- Freeradius-Users - lists.freeradius.org

Accounting Data to Multiple Servers
by J. Russell Woodman 15 May '20

15 May '20

Hi, I'd like to send RADIUS accounting data to three separate accounting servers. I believe most of the configuration I need can be borrowed from robust-proxy-accounting from the default sites-available. However, I don't think "type = load-balancing" in the pool declaration is the option I need. Could someone point me in the right direction to make sure all three servers get all accounting data? Thanks, Russ Woodman russ(a)natcotech.com

2 1

looking for test client for PEAP/MSCHAPv2
by Jim Shi 15 May '20

15 May '20

Hi, I am looking for a test client that I can use to test PEAP/MSCHAPv2 Seems radtest does not support PEAP/MSCHAPv2? Any help is appreciated. Thanks a lot. Jim

4 4

Re: Freeradius-Users Digest, Vol 181, Issue 21
by Imdad Hasan 15 May '20

15 May '20

So, if i want to make the framed-ip with dynamic value than how can i do that.? And i seen one vendor that use the freeradius and that use own module in perl for CHAP authentication. For MSCHAP and EAP its using built in system's (FreeRADIUS) module. Is that possible? On Fri, May 15, 2020 at 3:30 PM < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Wifi + Active Directory without ntlm (Alan DeKok) > 2. Re: Wifi + Active Directory without ntlm (Fabrice Durand) > 3. looking for test client for PEAP/MSCHAPv2 (Jim Shi) > 4. Re: looking for test client for PEAP/MSCHAPv2 (Matthew Newton) > 5. Re: looking for test client for PEAP/MSCHAPv2 (Jorge Pereira) > 6. CHAP Authentication with rlm_perl module (Imdad Hasan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 14 May 2020 10:59:13 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Wifi + Active Directory without ntlm > Message-ID: <8A61A9A6-900D-41D6-9F33-3174FCFCF6D9(a)deployingradius.com> > Content-Type: text/plain; charset=utf-8 > > On May 14, 2020, at 10:56 AM, Клеусов Владимир Сергеевич via > Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > > > > The idea was to link freeradius and ad via an ldap module. That is, do > not install samba and windbind. To authentifizierte using the ldap module. > That is, it will not work like this. Right ? > > That question has been asked and answered about 4 times now. The answer > won't change if you keep asking the same question. The only thing you'll > do is annoy the people who are trying to help you. > > > So the ldap module is it for other LDAP implementations, such as > openldap ? > > The LDAP module is for any server which implements LDAP. Like AD. > > But as you were already told, the issue isn't LDAP. It's AD. > > Alan DeKok. > > > > > ------------------------------ > > Message: 2 > Date: Thu, 14 May 2020 12:53:24 -0400 > From: Fabrice Durand <fdurand(a)inverse.ca> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Wifi + Active Directory without ntlm > Message-ID: <4d796e43-502b-b71f-4c6e-d4394ee70176(a)inverse.ca> > Content-Type: text/plain; charset=utf-8; format=flowed > > I did this kind of configuration a long time ago and most of the work > needs to be done on the AD side. > > The idea is to mimic what a Edirectory server do (universal password) > and create a ldap attribute where you will store the NTHASH of the > user/computer. > > > https://github.com/inverse-inc/packetfence/tree/devel/addons/nthash_AD_attr… > > > The other way is to extract the NTHASH for each users, store it > somewhere (sql per example) and configure FreeRADIUS to fetch the NTHASH > based on the username. > > > https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump… > > > Regards > > Fabrice > > Le 20-05-14 à 10 h 56, Клеусов Владимир Сергеевич via Freeradius-Users a > écrit : > > The idea was to link freeradius and ad via an ldap module. That is, do > not install samba and windbind. To authentifizierte using the ldap module. > That is, it will not work like this. Right ? So the ldap module is it for > other LDAP implementations, such as openldap ? > > > >> 14 мая 2020 г., в 16:40, Josef Vybíhal <josef.vybihal(a)gmail.com> > написал(а): > >> > >> Is it possible, that you mean that you just don't want to use ntlm_auth > >> command? If yes, then read the winbind comment section in the mschap > module > >> config. > >> # winbind_username = "%{mschap:User-Name}" > >> # winbind_domain = "%{mschap:NT-Domain}" > >> > >> or this > >> https://wiki.freeradius.org/guide/Active-Directory-direct-via-winbind > >> > >> On Thu, May 14, 2020 at 3:32 PM Клеусов Владимир Сергеевич via > >> Freeradius-Users <freeradius-users(a)lists.freeradius.org> wrote: > >> > >>> Ideally, I want to authenticate the domain user and if he is in the > >>> domain, check his group. If not in the group, do not connect to wifi. > Is > >>> this possible without ntlm ? > >>> > >>> 14 мая 2020 г., в 16:07, Matthew Newton <mcn(a)freeradius.org<mailto: > >>> mcn(a)freeradius.org>> написал(а): > >>> > >>> o do what? Just get policy information/groups etc, or to authenticate? > >>> > >>> FreeRADIUS can use LDAP to query AD to get group information etc just > >>> fine. However, AD won't give you a password over LDAP. So in the vast > >>> majority of cases if you want to authenticate you need to use mschap. > >>> > >>> - > >>> List info/subscribe/unsubscribe? See > >>> http://www.freeradius.org/list/users.html > >> - > >> List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- > Fabrice Durand > fdurand(a)inverse.ca :: +1.514.447.4918 (x135) :: www.inverse.ca > Inverse inc. :: Leaders behind SOGo (http://www.sogo.nu) and PacketFence ( > http://packetfence.org) > > > > ------------------------------ > > Message: 3 > Date: Thu, 14 May 2020 18:04:10 +0000 (UTC) > From: Jim Shi <hjshi(a)yahoo.com> > To: "freeradius-users(a)lists.freeradius.org" > <freeradius-users(a)lists.freeradius.org> > Subject: looking for test client for PEAP/MSCHAPv2 > Message-ID: <1191804016.213541.1589479450003(a)mail.yahoo.com> > Content-Type: text/plain; charset=UTF-8 > > Hi, > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > Seems radtest does not support PEAP/MSCHAPv2? > Any help is appreciated. > Thanks a lot. > Jim > > > > ------------------------------ > > Message: 4 > Date: Thu, 14 May 2020 19:07:50 +0100 > From: Matthew Newton <mcn(a)freeradius.org> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: looking for test client for PEAP/MSCHAPv2 > Message-ID: <a71f17df-a2f0-da95-9b20-4980b93e2956(a)freeradius.org> > Content-Type: text/plain; charset=utf-8; format=flowed > > > On 14/05/2020 19:04, Jim Shi via Freeradius-Users wrote: > > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > > Seems radtest does not support PEAP/MSCHAPv2? > > eapol_test from wpa_supplicant: > > https://w1.fi/wpa_supplicant/ > > There are example configs in the FreeRADIUS source (see "make test"). > > -- > Matthew > > > ------------------------------ > > Message: 5 > Date: Thu, 14 May 2020 15:12:15 -0300 > From: Jorge Pereira <jpereira(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: looking for test client for PEAP/MSCHAPv2 > Message-ID: <47565E26-014E-4114-B3BC-186CDD7E113B(a)freeradius.org> > Content-Type: text/plain; charset=utf-8 > > Hi Jimm > > Take a look at “eapol_test” tool. We have some config samples in our repo. > > e.g: > > [jpereira@jorge-sugarloaf freeradius-server-v3.0.x.git]$ grep eapol_test > -r src/ > src//tests/eap-md5.conf:# eapol_test -c eap-md5.conf -s testing123 -n > src//tests/Makefile:EAPOL_TEST = $(shell which eapol_test) > src//tests/Makefile:# Run eapol_test if it exists. Otherwise do nothing > src//tests/eap-mschapv2.conf:# eapol_test -c eap-mschapv2.conf -s > testing123 > src//tests/eap-ttls-eap-mschapv2.conf:# eapol_test -c > eap-ttls-eap-mschapv2.conf -s testing123 > src//tests/peap-mschapv2.conf:# ./eapol_test -c peap-mschapv2.conf -s > testing123 > src//tests/eap-ttls-mschapv2.conf:# eapol_test -c eap-ttls-mschapv2.conf > -s testing123 > src//tests/peap-client-mschapv2.conf:# ./eapol_test -c > peap-mschapv2.conf -s testing123 > src//tests/.gitignore:eapol_test > src//tests/eap-tls.conf:# eapol_test -c eap-tls.conf -s testing123 > src//tests/eap-ttls-pap.conf:# eapol_test -c eap-ttls-pap.conf -s > testing123 > [jpereira@jorge-sugarloaf freeradius-server-v3.0.x.git]$ > > --- > Jorge Pereira > jpereira(a)freeradius.org <mailto:jpereira@freeradius.org> > > > > > > On 14 May 2020, at 15:04, Jim Shi via Freeradius-Users < > freeradius-users(a)lists.freeradius.org> wrote: > > > > Hi, > > I am looking for a test client that I can use to test PEAP/MSCHAPv2 > > Seems radtest does not support PEAP/MSCHAPv2? > > Any help is appreciated. > > Thanks a lot. > > Jim > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > Message: 6 > Date: Fri, 15 May 2020 04:30:52 +0530 > From: Imdad Hasan <imdadalikadiwala0(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Authentication with rlm_perl module > Message-ID: > < > CAPidyMXKC+6zXm1sCNpHiSfaJKddrbNM7D7Ayd2JWM0hXjpfkQ(a)mail.gmail.com> > Content-Type: text/plain; charset="UTF-8" > > Dear all, > > i am using perl module, its working all like exec module but no doubt its > increased the performance on high load. But i have some queries when i use > CHAP authentication method with perl module. > > > In CHAP authentication i can't verify the password with Cleartext-Password, > right? > That's why i set RADCHECK attribute Cleartext-Password="password" and after > that freeradius verify them with authenticator and all. and if password > doesn't matched than its return Reject. > > But if i want to accept those user ( who have wrong password ) with special > disabled framed-ip than how can i?? > > > Thanks all, > > Imdad > > > ------------------------------ > > Subject: Digest Footer > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ > > End of Freeradius-Users Digest, Vol 181, Issue 21 > ************************************************* >

