken (7) ... skipping elsif for request 7: Preceding "if" was taken (7) ... skipping else for request 7: Preceding "if" was taken (7) eap: Peer sent code Response (2) ID 8 length 37 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0xcef5e17acefdfb91 (7) eap: Finished EAP session with state 0x5d232d885b2b34dd (7) eap: Previous EAP request found for state 0x5d232d885b2b34dd, released from the list (7) eap: Peer sent method PEAP (25) (7) eap: EAP PEAP (25) (7) eap: Calling eap_peap to process EAP data (7) eap_peap: processing EAP-TLS (7) eap_peap: eaptls_verify returned 7 (7) eap_peap: Done initial handshake (7) eap_peap: eaptls_process returned 7 (7) eap_peap: FR_TLS_OK (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state phase2 (7) eap_peap: EAP type NAK (3) (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x020800060306 (7) eap_peap: Setting User-Name to 00703070(a)harper-adams.ac.uk (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x020800060306 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = '00703070(a)harper-adams.ac.uk' (7) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d (7) eap_peap: NAS-IP-Address = 192.168.30.121 (7) eap_peap: NAS-Port = 0 (7) eap_peap: NAS-Identifier = '192.168.30.121' (7) eap_peap: NAS-Port-Type = Wireless-802.11 (7) eap_peap: Calling-Station-Id = '96006F089222' (7) eap_peap: Called-Station-Id = '001A1E01CF58' (7) eap_peap: Service-Type = Framed-User (7) eap_peap: Framed-MTU = 1100 (7) eap_peap: Aruba-Essid-Name = 'eduroam' (7) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01' (7) eap_peap: Aruba-AP-Group = 'apg-comp' (7) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST' (7) eap_peap: Operator-Name = '1harper-adams.ac.uk' (7) eap_peap: Chargeable-User-Identity := 0x00 (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x020800060306 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = '00703070(a)harper-adams.ac.uk' (7) State = 0xcef5e17acefdfb9195ed82a9e621722d (7) NAS-IP-Address = 192.168.30.121 (7) NAS-Port = 0 (7) NAS-Identifier = '192.168.30.121' (7) NAS-Port-Type = Wireless-802.11 (7) Calling-Station-Id = '96006F089222' (7) Called-Station-Id = '001A1E01CF58' (7) Service-Type = Framed-User (7) Framed-MTU = 1100 (7) Aruba-Essid-Name = 'eduroam' (7) Aruba-Location-Id = 'CETLfoyer_AP01' (7) Aruba-AP-Group = 'apg-comp' (7) Event-Timestamp = 'Sep 7 2020 19:55:28 BST' (7) Operator-Name = '1harper-adams.ac.uk' (7) Chargeable-User-Identity := 0x00 (7) server inner-tunnel { (7) session-state: No cached attributes (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) [chap] = noop (7) [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (7) suffix: Found realm "harper-adams.ac.uk" (7) suffix: Adding Stripped-User-Name = "00703070" (7) suffix: Adding Realm = "harper-adams.ac.uk" (7) suffix: Authentication realm is LOCAL (7) [suffix] = ok (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent code Response (2) ID 8 length 6 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) [files] = noop (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Expiring EAP session with state 0xcef5e17acefdfb91 (7) eap: Finished EAP session with state 0xcef5e17acefdfb91 (7) eap: Previous EAP request found for state 0xcef5e17acefdfb91, released from the list (7) eap: Peer sent method NAK (3) (7) eap: Found mutually acceptable type GTC (6) (7) eap: Calling eap_gtc to process EAP data (7) eap_gtc: EXPAND Password: (7) eap_gtc: --> Password: (7) eap: EAP session adding &reply:State = 0xcef5e17acffce791 (7) [eap] = handled (7) } # authenticate = handled (7) } # server inner-tunnel (7) Virtual server sending reply (7) EAP-Message = 0x0109000f0650617373776f72643a20 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xcef5e17acffce79195ed82a9e621722d (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x0109000f0650617373776f72643a20 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x0109000f0650617373776f72643a20 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d (7) eap_peap: Got tunneled Access-Challenge (7) eap: EAP session adding &reply:State = 0x5d232d885a2a34dd (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) Post-Auth-Type sub-section not found. Ignoring. (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (7) Sent Access-Challenge Id 109 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (7) EAP-Message = 0x0109002e19001703030023dbf9a5fe6b58c9b2c86f77544490173e291a25dd612c301797c162a5c8fc06f66e5112 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x5d232d885a2a34dd60443f4cd8d35175 (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 95 from 192.168.30.121:59063 to 192.168.10.211:1812 length 265 (8) User-Name = '00703070(a)harper-adams.ac.uk' (8) NAS-IP-Address = 192.168.30.121 (8) NAS-Port = 0 (8) NAS-Identifier = '192.168.30.121' (8) NAS-Port-Type = Wireless-802.11 (8) Calling-Station-Id = '96006F089222' (8) Called-Station-Id = '001A1E01CF58' (8) Service-Type = Framed-User (8) Framed-MTU = 1100 (8) EAP-Message = 0x02090033190017030300280000000000000003e26173435d91e7f61b6321efcb63810a55eedad5f9ee2e3b1bd11f0c34e5d051 (8) State = 0x5d232d885a2a34dd60443f4cd8d35175 (8) Aruba-Essid-Name = 'eduroam' (8) Aruba-Location-Id = 'CETLfoyer_AP01' (8) Aruba-AP-Group = 'apg-comp' (8) Message-Authenticator = 0x6290f9ac9790288097d9abada7f4cf76 (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (8) authorize { (8) policy eduroam_filter { (8) if (User-Name !~ /@/) { (8) if (User-Name !~ /@/) -> FALSE (8) if ("%{User-Name}" =~ /@$/) { (8) EXPAND %{User-Name} (8) --> 00703070(a)harper-adams.ac.uk (8) if ("%{User-Name}" =~ /@$/) -> FALSE (8) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (8) EXPAND %{User-Name} (8) --> 00703070(a)harper-adams.ac.uk (8) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (8) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (8) EXPAND %{User-Name} (8) --> 00703070(a)harper-adams.ac.uk (8) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (8) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (8) EXPAND %{User-Name} (8) --> 00703070(a)harper-adams.ac.uk (8) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (8) } # policy eduroam_filter = notfound (8) [preprocess] = ok (8) policy operator-name.authorize { (8) if ("%{client:Operator-Name}") { (8) EXPAND %{client:Operator-Name} (8) --> 1harper-adams.ac.uk (8) if ("%{client:Operator-Name}") -> TRUE (8) if ("%{client:Operator-Name}") { (8) update request { (8) EXPAND %{client:Operator-Name} (8) --> 1harper-adams.ac.uk (8) &Operator-Name = 1harper-adams.ac.uk (8) } # update request = noop (8) } # if ("%{client:Operator-Name}") = noop (8) } # policy operator-name.authorize = noop (8) policy cui.authorize { (8) if ("%{client:add_cui}" == 'yes') { (8) EXPAND %{client:add_cui} (8) --> yes (8) if ("%{client:add_cui}" == 'yes') -> TRUE (8) if ("%{client:add_cui}" == 'yes') { (8) update request { (8) &Chargeable-User-Identity := 0x00 (8) } # update request = noop (8) } # if ("%{client:add_cui}" == 'yes') = noop (8) } # policy cui.authorize = noop (8) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (8) EXPAND %{User-Name} (8) --> 00703070(a)harper-adams.ac.uk (8) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (8) else { (8) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (8) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (8) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (8) auth_log: EXPAND %t (8) auth_log: --> Mon Sep 7 19:55:28 2020 (8) [auth_log] = ok (8) } # else = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (8) suffix: Found realm "harper-adams.ac.uk" (8) suffix: Adding Stripped-User-Name = "00703070" (8) suffix: Adding Realm = "harper-adams.ac.uk" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (8) EXPAND %{User-Name} (8) --> 00703070(a)harper-adams.ac.uk (8) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (8) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (8) [noop] = noop (8) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (8) ... skipping elsif for request 8: Preceding "if" was taken (8) ... skipping elsif for request 8: Preceding "if" was taken (8) ... skipping elsif for request 8: Preceding "if" was taken (8) ... skipping else for request 8: Preceding "if" was taken (8) eap: Peer sent code Response (2) ID 9 length 51 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0xcef5e17acffce791 (8) eap: Finished EAP session with state 0x5d232d885a2a34dd (8) eap: Previous EAP request found for state 0x5d232d885a2a34dd, released from the list (8) eap: Peer sent method PEAP (25) (8) eap: EAP PEAP (25) (8) eap: Calling eap_peap to process EAP data (8) eap_peap: processing EAP-TLS (8) eap_peap: eaptls_verify returned 7 (8) eap_peap: Done initial handshake (8) eap_peap: eaptls_process returned 7 (8) eap_peap: FR_TLS_OK (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP type GTC (6) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x020900140654726964656e743234313030303239 (8) eap_peap: Setting User-Name to 