1 0

CHAP Authentication with rlm_perl module
by Imdad Hasan 15 May '20

15 May '20

Dear all, i am using perl module, its working all like exec module but no doubt its increased the performance on high load. But i have some queries when i use CHAP authentication method with perl module. In CHAP authentication i can't verify the password with Cleartext-Password, right? That's why i set RADCHECK attribute Cleartext-Password="password" and after that freeradius verify them with authenticator and all. and if password doesn't matched than its return Reject. But if i want to accept those user ( who have wrong password ) with special disabled framed-ip than how can i?? Thanks all, Imdad

2 1

RE: How to force EAP-Identity Request sending after EAP START
by Fernando Alvarez 15 May '20

15 May '20

Hi! We are experiencing the same problem, and we were able to reproduce it using the following environment: Auth method: EAP-MSCHAPv2 against file with clear text passwords. NAS: Nokia vSR 7750 FreeRADIUS 3.0.21 3 clients tested: - Linux (StrongSwan client): works OK - MacOS (native client): partial OK. Works only if “local-id” is set with the username. - Windows 10 (native client): KO We check in logs that we receive the local IP address from the Windows and Mac clients as the user-name attribute. During MSCHAPv2 challenge, the user-name provided to the identity backend is the local IP address, thus making the authentication fail, as it doesn’t receive the actual username. Digging a little further in the issue, we see that clients do not send the actual username because they do not receive the Identity request from RADIUS server. Likewise, FreeRadius doesn’t send the Identity Request because it didn’t receive an EAP start message. This behaviour is documented in the “handled" return code in the Processing/authorize section of the EAP module documentation ( https://networkradius.com/doc/current/raddb/mods-available/eap.html) Here the relevant log in our environment: Ready to process requests (3) Received Access-Request Id 7 from 85.57.4.42:64391 to 10.0.103.175:1812 length 145 (3) User-Name = "192.168.1.19" (3) Acct-Session-Id = "85.51.29.253-87.217.240.140:4500-1589384382" (3) NAS-Port-Id = "tunnel-1.public:10" (3) NAS-Identifier = "secgw01" (3) EAP-Message = 0x020b0011013139322e3136382e312e3139 (3) Message-Authenticator = 0x9f6ec0d3f5148c3a19ecc9580cc24d61 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default As discussed before in this thread, this behavior considers the EAP start as a MANDATORY, when the RFC 3579 says that: "the NAS MAY send an Access-Request packet to the RADIUS server containing an EAP-Message attribute signifying EAP-Start” (page 7). In other NAS like StrongSwan server, we have found that this specific issue has forced StrongSwan to send the identity request to the client on behalf of the FreeRADIUS server. In our view, maybe this is something that shouldn’t be done, as the NAS is impersonating part of the RADIUS flow, right? We have tried to shortcut this issue and we modified the source code with a quick & very dirty workaround in line 691 of eap.c file (https://github.com/FreeRADIUS/freeradius-server/blob/af8643bd8b7487fd687dee…) making EAP messages containing certain length to enter the "if" statement, and thus making FreeRadius to act if it received the EAP START message: if ((eap_msg->vp_length == 0) || (eap_msg->vp_length == 2) || (eap_msg->vp_length == 18) || (eap_msg->vp_length == 14)) { Note here that we specified length of 18 and 14, as it was the two lengths that we were receiving from our two test clients. This obviously cannot be a general solution, as this length varies with the user-name field. ** The first question here is: How should be in your opinion this made, and implement the MAY instead of MUST? After “fixing” this issue, we have found also that there’s s paranoid check in this very same eap.c file (https://github.com/FreeRADIUS/freeradius-server/blob/af8643bd8b7487fd687dee…) FreeRadius checks if sent user-name value matches identity. Unfortunately, it doesn´t, because Windows and Mac send local IP address as user-name and the actual username as the identity: “Identity does not match User-Name, setting from EAP Identity” Again, we did the trick of deleting this check and continued forward. ** Second question here: should this check be deleted, as there’re legitim use cases that do not comply with this? Should this be configurable via a configuration option? Finally, we get to a dead end with the nt_password validation. FreeRADIUS is using the user-name field to look for the password, instead of using the identity field. So, authentication fails because rlm_mschap module doesn’t find the provided username (it’s a local IP address!), and thus validations fail, even when the right password is sent. We ended up in this file: https://github.com/FreeRADIUS/freeradius-server/blob/aeb8d49ba823ee69f8a032… **So third and last question is: which and where to change the provided parameters to mschap module in order to send the right ones (identity vs. user-name)? We really appreciate your support on this. We have tried our best to provide as much detail as possible, even when we are not RADIUS experts, nor having knowledge on FreeRadius source code. Best, Fer Alvarez