00703070(a)harper-adams.ac.uk (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x020900140654726964656e743234313030303239 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = '00703070(a)harper-adams.ac.uk' (8) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d (8) eap_peap: NAS-IP-Address = 192.168.30.121 (8) eap_peap: NAS-Port = 0 (8) eap_peap: NAS-Identifier = '192.168.30.121' (8) eap_peap: NAS-Port-Type = Wireless-802.11 (8) eap_peap: Calling-Station-Id = '96006F089222' (8) eap_peap: Called-Station-Id = '001A1E01CF58' (8) eap_peap: Service-Type = Framed-User (8) eap_peap: Framed-MTU = 1100 (8) eap_peap: Aruba-Essid-Name = 'eduroam' (8) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01' (8) eap_peap: Aruba-AP-Group = 'apg-comp' (8) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST' (8) eap_peap: Operator-Name = '1harper-adams.ac.uk' (8) eap_peap: Chargeable-User-Identity := 0x00 (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x020900140654726964656e743234313030303239 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = '00703070(a)harper-adams.ac.uk' (8) State = 0xcef5e17acffce79195ed82a9e621722d (8) NAS-IP-Address = 192.168.30.121 (8) NAS-Port = 0 (8) NAS-Identifier = '192.168.30.121' (8) NAS-Port-Type = Wireless-802.11 (8) Calling-Station-Id = '96006F089222' (8) Called-Station-Id = '001A1E01CF58' (8) Service-Type = Framed-User (8) Framed-MTU = 1100 (8) Aruba-Essid-Name = 'eduroam' (8) Aruba-Location-Id = 'CETLfoyer_AP01' (8) Aruba-AP-Group = 'apg-comp' (8) Event-Timestamp = 'Sep 7 2020 19:55:28 BST' (8) Operator-Name = '1harper-adams.ac.uk' (8) Chargeable-User-Identity := 0x00 (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) [chap] = noop (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (8) suffix: Found realm "harper-adams.ac.uk" (8) suffix: Adding Stripped-User-Name = "00703070" (8) suffix: Adding Realm = "harper-adams.ac.uk" (8) suffix: Authentication realm is LOCAL (8) [suffix] = ok (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent code Response (2) ID 9 length 20 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0xcef5e17acffce791 (8) eap: Finished EAP session with state 0xcef5e17acffce791 (8) eap: Previous EAP request found for state 0xcef5e17acffce791, released from the list (8) eap: Peer sent method GTC (6) (8) eap: EAP GTC (6) (8) eap: Calling eap_gtc to process EAP data (8) eap_gtc: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) eap_gtc: Auth-Type PAP { (8) pap: Login attempt with password (8) pap: No password configured for the user. Cannot do authentication (8) [pap] = fail (8) } # Auth-Type PAP = fail (8) eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed (8) eap: Failed in EAP select (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Using Post-Auth-Type Reject (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject: EXPAND %{User-Name} (8) attr_filter.access_reject: --> 00703070(a)harper-adams.ac.uk (8) attr_filter.access_reject: Matched entry DEFAULT at line 18 (8) [attr_filter.access_reject] = updated (8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log.%{%{reply:Packet-Type}:-format} (8) inner_tunnel_server_log: --> inner_tunnel_server_log.Access-Reject (8) inner_tunnel_server_log: EXPAND /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d (8) inner_tunnel_server_log: --> /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-20200907 (8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject (8) inner_tunnel_server_log: --> inner_tunnel_server_log#Mon Sep 7 19:55:28 2020#USERNAME=00703070@harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020900140654726964656e743234313030303239#RESULT=Access-Reject (8) [inner_tunnel_server_log] = ok (8) update outer.session-state { (8) &Module-Failure-Message := &Module-Failure-Message -> eap: Failed continuing EAP GTC (6) session. EAP sub-module failed (8) } # update outer.session-state = noop (8) } # Post-Auth-Type REJECT = updated (8) } # server inner-tunnel (8) Virtual server sending reply (8) EAP-Message = 0x04090004 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: Got tunneled reply code 3 (8) eap_peap: EAP-Message = 0x04090004 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: Got tunneled reply RADIUS code 3 (8) eap_peap: EAP-Message = 0x04090004 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: Tunneled authentication was rejected (8) eap_peap: FAILURE (8) eap: EAP session adding &reply:State = 0x5d232d88552934dd (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (8) session-state: Saving cached attributes (8) Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed' (8) Sent Access-Challenge Id 95 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0 (8) EAP-Message = 0x010a002e19001703030023dbf9a5fe6b58c9b35409b5950099335ab262a924b463f36eeabe34c5e86c199e0fb490 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x5d232d88552934dd60443f4cd8d35175 (8) Finished request Waking up in 4.9 seconds. (9) Received Access-Request Id 205 from 192.168.30.121:59063 to 192.168.10.211:1812 length 260 (9) User-Name = '00703070(a)harper-adams.ac.uk' (9) NAS-IP-Address = 192.168.30.121 (9) NAS-Port = 0 (9) NAS-Identifier = '192.168.30.121' (9) NAS-Port-Type = Wireless-802.11 (9) Calling-Station-Id = '96006F089222' (9) Called-Station-Id = '001A1E01CF58' (9) Service-Type = Framed-User (9) Framed-MTU = 1100 (9) EAP-Message = 0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490 (9) State = 0x5d232d88552934dd60443f4cd8d35175 (9) Aruba-Essid-Name = 'eduroam' (9) Aruba-Location-Id = 'CETLfoyer_AP01' (9) Aruba-AP-Group = 'apg-comp' (9) Message-Authenticator = 0x9fd80c90ae227ad00b39d0f216ca9efb (9) session-state: Found cached attributes (9) Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed' (9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (9) authorize { (9) policy eduroam_filter { (9) if (User-Name !~ /@/) { (9) if (User-Name !~ /@/) -> FALSE (9) if ("%{User-Name}" =~ /@$/) { (9) EXPAND %{User-Name} (9) --> 00703070(a)harper-adams.ac.uk (9) if ("%{User-Name}" =~ /@$/) -> FALSE (9) if ("%{User-Name}" =~ /(a)gmail\.com$/) { (9) EXPAND %{User-Name} (9) --> 00703070(a)harper-adams.ac.uk (9) if ("%{User-Name}" =~ /(a)gmail\.com$/) -> FALSE (9) if ("%{User-Name}" =~ /(a)yahoo\.com$/) { (9) EXPAND %{User-Name} (9) --> 00703070(a)harper-adams.ac.uk (9) if ("%{User-Name}" =~ /(a)yahoo\.com$/) -> FALSE (9) if ("%{User-Name}" =~ /(a)hotmail\.com$/) { (9) EXPAND %{User-Name} (9) --> 00703070(a)harper-adams.ac.uk (9) if ("%{User-Name}" =~ /(a)hotmail\.com$/) -> FALSE (9) } # policy eduroam_filter = notfound (9) [preprocess] = ok (9) policy operator-name.authorize { (9) if ("%{client:Operator-Name}") { (9) EXPAND %{client:Operator-Name} (9) --> 1harper-adams.ac.uk (9) if ("%{client:Operator-Name}") -> TRUE (9) if ("%{client:Operator-Name}") { (9) update request { (9) EXPAND %{client:Operator-Name} (9) --> 1harper-adams.ac.uk (9) &Operator-Name = 1harper-adams.ac.uk (9) } # update request = noop (9) } # if ("%{client:Operator-Name}") = noop (9) } # policy operator-name.authorize = noop (9) policy cui.authorize { (9) if ("%{client:add_cui}" == 'yes') { (9) EXPAND %{client:add_cui} (9) --> yes (9) if ("%{client:add_cui}" == 'yes') -> TRUE (9) if ("%{client:add_cui}" == 'yes') { (9) update request { (9) &Chargeable-User-Identity := 0x00 (9) } # update request = noop (9) } # if ("%{client:add_cui}" == 'yes') = noop (9) } # policy cui.authorize = noop (9) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) { (9) EXPAND %{User-Name} (9) --> 00703070(a)harper-adams.ac.uk (9) if ("%{User-Name}" =~ /EduroamSupport(a)harper-adams\.ac\.uk$/) -> FALSE (9) else { (9) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (9) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (9) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907 (9) auth_log: EXPAND %t (9) auth_log: --> Mon Sep 7 19:55:28 2020 (9) [auth_log] = ok (9) } # else = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070(a)harper-adams.ac.uk" (9) suffix: Found realm "harper-adams.ac.uk" (9) suffix: Adding Stripped-User-Name = "00703070" (9) suffix: Adding Realm = "harper-adams.ac.uk" (9) suffix: Authentication realm is LOCAL (9) [suffix] = ok (9) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (9) EXPAND %{User-Name} (9) --> 00703070(a)harper-adams.ac.uk (9) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) -> TRUE (9) if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) { (9) [noop] = noop (9) } # if ("%{User-Name}" =~ /(a)harper-adams\.ac\.uk$/) = noop (9) ... skipping elsif for request 9: Preceding "if" was taken (9) ... skipping elsif for request 9: Preceding "if" was taken (9) ... skipping elsif for request 9: Preceding "if" was taken (9) ... skipping else for request 9: Preceding "if" was taken (9) eap: Peer sent code Response (2) ID 10 length 46 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x5d232d88552934dd (9) eap: Finished EAP session with state 0x5d232d88552934dd (9) eap: Previous