1 0

Connection Failure with PEAP0/1 with MSCHAPv2
by Ammann, Lukas 13 May '20

13 May '20

I run a freeradius server on ubuntu (self signed certificates) with PEAP0/1 and MSCHAPv2. On the device side i use: - Windows 10 - Ubuntu - Android - Embedded Device If i disable certificate validation on Win, Ubuntu and Android, the devices connect successfully. The embedded device (TI CC3100MOD) however, also has disabled certification validation, but is unable to connect to the server. I post the debug log output from freeradius below, can someone explain here where is goes wrong based in the log info? (52) Received Access-Request Id 246 from 192.168.1.20:32778 to 192.168.1.10:1812 length 163 (52) User-Name = "test01" (52) NAS-IP-Address = 192.168.1.20 (52) NAS-Port = 0 (52) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (52) Calling-Station-Id = "78-04-73-D4-B4-24" (52) Framed-MTU = 1400 (52) NAS-Port-Type = Wireless-802.11 (52) Connect-Info = "CONNECT 0Mbps 802.11g" (52) EAP-Message = 0x0200000b01746573743031 (52) Message-Authenticator = 0x4ceab2578c8f02a075a7f11f6320a748 (52) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (52) authorize { (52) policy filter_username { (52) if (&User-Name) { (52) if (&User-Name) -> TRUE (52) if (&User-Name) { (52) if (&User-Name =~ / /) { (52) if (&User-Name =~ / /) -> FALSE (52) if (&User-Name =~ /@[^@]*@/ ) { (52) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (52) if (&User-Name =~ /\.\./ ) { (52) if (&User-Name =~ /\.\./ ) -> FALSE (52) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (52) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (52) if (&User-Name =~ /\.$/) { (52) if (&User-Name =~ /\.$/) -> FALSE (52) if (&User-Name =~ /(a)\./) { (52) if (&User-Name =~ /(a)\./) -> FALSE (52) } # if (&User-Name) = notfound (52) } # policy filter_username = notfound (52) [preprocess] = ok (52) [chap] = noop (52) [mschap] = noop (52) [digest] = noop (52) suffix: Checking for suffix after "@" (52) suffix: No '@' in User-Name = "test01", looking up realm NULL (52) suffix: No such realm "NULL" (52) [suffix] = noop (52) eap: Peer sent EAP Response (code 2) ID 0 length 11 (52) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (52) [eap] = ok (52) } # authorize = ok (52) Found Auth-Type = eap (52) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (52) authenticate { (52) eap: Peer sent packet with method EAP Identity (1) (52) eap: Calling submodule eap_md5 to process data (52) eap_md5: Issuing MD5 Challenge (52) eap: Sending EAP Request (code 1) ID 1 length 22 (52) eap: EAP session adding &reply:State = 0x633491436335957d (52) [eap] = handled (52) } # authenticate = handled (52) Using Post-Auth-Type Challenge (52) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (52) Challenge { ... } # empty sub-section is ignored (52) Sent Access-Challenge Id 246 from 192.168.1.10:1812 to 192.168.1.20:32778 length 0 (52) EAP-Message = 0x010100160410ba5f459eda3617acd2e624d807a8723c (52) Message-Authenticator = 0x00000000000000000000000000000000 (52) State = 0x633491436335957dbc3411b176659974 (52) Finished request Waking up in 4.9 seconds. (53) Received Access-Request Id 247 from 192.168.1.20:32778 to 192.168.1.10:1812 length 176 (53) User-Name = "test01" (53) NAS-IP-Address = 192.168.1.20 (53) NAS-Port = 0 (53) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (53) Calling-Station-Id = "78-04-73-D4-B4-24" (53) Framed-MTU = 1400 (53) NAS-Port-Type = Wireless-802.11 (53) Connect-Info = "CONNECT 0Mbps 802.11g" (53) EAP-Message = 0x020100060319 (53) State = 0x633491436335957dbc3411b176659974 (53) Message-Authenticator = 0x9cfee8f9a78b498db004da9449e91e98 (53) session-state: No cached attributes (53) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (53) authorize { (53) policy filter_username { (53) if (&User-Name) { (53) if (&User-Name) -> TRUE (53) if (&User-Name) { (53) if (&User-Name =~ / /) { (53) if (&User-Name =~ / /) -> FALSE (53) if (&User-Name =~ /@[^@]*@/ ) { (53) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (53) if (&User-Name =~ /\.\./ ) { (53) if (&User-Name =~ /\.\./ ) -> FALSE (53) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (53) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (53) if (&User-Name =~ /\.$/) { (53) if (&User-Name =~ /\.$/) -> FALSE (53) if (&User-Name =~ /(a)\./) { (53) if (&User-Name =~ /(a)\./) -> FALSE (53) } # if (&User-Name) = notfound (53) } # policy filter_username = notfound (53) [preprocess] = ok (53) [chap] = noop (53) [mschap] = noop (53) [digest] = noop (53) suffix: Checking for suffix after "@" (53) suffix: No '@' in User-Name = "test01", looking up realm NULL (53) suffix: No such realm "NULL" (53) [suffix] = noop (53) eap: Peer sent EAP Response (code 2) ID 1 length 6 (53) eap: No EAP Start, assuming it's an on-going EAP conversation (53) [eap] = updated (53) files: users: Matched entry test01 at line 1 (53) [files] = ok (53) [expiration] = noop (53) [logintime] = noop (53) pap: WARNING: Auth-Type already set. Not setting to PAP (53) [pap] = noop (53) } # authorize = updated (53) Found Auth-Type = eap (53) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (53) authenticate { (53) eap: Expiring EAP session with state 0x633491436335957d (53) eap: Finished EAP session with state 0x633491436335957d (53) eap: Previous EAP request found for state 0x633491436335957d, released from the list (53) eap: Peer sent packet with method EAP NAK (3) (53) eap: Found mutually acceptable type PEAP (25) (53) eap: Calling submodule eap_peap to process data (53) eap_peap: Initiating new TLS session (53) eap_peap: [eaptls start] = request (53) eap: Sending EAP Request (code 1) ID 2 length 6 (53) eap: EAP session adding &reply:State = 0x633491436236887d (53) [eap] = handled (53) } # authenticate = handled (53) Using Post-Auth-Type Challenge (53) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (53) Challenge { ... } # empty sub-section is ignored (53) Sent Access-Challenge Id 247 from 192.168.1.10:1812 to 192.168.1.20:32778 length 0 (53) EAP-Message = 0x010200061920 (53) Message-Authenticator = 0x00000000000000000000000000000000 (53) State = 0x633491436236887dbc3411b176659974 (53) Finished request Waking up in 4.9 seconds. (54) Received Access-Request Id 248 from 192.168.1.20:32778 to 192.168.1.10:1812 length 176 (54) User-Name = "test01" (54) NAS-IP-Address = 192.168.1.20 (54) NAS-Port = 0 (54) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (54) Calling-Station-Id = "78-04-73-D4-B4-24" (54) Framed-MTU = 1400 (54) NAS-Port-Type = Wireless-802.11 (54) Connect-Info = "CONNECT 0Mbps 802.11g" (54) EAP-Message = 0x020200060300 (54) State = 0x633491436236887dbc3411b176659974 (54) Message-Authenticator = 0x90af88c3ea0d47d73d2b5e1764683fd8 (54) session-state: No cached attributes (54) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (54) authorize { (54) policy filter_username { (54) if (&User-Name) { (54) if (&User-Name) -> TRUE (54) if (&User-Name) { (54) if (&User-Name =~ / /) { (54) if (&User-Name =~ / /) -> FALSE (54) if (&User-Name =~ /@[^@]*@/ ) { (54) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (54) if (&User-Name =~ /\.\./ ) { (54) if (&User-Name =~ /\.\./ ) -> FALSE (54) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (54) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (54) if (&User-Name =~ /\.$/) { (54) if (&User-Name =~ /\.$/) -> FALSE (54) if (&User-Name =~ /(a)\./) { (54) if (&User-Name =~ /(a)\./) -> FALSE (54) } # if (&User-Name) = notfound (54) } # policy filter_username = notfound (54) [preprocess] = ok (54) [chap] = noop (54) [mschap] = noop (54) [digest] = noop (54) suffix: Checking for suffix after "@" (54) suffix: No '@' in User-Name = "test01", looking up realm NULL (54) suffix: No such realm "NULL" (54) [suffix] = noop (54) eap: Peer sent EAP Response (code 2) ID 2 length 6 (54) eap: No EAP Start, assuming it's an on-going EAP conversation (54) [eap] = updated (54) files: users: Matched entry test01 at line 1 (54) [files] = ok (54) [expiration] = noop (54) [logintime] = noop (54) pap: WARNING: Auth-Type already set. Not setting to PAP (54) [pap] = noop (54) } # authorize = updated (54) Found Auth-Type = eap (54) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (54) authenticate { (54) eap: Expiring EAP session with state 0x633491436236887d (54) eap: Finished EAP session with state 0x633491436236887d (54) eap: Previous EAP request found for state 0x633491436236887d, released from the list (54) eap: Peer sent packet with method EAP NAK (3) (54) eap: Peer NAK'd indicating it is not willing to continue (54) eap: Sending EAP Failure (code 4) ID 2 length 4 (54) eap: Failed in EAP select (54) [eap] = invalid (54) } # authenticate = invalid (54) Failed to authenticate the user (54) Using Post-Auth-Type Reject (54) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (54) Post-Auth-Type REJECT { (54) attr_filter.access_reject: EXPAND %{User-Name} (54) attr_filter.access_reject: --> test01 (54) attr_filter.access_reject: Matched entry DEFAULT at line 11 (54) [attr_filter.access_reject] = updated (54) [eap] = noop (54) policy remove_reply_message_if_eap { (54) if (&reply:EAP-Message && &reply:Reply-Message) { (54) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (54) else { (54) [noop] = noop (54) } # else = noop (54) } # policy remove_reply_message_if_eap = noop (54) } # Post-Auth-Type REJECT = updated (54) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (54) Sending delayed response (54) Sent Access-Reject Id 248 from 192.168.1.10:1812 to 192.168.1.20:32778 length 44 (54) EAP-Message = 0x04020004 (54) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (55) Received Access-Request Id 249 from 192.168.1.20:32778 to 192.168.1.10:1812 length 163 (55) User-Name = "test01" (55) NAS-IP-Address = 192.168.1.20 (55) NAS-Port = 0 (55) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (55) Calling-Station-Id = "78-04-73-D4-B4-24" (55) Framed-MTU = 1400 (55) NAS-Port-Type = Wireless-802.11 (55) Connect-Info = "CONNECT 0Mbps 802.11g" (55) EAP-Message = 0x0200000b01746573743031 (55) Message-Authenticator = 0xef10fa68009844fdf7211b785d7c251b (55) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (55) authorize { (55) policy filter_username { (55) if (&User-Name) { (55) if (&User-Name) -> TRUE (55) if (&User-Name) { (55) if (&User-Name =~ / /) { (55) if (&User-Name =~ / /) -> FALSE (55) if (&User-Name =~ /@[^@]*@/ ) { (55) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (55) if (&User-Name =~ /\.\./ ) { (55) if (&User-Name =~ /\.\./ ) -> FALSE (55) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (55) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (55) if (&User-Name =~ /\.$/) { (55) if (&User-Name =~ /\.$/) -> FALSE (55) if (&User-Name =~ /(a)\./) { (55) if (&User-Name =~ /(a)\./) -> FALSE (55) } # if (&User-Name) = notfound (55) } # policy filter_username = notfound (55) [preprocess] = ok (55) [chap] = noop (55) [mschap] = noop (55) [digest] = noop (55) suffix: Checking for suffix after "@" (55) suffix: No '@' in User-Name = "test01", looking up realm NULL (55) suffix: No such realm "NULL" (55) [suffix] = noop (55) eap: Peer sent EAP Response (code 2) ID 0 length 11 (55) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (55) [eap] = ok (55) } # authorize = ok (55) Found Auth-Type = eap (55) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (55) authenticate { (55) eap: Peer sent packet with method EAP Identity (1) (55) eap: Calling submodule eap_md5 to process data (55) eap_md5: Issuing MD5 Challenge (55) eap: Sending EAP Request (code 1) ID 1 length 22 (55) eap: EAP session adding &reply:State = 0x63735e5863725ae6 (55) [eap] = handled (55) } # authenticate = handled (55) Using Post-Auth-Type Challenge (55) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (55) Challenge { ... } # empty sub-section is ignored (55) Sent Access-Challenge Id 249 from 192.168.1.10:1812 to 192.168.1.20:32778 length 0 (55) EAP-Message = 0x01010016041068b48875b03f069d5553d10b064ac816 (55) Message-Authenticator = 0x00000000000000000000000000000000 (55) State = 0x63735e5863725ae6e05a1d3b154eb421 (55) Finished request Waking up in 1.6 seconds. (56) Received Access-Request Id 250 from 192.168.1.20:32778 to 192.168.1.10:1812 length 176 (56) User-Name = "test01" (56) NAS-IP-Address = 192.168.1.20 (56) NAS-Port = 0 (56) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (56) Calling-Station-Id = "78-04-73-D4-B4-24" (56) Framed-MTU = 1400 (56) NAS-Port-Type = Wireless-802.11 (56) Connect-Info = "CONNECT 0Mbps 802.11g" (56) EAP-Message = 0x020100060319 (56) State = 0x63735e5863725ae6e05a1d3b154eb421 (56) Message-Authenticator = 0xfc3751df489663d525ecfaa82e691525 (56) session-state: No cached attributes (56) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (56) authorize { (56) policy filter_username { (56) if (&User-Name) { (56) if (&User-Name) -> TRUE (56) if (&User-Name) { (56) if (&User-Name =~ / /) { (56) if (&User-Name =~ / /) -> FALSE (56) if (&User-Name =~ /@[^@]*@/ ) { (56) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (56) if (&User-Name =~ /\.\./ ) { (56) if (&User-Name =~ /\.\./ ) -> FALSE (56) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (56) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (56) if (&User-Name =~ /\.$/) { (56) if (&User-Name =~ /\.$/) -> FALSE (56) if (&User-Name =~ /(a)\./) { (56) if (&User-Name =~ /(a)\./) -> FALSE (56) } # if (&User-Name) = notfound (56) } # policy filter_username = notfound (56) [preprocess] = ok (56) [chap] = noop (56) [mschap] = noop (56) [digest] = noop (56) suffix: Checking for suffix after "@" (56) suffix: No '@' in User-Name = "test01", looking up realm NULL (56) suffix: No such realm "NULL" (56) [suffix] = noop (56) eap: Peer sent EAP Response (code 2) ID 1 length 6 (56) eap: No EAP Start, assuming it's an on-going EAP conversation (56) [eap] = updated (56) files: users: Matched entry test01 at line 1 (56) [files] = ok (56) [expiration] = noop (56) [logintime] = noop (56) pap: WARNING: Auth-Type already set. Not setting to PAP (56) [pap] = noop (56) } # authorize = updated (56) Found Auth-Type = eap (56) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (56) authenticate { (56) eap: Expiring EAP session with state 0x63735e5863725ae6 (56) eap: Finished EAP session with state 0x63735e5863725ae6 (56) eap: Previous EAP request found for state 0x63735e5863725ae6, released from the list (56) eap: Peer sent packet with method EAP NAK (3) (56) eap: Found mutually acceptable type PEAP (25) (56) eap: Calling submodule eap_peap to process data (56) eap_peap: Initiating new TLS session (56) eap_peap: [eaptls start] = request (56) eap: Sending EAP Request (code 1) ID 2 length 6 (56) eap: EAP session adding &reply:State = 0x63735e58627147e6 (56) [eap] = handled (56) } # authenticate = handled (56) Using Post-Auth-Type Challenge (56) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (56) Challenge { ... } # empty sub-section is ignored (56) Sent Access-Challenge Id 250 from 192.168.1.10:1812 to 192.168.1.20:32778 length 0 (56) EAP-Message = 0x010200061920 (56) Message-Authenticator = 0x00000000000000000000000000000000 (56) State = 0x63735e58627147e6e05a1d3b154eb421 (56) Finished request Waking up in 1.6 seconds. (57) Received Access-Request Id 251 from 192.168.1.20:32778 to 192.168.1.10:1812 length 176 (57) User-Name = "test01" (57) NAS-IP-Address = 192.168.1.20 (57) NAS-Port = 0 (57) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (57) Calling-Station-Id = "78-04-73-D4-B4-24" (57) Framed-MTU = 1400 (57) NAS-Port-Type = Wireless-802.11 (57) Connect-Info = "CONNECT 0Mbps 802.11g" (57) EAP-Message = 0x020200060300 (57) State = 0x63735e58627147e6e05a1d3b154eb421 (57) Message-Authenticator = 0xc33ab970a8a9c1c0e5a1e367b874a105 (57) session-state: No cached attributes (57) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (57) authorize { (57) policy filter_username { (57) if (&User-Name) { (57) if (&User-Name) -> TRUE (57) if (&User-Name) { (57) if (&User-Name =~ / /) { (57) if (&User-Name =~ / /) -> FALSE (57) if (&User-Name =~ /@[^@]*@/ ) { (57) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (57) if (&User-Name =~ /\.\./ ) { (57) if (&User-Name =~ /\.\./ ) -> FALSE (57) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (57) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (57) if (&User-Name =~ /\.$/) { (57) if (&User-Name =~ /\.$/) -> FALSE (57) if (&User-Name =~ /(a)\./) { (57) if (&User-Name =~ /(a)\./) -> FALSE (57) } # if (&User-Name) = notfound (57) } # policy filter_username = notfound (57) [preprocess] = ok (57) [chap] = noop (57) [mschap] = noop (57) [digest] = noop (57) suffix: Checking for suffix after "@" (57) suffix: No '@' in User-Name = "test01", looking up realm NULL (57) suffix: No such realm "NULL" (57) [suffix] = noop (57) eap: Peer sent EAP Response (code 2) ID 2 length 6 (57) eap: No EAP Start, assuming it's an on-going EAP conversation (57) [eap] = updated (57) files: users: Matched entry test01 at line 1 (57) [files] = ok (57) [expiration] = noop (57) [logintime] = noop (57) pap: WARNING: Auth-Type already set. Not setting to PAP (57) [pap] = noop (57) } # authorize = updated (57) Found Auth-Type = eap (57) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (57) authenticate { (57) eap: Expiring EAP session with state 0x63735e58627147e6 (57) eap: Finished EAP session with state 0x63735e58627147e6 (57) eap: Previous EAP request