EAP request found for state 0x5d232d88552934dd, released from the list (9) eap: Peer sent method PEAP (25) (9) eap: EAP PEAP (25) (9) eap: Calling eap_peap to process EAP data (9) eap_peap: processing EAP-TLS (9) eap_peap: eaptls_verify returned 7 (9) eap_peap: Done initial handshake (9) eap_peap: eaptls_process returned 7 (9) eap_peap: FR_TLS_OK (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state send tlv failure (9) eap_peap: Received EAP-TLV response (9) eap_peap: The users session was previously rejected: returning reject (again.) (9) eap_peap: This means you need to read the PREVIOUS messages in the debug output (9) eap_peap: to find out the reason why the user was rejected (9) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you (9) eap_peap: what went wrong, and how to fix the problem SSL: Removing session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c from the cache (9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed (9) eap: Failed in EAP select (9) [eap] = invalid (9) } # authenticate = invalid (9) Failed to authenticate the user (9) Using Post-Auth-Type Reject (9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (9) Post-Auth-Type REJECT { (9) attr_filter.access_reject: EXPAND %{User-Name} (9) attr_filter.access_reject: --> 00703070(a)harper-adams.ac.uk (9) attr_filter.access_reject: Matched entry DEFAULT at line 18 (9) [attr_filter.access_reject] = updated (9) [eap] = noop (9) policy remove_reply_message_if_eap { (9) if (&reply:EAP-Message && &reply:Reply-Message) { (9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (9) else { (9) [noop] = noop (9) } # else = noop (9) } # policy remove_reply_message_if_eap = noop (9) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d (9) reply_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907 (9) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907 (9) reply_log: EXPAND %t (9) reply_log: --> Mon Sep 7 19:55:28 2020 (9) [reply_log] = ok (9) default_server_log: EXPAND default_server_log.%{%{reply:Packet-Type}:-format} (9) default_server_log: --> default_server_log.Access-Reject (9) default_server_log: EXPAND /usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d (9) default_server_log: --> /usr/local/var/log/radius/radacct/default_server_log/default_server_log-20200907 (9) default_server_log: EXPAND default_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject (9) default_server_log: --> default_server_log#Mon Sep 7 19:55:28 2020#USERNAME=00703070@harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490#RESULT=Access-Reject (9) [default_server_log] = ok (9) on-site-reject-log: EXPAND on-site-reject-log.%{%{reply:Packet-Type}:-format} (9) on-site-reject-log: --> on-site-reject-log.Access-Reject (9) on-site-reject-log: EXPAND /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d (9) on-site-reject-log: --> /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-20200907 (9) on-site-reject-log: EXPAND %S#USERNAME=%{%{request:User-Name}:-NO-USER-NAME}#MACADDR=%{%{Calling-Station-Id}:-NO-MAC-ADDR}##DEVICE=%{%{request:Aruba-Device-Type}:-NO-DEVICE-TYPE}#LOCATION=%{%{request:Aruba-Location-Id}:-NO-LOCATION-ID}#ERRORMSG=%{%{reply:Reply-Message}:-%{&session-state:Module-Failure-Message}} (9) on-site-reject-log: --> 2020-09-07 19:55:28#USERNAME=00703070@harper-adams.ac.uk#MACADDR=96006F089222##DEVICE=NO-DEVICE-TYPE#LOCATION=CETLfoyer_AP01#ERRORMSG=eap: Failed continuing EAP GTC (6) session. EAP sub-module failed (9) [on-site-reject-log] = ok (9) } # Post-Auth-Type REJECT = updated (9) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (9) <delay>: Sending delayed response (9) <delay>: Sent Access-Reject Id 205 from 192.168.10.211:1812 to 192.168.30.121:59063 length 44 (9) <delay>: EAP-Message = 0x040a0004 (9) <delay>: Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) <done>: Cleaning up request packet ID 66 with timestamp +5 (1) <done>: Cleaning up request packet ID 36 with timestamp +5 (2) <done>: Cleaning up request packet ID 101 with timestamp +5 (3) <done>: Cleaning up request packet ID 246 with timestamp +5 (4) <done>: Cleaning up request packet ID 93 with timestamp +5 (5) <done>: Cleaning up request packet ID 254 with timestamp +5 (6) <done>: Cleaning up request packet ID 236 with timestamp +5 (7) <done>: Cleaning up request packet ID 109 with timestamp +5 (8) <done>: Cleaning up request packet ID 95 with timestamp +5 (9) <delay>: Cleaning up request packet ID 205 with timestamp +5 Ready to process requests