found for state 0x63735e58627147e6, released from the list (57) eap: Peer sent packet with method EAP NAK (3) (57) eap: Peer NAK'd indicating it is not willing to continue (57) eap: Sending EAP Failure (code 4) ID 2 length 4 (57) eap: Failed in EAP select (57) [eap] = invalid (57) } # authenticate = invalid (57) Failed to authenticate the user (57) Using Post-Auth-Type Reject (57) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (57) Post-Auth-Type REJECT { (57) attr_filter.access_reject: EXPAND %{User-Name} (57) attr_filter.access_reject: --> test01 (57) attr_filter.access_reject: Matched entry DEFAULT at line 11 (57) [attr_filter.access_reject] = updated (57) [eap] = noop (57) policy remove_reply_message_if_eap { (57) if (&reply:EAP-Message && &reply:Reply-Message) { (57) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (57) else { (57) [noop] = noop (57) } # else = noop (57) } # policy remove_reply_message_if_eap = noop (57) } # Post-Auth-Type REJECT = updated (57) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (57) Sending delayed response (57) Sent Access-Reject Id 251 from 192.168.1.10:1812 to 192.168.1.20:32778 length 44 (57) EAP-Message = 0x04020004 (57) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.6 seconds. (52) Cleaning up request packet ID 246 with timestamp +2298 (53) Cleaning up request packet ID 247 with timestamp +2298 (54) Cleaning up request packet ID 248 with timestamp +2298 Waking up in 3.3 seconds. (58) Received Access-Request Id 252 from 192.168.1.20:32778 to 192.168.1.10:1812 length 163 (58) User-Name = "test01" (58) NAS-IP-Address = 192.168.1.20 (58) NAS-Port = 0 (58) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (58) Calling-Station-Id = "78-04-73-D4-B4-24" (58) Framed-MTU = 1400 (58) NAS-Port-Type = Wireless-802.11 (58) Connect-Info = "CONNECT 0Mbps 802.11g" (58) EAP-Message = 0x0200000b01746573743031 (58) Message-Authenticator = 0x8087e4271b0fdcde223342ef9dd07a2d (58) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (58) authorize { (58) policy filter_username { (58) if (&User-Name) { (58) if (&User-Name) -> TRUE (58) if (&User-Name) { (58) if (&User-Name =~ / /) { (58) if (&User-Name =~ / /) -> FALSE (58) if (&User-Name =~ /@[^@]*@/ ) { (58) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (58) if (&User-Name =~ /\.\./ ) { (58) if (&User-Name =~ /\.\./ ) -> FALSE (58) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (58) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (58) if (&User-Name =~ /\.$/) { (58) if (&User-Name =~ /\.$/) -> FALSE (58) if (&User-Name =~ /(a)\./) { (58) if (&User-Name =~ /(a)\./) -> FALSE (58) } # if (&User-Name) = notfound (58) } # policy filter_username = notfound (58) [preprocess] = ok (58) [chap] = noop (58) [mschap] = noop (58) [digest] = noop (58) suffix: Checking for suffix after "@" (58) suffix: No '@' in User-Name = "test01", looking up realm NULL (58) suffix: No such realm "NULL" (58) [suffix] = noop (58) eap: Peer sent EAP Response (code 2) ID 0 length 11 (58) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (58) [eap] = ok (58) } # authorize = ok (58) Found Auth-Type = eap (58) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (58) authenticate { (58) eap: Peer sent packet with method EAP Identity (1) (58) eap: Calling submodule eap_md5 to process data (58) eap_md5: Issuing MD5 Challenge (58) eap: Sending EAP Request (code 1) ID 1 length 22 (58) eap: EAP session adding &reply:State = 0x2495222a249426c6 (58) [eap] = handled (58) } # authenticate = handled (58) Using Post-Auth-Type Challenge (58) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (58) Challenge { ... } # empty sub-section is ignored (58) Sent Access-Challenge Id 252 from 192.168.1.10:1812 to 192.168.1.20:32778 length 0 (58) EAP-Message = 0x01010016041039f1f2b9147a22c98fa2c02d2638cf8c (58) Message-Authenticator = 0x00000000000000000000000000000000 (58) State = 0x2495222a249426c65548f2a1339b6a08 (58) Finished request Waking up in 1.3 seconds. (59) Received Access-Request Id 253 from 192.168.1.20:32778 to 192.168.1.10:1812 length 176 (59) User-Name = "test01" (59) NAS-IP-Address = 192.168.1.20 (59) NAS-Port = 0 (59) Called-Station-Id = "70-69-5A-FD-23-05:ophtest-wpa2ent-up" (59) Calling-Station-Id = "78-04-73-D4-B4-24" (59) Framed-MTU = 1400 (59) NAS-Port-Type = Wireless-802.11 (59) Connect-Info = "CONNECT 0Mbps 802.11g" (59) EAP-Message = 0x020100060319 (59) State = 0x2495222a249426c65548f2a1339b6a08 (59) Message-Authenticator = 0x14fc2eea705ed936b8612c6f0d377d37 (59) session-state: No cached attributes (59) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (59) authorize { (59) policy filter_username { (59) if (&User-Name) { (59) if (&User-Name) -> TRUE (59) if (&User-Name) { (59) if (&User-Name =~ / /) { (59) if (&User-Name =~ / /) -> FALSE (59) if (&User-Name =~ /@[^@]*@/ ) { (59) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (59) if (&User-Name =~ /\.\./ ) { (59) if (&User-Name =~ /\.\./ ) -> FALSE (59) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (59) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (59) if (&User-Name =~ /\.$/) { (59) if (&User-Name =~ /\.$/) -> FALSE (59) if (&User-Name =~ /(a)\./) { (59) if (&User-Name =~ /(a)\./) -> FALSE (59) } # if (&User-Name) = notfound (59) } # policy filter_username = notfound (59) [preprocess] = ok (59) [chap] = noop (59) [mschap] = noop (59) [digest] = noop (59) suffix: Checking for suffix after "@" (59) suffix: No '@' in User-Name = "test01", looking up realm NULL (59) suffix: No such realm "NULL" (59) [suffix] = noop (59) eap: Peer sent EAP Response (code 2) ID 1 length 6 (59) eap: No EAP Start, assuming it's an on-going EAP conversation (59) [eap] = updated (59) files: users: Matched entry test01 at line 1 (59) [files] = ok (59) [expiration] = noop (59) [logintime] = noop

2 1

FreeRADIUS Proxy configuration not working
by Thomas Schachtner 11 May '20

11 May '20

Hi there, I need to authenticate different services coming from the same NAS with a different set of policies. The NAS is signalling the different services using a specific "NAS-Identifier" for every service. For example, I have a NAS-Identifier == "wifi" when WiFi clients are to be authenticated and I have a NAS-Identifier == "l2tp" when a VPN user should be authenticated. I need to authenticate WiFi users using their Active Directory computer certificate (using PEAP) and I need to authenticate VPN users using their Active Directory user name (plus their Yubikey, but I am not yet as far...) Using the available information and guidelines, I managed it to authenticate both services using the same server. It automatically accepts either MSCHAPv2 or EAP requests. But that is not what I want. I would like to have the VPN guys processed with another ruleset that the one used for the WiFi folks... Following the advice at http://freeradius.1045715.n5.nabble.com/Go-to-virtual-server-by-nas-id-td57… I added some home_servers and some home_server_pools in order to take care of the different jobs. In the default server config file, I added the following: if (NAS-Identifier == "wifi") { update control { Home-Server-Pool := "wifi-clients-pool" } } if (NAS-Identifier == "l2tp") { update control { Home-Server-Pool := "vpn-pool" } } I left all the rest of the file as it was (in order not to break anything). As it was mentioned in the comments of the default server config file, I also added the same lines to the inner-tunnel config file. After some time (two seconds or so), the authentication succeeded. But it seems as if the default server configuration would be used (instead of the wifi server) as you can see in the listing below (Listing 1). When removing all the rest of the default server config file, the authentication does not succeed anymore. On some other site I found that it might have to be done like this: if (NAS-Identifier == "wifi") { update control { Proxy-To-Realm := "wifi-clients-realm" } } if (NAS-Identifier == "l2tp") { update control { Proxy-To-Realm := "vpn-realm" } } But then, the authentication does not work at all anymore although now it seems as if the wifi virtial server processes the request (Listing 2). Does anyone know how? Here are the added contents to the proxy.conf file home_server wifi-clients { virtual_server = wifi-clients type = auth } home_server vpn { virtual_server = vpn type = auth } home_server_pool wifi-clients-pool { home_server = wifi-clients type = fail-over } home_server_pool vpn-pool { home_server = vpn type = fail-over } (The virtual server configuration files are copies of the default server file without the NAS-Identifier switching part shown above.) Originally, I wanted the main server just to be a dispatcher, forwarding the request either to the one or to the other virtual server. Can that be done? If so, how? Im completely lost at the mpoment... Best regards, Tom Listing 1: FreeRADIUS Version 3.0.16 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/eap including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/ntlm_auth including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/eap including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/wifi-clients including configuration file /etc/freeradius/3.0/sites-enabled/vpn main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server wifi-clients { virtual_server = "wifi-clients" port = 0 type = "auth" response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server vpn { virtual_server = "vpn" port = 0 type = "auth" response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } home_server_pool wifi-clients-pool { type = fail-over home_server = wifi-clients } realm wifi-clients-realm { auth_pool = wifi-clients-pool nostrip } home_server_pool vpn-pool { type = fail-over home_server = vpn } realm vpn-realm { auth_pool = vpn-pool } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw03 { ipaddr = 10.10.10.10 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw02 { ipaddr = 10.10.40.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw01 { ipaddr = 10.10.30.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw04 { ipaddr = 10.10.50.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw07 { ipaddr = 10.10.60.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw05 { ipaddr = 192.168.21.254 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Auth-Type = ntlm_auth radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´Å“Ã¹Ã»Ã¼aÃ¿Ã„Ã‰Ã–ÃœÃŸÃ€Ã‚Ã†Ã‡ÃˆÃ‰ÃŠÃ‹ÃŽÃ Ã”Å’Ã™Ã›ÃœÅ¸" } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=GP.VIEL --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } instantiate { } # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 retry_delay = 30 spread = no } rlm_mschap (mschap): Opening additional connection (0), 1 of 32 pending slots used rlm_mschap (mschap): Opening additional connection (1), 1 of 31 pending slots used rlm_mschap (mschap): Opening additional connection (2), 1 of 30 pending slots used rlm_mschap (mschap): Opening additional connection (3), 1 of 29 pending slots used rlm_mschap (mschap): Opening additional connection (4), 1 of 28 pending slots used rlm_mschap (mschap): authenticating directly to winbind # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/mykey.pem" certificate_file = "/etc/freeradius/3.0/certs/certificate.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:353 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server wifi-clients { # from file /etc/freeradius/3.0/sites-enabled/wifi-clients # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server wifi-clients server vpn { # from file /etc/freeradius/3.0/sites-enabled/vpn # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server vpn radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 58077 Listening on proxy address :: port 56627 Ready to process requests (0) Received Access-Request Id 237 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (0) User-Name = "host/PC06820.example.com" (0) NAS-Identifier = "wifi" (0) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (0) NAS-Port-Type = Wireless-802.11 (0) NAS-Port = 1 (0) Calling-Station-Id = "20-68-9D-2E-7A-B3" (0) Connect-Info = "CONNECT 54Mbps 802.11g" (0) Framed-MTU = 1400 (0) EAP-Message = 0x028c001c01686f73742f504330363832302e67702e7669656c2e6465 (0) Message-Authenticator = 0x4d2aa1836af04945475d99a3b0aebd73 (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) if (NAS-Identifier == "wifi") { (0) if (NAS-Identifier == "wifi") -> TRUE (0) if (NAS-Identifier == "wifi") { (0) update control { (0) Home-Server-Pool := "wifi-clients-pool" (0) } # update control = noop (0) } # if (NAS-Identifier == "wifi") = noop (0) if (NAS-Identifier == "l2tp") { (0) if (NAS-Identifier == "l2tp") -> FALSE (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = noop (0) } # policy filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 140 length 28 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 141 length 22 (0) eap: EAP session adding &reply:State = 0x5e51316b5edc3578 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 237 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (0) EAP-Message = 0x018d00160410974a533dad48c1d38b10bada2f39934e (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x5e51316b5edc35788145ae0a6b335879 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 238 from 10.10.10.10:57160 to 10.10.8.43:1812 length 176 (1) User-Name = "host/PC06820.example.com" (1) NAS-Identifier = "wifi" (1) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (1) NAS-Port-Type = Wireless-802.11 (1) NAS-Port = 1 (1) Calling-Station-Id = "20-68-9D-2E-7A-B3" (1) Connect-Info = "CONNECT 54Mbps 802.11g" (1) Framed-MTU = 1400 (1) EAP-Message = 0x028d00060319 (1) State = 0x5e51316b5edc35788145ae0a6b335879 (1) Message-Authenticator = 0x4bc7a62d6f9c53d3ad9fdfac2c98c4dc (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) if (NAS-Identifier == "wifi") { (1) if (NAS-Identifier == "wifi") -> TRUE (1) if (NAS-Identifier == "wifi") { (1) update control { (1) Home-Server-Pool := "wifi-clients-pool" (1) } # update control = noop (1) } # if (NAS-Identifier == "wifi") = noop (1) if (NAS-Identifier == "l2tp") { (1) if (NAS-Identifier == "l2tp") -> FALSE (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = noop (1) } # policy filter_username = noop (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 141 