3 3

auth-type-error
by MEjaz 20 Sep '20

20 Sep '20

Hello all, I am trying to configure FreeRadius 3.0X with remote MSSQL and unixODBC, all basic tests have been passed sucefully. However, when I run radtest, on my radiusd server, I get the following error - [root@radius-1 ~]# radtest testnesma(a)1024.corp.nesma.net.sa 112233 localhost 0 testing123 Sent Access-Request Id 108 from 0.0.0.0:45102 to 127.0.0.1:1812 length 102 User-Name = "testnesma(a)1024.corp.nesma.net.sa" User-Password = "112233" NAS-IP-Address = 212.71.40.32 NAS-Port = 0 Message-Authenticator = 0x00 Cleartext-Password = "112233" Received Access-Reject Id 108 from 127.0.0.1:1812 to 127.0.0.1:45102 length 20 (0) -: Expected Access-Accept got Access-Reject Debug output. (0) Received Access-Request Id 108 from 127.0.0.1:45102 to 127.0.0.1:1812 length 102 (0) User-Name = "testnesma(a)1024.corp.nesma.net.sa" (0) User-Password = "112233" (0) NAS-IP-Address = 212.71.40.32 (0) NAS-Port = 0 (0) Message-Authenticator = 0xcae0ae6cc9464e071bedb1119c825542 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "1024.corp.nesma.net.sa" for User-Name = "testnesma(a)1024.corp.nesma.net.sa" (0) suffix: No such realm "1024.corp.nesma.net.sa" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql: EXPAND %{User-Name} (0) sql: --> testnesma(a)1024.corp.nesma.net.sa (0) sql: SQL-User-Name set to 'testnesma(a)1024.corp.nesma.net.sa' rlm_sql (sql): Reserved connection (0) (0) sql: EXPAND SELECT select password, replyattr, checkattr FROM NB_Authentication_Nesma WHERE Username = '%{User-Name}' ORDER BY id (0) sql: --> SELECT select password, replyattr, checkattr FROM NB_Authentication_Nesma WHERE Username = 'testnesma(a)1024.corp.nesma.net.sa' ORDER BY id (0) sql: Executing select query: SELECT select password, replyattr, checkattr FROM NB_Authentication_Nesma WHERE Username = 'testnesma(a)1024.corp.nesma.net.sa' ORDER BY id The 'rlm_sql_null' driver CANNOT be used for SELECTS. Please update the 'sql' module configuration to use a real database. Set 'driver = ...' to the database you want to use. (0) sql: WARNING: Cannot do check groups when group_membership_query is not set rlm_sql (sql): Released connection (0) Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used (0) [sql] = notfound (0) [expiration] = noop (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (0) Failed to authenticate the user (0) Using Post-Auth-Type Reject (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) Post-Auth-Type REJECT { (0) sql: EXPAND .query (0) sql: --> .query (0) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (0) sql: EXPAND %{User-Name} (0) sql: --> testnesma(a)1024.corp.nesma.net.sa (0) sql: SQL-User-Name set to 'testnesma(a)1024.corp.nesma.net.sa' (0) sql: EXPAND insert into RADONLINE (USERNAME,NASIDENTIFIER,NASPORT,ACCTSESSIONID,TIME_STAMP,FRAMEDIPADDRESS,NAS PORTTYPE,SERVICETYPE,CALLERID) values ('%{User-Name}','%{NAS-IP-Address}',%{NAS-Port},'%{Acct-Session-Id}',Cast ('%G' as datetime),'%{Framed-IP-Address}','%{NAS-Port-Type}','%{Framed-Protocol}','%{ Calling-Station-Id}') (0) sql: --> insert into RADONLINE (USERNAME,NASIDENTIFIER,NASPORT,ACCTSESSIONID,TIME_STAMP,FRAMEDIPADDRESS,NAS PORTTYPE,SERVICETYPE,CALLERID) values ('testnesma(a)1024.corp.nesma.net.sa','212.71.40.32',0,'',Cast ('39' as datetime),'','','','') (0) sql: Executing query: insert into RADONLINE (USERNAME,NASIDENTIFIER,NASPORT,ACCTSESSIONID,TIME_STAMP,FRAMEDIPADDRESS,NAS PORTTYPE,SERVICETYPE,CALLERID) values ('testnesma(a)1024.corp.nesma.net.sa','212.71.40.32',0,'',Cast ('39' as datetime),'','','','') (0) sql: SQL query returned: success (0) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (0) [sql] = ok (0) attr_filter.access_reject: EXPAND %{User-Name} (0) attr_filter.access_reject: --> testnesma(a)1024.corp.nesma.net.sa (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 (0) [attr_filter.access_reject] = updated (0) [eap] = noop (0) policy remove_reply_message_if_eap { (0) if (&reply:EAP-Message && &reply:Reply-Message) { (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy remove_reply_message_if_eap = noop (0) } # Post-Auth-Type REJECT = updated (0) Delaying response for 1.000000 seconds

3 11

FreeRADIUS+EAP in Alpine based docker container
by victorsugo 20 Sep '20

20 Sep '20

I'd like to run FreeRADIUS in a docker container, but I can't start it with the default config. (I am not sure if this is the right place for my question or should I go to an alpine forum/list.) What I do: $ docker run -it alpine # apk add freeradius-eap make openssl # cd /etc/raddb/certs # ./bootstrap # radiusd -X What I wait: it starts radius server. What I get instead of it: an error message. # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap /etc/raddb/mods-enabled/eap[14]: Failed to find 'Auth-Type EAP' section. Cannot authenticate users. /etc/raddb/mods-enabled/eap[14]: Instantiation failed for module "eap" But... If I edit /etc/raddb/sites-enabled/default and change authenticate { ... -eap ... } to authenticate { ... eap ... } then it starts with no error. I've tried to compare the logs with "diff -y --suppress-common-lines wrong.log good.log" and in the left column I get only that error message. Have you got any idea, what happens, what is the problem with the conditional loading of eap module? Regards, Victor Sugo

2 1

Freeradius, Kerberos and Openldap GSSAPI-SASL service principal issue
by Dario García Díaz-Miguel 18 Sep '20

18 Sep '20

Hi there, I'm writing to this mailing list looking for some help in order to configure Freeradius on a Kerberos and OpenLDAP GSSAPI-SASL infrastructure. We have everything working flawlessly. Freeradius service and server is working fine with krb5 and ldap modules enabled. The problem is when we need to start the freeradius service. The service only starts if you manually issue a ticket for the service kerberos principal or the host principal. This is such a strange behavior I can't understand. Krb5 module: krb5 { keytab = /etc/radius.keytab service_principal = radius/ex.ample.com pool { start = ${thread[pool].start_servers} min = ${thread[pool].min_spare_servers} max = ${thread[pool].max_servers} spare = ${thread[pool].max_spare_servers} uses = 0 lifetime = 0 idle_timeout = 0 } } The keytab /etc/radius.keytab contains the keys for the service principal radius/ex.ample.com. The service should be able to access to the keytab to asks automatically for a ticket for radius/ex.ample.com. But it doesn't. Instead, the service fails until we issue for a new ticket: kinit -k -t /etc/radius.keytab radius/ex.ample.com The ownership of this keytab is radiusd:radiusd and it has reading permissions 440. But I've also tried with 777 with no luck The reason because it does not understand is that ldap has anon bind disallowed and the freeradius service tries an anonymous bind. I know that according to the rules I should have posted the full output debug log but I'm afraid that since it's a totally isolated environment, I can't extract the whole log. Error: rlm_ldap (ldap): Bind with (anonymous) to ldap://ex.ample.com:389 failed: Local error Error: rlm_ldap (ldap): Opening connection failed (0) Error: rlm_ldap (ldap): Error: /etc/raddb/mods-enabled/ldap [8]: Instantiation failed for module "ldap" This is how the ldap module SASL section looks: sasl { mech = 'GSSAPI' realm ='EX.AMPLE.COM' } The most weird behavior is that If we issue a host ticket (kinit -k) it starts and bind correctly using the host/ex.ample.com service principal. No matter that the service principal configured on krb5 module is radius/ex.ample.com Any ideas about how to proceed and the reasons why this happens? We are running the 3.0.15-2.11.2 freeradius version on SuSE12 SP3. Thank you so much. Kind Regards. Dario Garcia Díaz-Miguel GGCS-SES Unit GGCS SKMF Infrastructure Division GMV C\ de Isaac Newton, 11 28760, Tres Cantos, Madrid España +34 918 07 21 00 +34 918 07 21 99 www.gmv.com P Please consider the environment before printing this e-mail.

3 3

I want to limit the number of users online to 1 at the same time. Is it OK to operate the database only?
by 纽约城门口的小木匠 ■ 17 Sep '20

17 Sep '20

I want to limit the number of users online to 1 at the same time. Is it OK to operate the database only?

2 1

Accounting Start - Proxy
by Byron Jeffery 15 Sep '20

15 Sep '20

Hi I am looking into a possible scenario where we need to pass the accounting start record to two devices simultaneously, but because we have multiple sites, I will need to look at the source NAS and then forward/proxy to the two correct accounting servers based on that site. Currently our NAS can only send the accounting start to one device at a time. In my research, I know that there is the option of setting up a freeradius accounting proxy with some home servers, but I am struggling to understand if this will accomplish what we are looking to do as above. Will I need to reference these home servers in the Accounting section in the sites-enabled>default config file? Hope I made sense, sorry. - Kind Regards - Byron Jeffery - Assisting ICT Manager -- The content of this message is provided without responsibility in law for their accuracy or otherwise, and without assumption of a duty of care by Christian Education Ministries. Whilst every attempt has been made to ensure that material contained in this email is free from computer viruses or other defects, the attached files are provided, and may only be used, on the basis that the user assumes all responsibility for use of the material transmitted. This email is intended only for the use of the individual or entity names above and may contain information that is confidential and privileged. If you are not the intended recipient, please note that any dissemination, distribution or copying of this email is strictly prohibited. If you have received this email in error, please notify us immediately by return email and destroy the original message.

2 1

Wiki RadSec outdated
by Henning Hollermann 14 Sep '20

14 Sep '20

Hi, I think freeRADIUS supports RadSec by now, correct? https://wiki.freeradius.org/glossary/RadSec Best, Henning

2 3

External trigger for CoA
by Vadim Cargatser (vcargats) 14 Sep '20

14 Sep '20

Hi, We'd like to trigger a CoA based on an external event. Is this possible? There was a mail thread back in 2010 I was just wondering if something has been changed so far: http://freeradius.1045715.n5.nabble.com/Freeradius-COA-trigger-td3204376.ht… I know the basic approach is to use radclient for that scenario. Unfortunately, radclient does not support TLS/RADSEC which is critical for us. In case this is not currently possible, can we just implement that? Say to allow getting external events for example from RabbitMQ? Thanks, Vadim

2 2