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) policy ntlm_auth.authorize { (1) if (!control:Auth-Type && User-Password) { (1) if (!control:Auth-Type && User-Password) -> FALSE (1) } # policy ntlm_auth.authorize = updated (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x5e51316b5edc3578 (1) eap: Finished EAP session with state 0x5e51316b5edc3578 (1) eap: Previous EAP request found for state 0x5e51316b5edc3578, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Initiating new EAP-TLS session (1) eap_peap: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 142 length 6 (1) eap: EAP session adding &reply:State = 0x5e51316b5fdf2878 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 238 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (1) EAP-Message = 0x018e00061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x5e51316b5fdf28788145ae0a6b335879 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 239 from 10.10.10.10:57160 to 10.10.8.43:1812 length 336 (2) User-Name = "host/PC06820.example.com" (2) NAS-Identifier = "wifi" (2) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (2) NAS-Port-Type = Wireless-802.11 (2) NAS-Port = 1 (2) Calling-Station-Id = "20-68-9D-2E-7A-B3" (2) Connect-Info = "CONNECT 54Mbps 802.11g" (2) Framed-MTU = 1400 (2) EAP-Message = 0x028e00a619800000009c16030300970100009303035eb18e44d04b3f65371e591dbecbbbf82cda5aed364ca0da3d0d8f7f52d5c3fe00002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d (2) State = 0x5e51316b5fdf28788145ae0a6b335879 (2) Message-Authenticator = 0x1f7cac4d86400e0d036321291cf4d622 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) if (NAS-Identifier == "wifi") { (2) if (NAS-Identifier == "wifi") -> TRUE (2) if (NAS-Identifier == "wifi") { (2) update control { (2) Home-Server-Pool := "wifi-clients-pool" (2) } # update control = noop (2) } # if (NAS-Identifier == "wifi") = noop (2) if (NAS-Identifier == "l2tp") { (2) if (NAS-Identifier == "l2tp") -> FALSE (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = noop (2) } # policy filter_username = noop (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 142 length 166 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x5e51316b5fdf2878 (2) eap: Finished EAP session with state 0x5e51316b5fdf2878 (2) eap: Previous EAP request found for state 0x5e51316b5fdf2878, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 156 bytes (2) eap_peap: Got complete TLS record (156 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 0097] (2) eap_peap: TLS_accept: SSLv3/TLS read client hello (2) eap_peap: >>> send TLS 1.2 [length 003d] (2) eap_peap: TLS_accept: SSLv3/TLS write server hello (2) eap_peap: >>> send TLS 1.2 [length 09dd] (2) eap_peap: TLS_accept: SSLv3/TLS write certificate (2) eap_peap: >>> send TLS 1.2 [length 014d] (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: SSLv3/TLS write server done (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (2) eap_peap: In SSL Handshake Phase (2) eap_peap: In SSL Accept mode (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 143 length 1004 (2) eap: EAP session adding &reply:State = 0x5e51316b5cde2878 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 239 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (2) EAP-Message = 0x018f03ec19c000000b7f160303003d02000039030305646e7d7dd9e65e890551dfe8987962d49032a4e59baaaeab578aeec0c328f800c030000011ff01000100000b0004030001020017000016030309dd0b0009d90009d60006303082062c30820514a0030201020213460000009bc8cd1dbbd3313db6 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x5e51316b5cde28788145ae0a6b335879 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 240 from 10.10.10.10:57160 to 10.10.8.43:1812 length 176 (3) User-Name = "host/PC06820.example.com" (3) NAS-Identifier = "wifi" (3) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (3) NAS-Port-Type = Wireless-802.11 (3) NAS-Port = 1 (3) Calling-Station-Id = "20-68-9D-2E-7A-B3" (3) Connect-Info = "CONNECT 54Mbps 802.11g" (3) Framed-MTU = 1400 (3) EAP-Message = 0x028f00061900 (3) State = 0x5e51316b5cde28788145ae0a6b335879 (3) Message-Authenticator = 0x86ca96d94b0a09e53d9b5696e1c6ee25 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) if (NAS-Identifier == "wifi") { (3) if (NAS-Identifier == "wifi") -> TRUE (3) if (NAS-Identifier == "wifi") { (3) update control { (3) Home-Server-Pool := "wifi-clients-pool" (3) } # update control = noop (3) } # if (NAS-Identifier == "wifi") = noop (3) if (NAS-Identifier == "l2tp") { (3) if (NAS-Identifier == "l2tp") -> FALSE (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = noop (3) } # policy filter_username = noop (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 143 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x5e51316b5cde2878 (3) eap: Finished EAP session with state 0x5e51316b5cde2878 (3) eap: Previous EAP request found for state 0x5e51316b5cde2878, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 144 length 1000 (3) eap: EAP session adding &reply:State = 0x5e51316b5dc12878 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 240 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (3) EAP-Message = 0x019003e819406e506f696e74862b687474703a2f2f706b692e67702e7669656c2e64652f706b692f67702d53562d444330322d43412e63726c3082010f06082b06010505070101048201013081fe3081ae06082b060105050730028681a16c6461703a2f2f2f434e3d67702d53562d444330322d43412c (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x5e51316b5dc128788145ae0a6b335879 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 241 from 10.10.10.10:57160 to 10.10.8.43:1812 length 176 (4) User-Name = "host/PC06820.example.com" (4) NAS-Identifier = "wifi" (4) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (4) NAS-Port-Type = Wireless-802.11 (4) NAS-Port = 1 (4) Calling-Station-Id = "20-68-9D-2E-7A-B3" (4) Connect-Info = "CONNECT 54Mbps 802.11g" (4) Framed-MTU = 1400 (4) EAP-Message = 0x029000061900 (4) State = 0x5e51316b5dc128788145ae0a6b335879 (4) Message-Authenticator = 0x89c433b521d79323ed524046bb9be860 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) if (NAS-Identifier == "wifi") { (4) if (NAS-Identifier == "wifi") -> TRUE (4) if (NAS-Identifier == "wifi") { (4) update control { (4) Home-Server-Pool := "wifi-clients-pool" (4) } # update control = noop (4) } # if (NAS-Identifier == "wifi") = noop (4) if (NAS-Identifier == "l2tp") { (4) if (NAS-Identifier == "l2tp") -> FALSE (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = noop (4) } # policy filter_username = noop (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 144 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x5e51316b5dc12878 (4) eap: Finished EAP session with state 0x5e51316b5dc12878 (4) eap: Previous EAP request found for state 0x5e51316b5dc12878, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer ACKed our handshake fragment (4) eap_peap: [eaptls verify] = request (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 145 length 961 (4) eap: EAP session adding &reply:State = 0x5e51316b5ac02878 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 241 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (4) EAP-Message = 0x019103c119000de709ec58e62837b2993411cdbde5dd2b988bc253e59b4df0452cf308122202c6e04affb51e178d9c4407f483a5314a96878b11f3b2d1fbd12cf389997cc8d0be34647894e48d50bd337004b43349a901f030cb526c95708d5c946843f1a8b49dc916a147b8dc8c60436774b32137bdc5 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x5e51316b5ac028788145ae0a6b335879 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 242 from 10.10.10.10:57160 to 10.10.8.43:1812 length 306 (5) User-Name = "host/PC06820.example.com" (5) NAS-Identifier = "wifi" (5) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (5) NAS-Port-Type = Wireless-802.11 (5) NAS-Port = 1 (5) Calling-Station-Id = "20-68-9D-2E-7A-B3" (5) Connect-Info = "CONNECT 54Mbps 802.11g" (5) Framed-MTU = 1400 (5) EAP-Message = 0x0291008819800000007e1603030046100000424104f73d093de91fc3ace997fd5366f168380b3a8d420e28d9f635c70e4f994fea76edc5d601141c794ead4b5ea5b4110dde6c982e75345a7e695684195d4fc760be14030300010116030300280000000000000000934d862861461cc184dd66122d1404 (5) State = 0x5e51316b5ac028788145ae0a6b335879 (5) Message-Authenticator = 0xcd1f8be4db6981050654ce234a0dc362 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) if (NAS-Identifier == "wifi") { (5) if (NAS-Identifier == "wifi") -> TRUE (5) if (NAS-Identifier == "wifi") { (5) update control { (5) Home-Server-Pool := "wifi-clients-pool" (5) } # update control = noop (5) } # if (NAS-Identifier == "wifi") = noop (5) if (NAS-Identifier == "l2tp") { (5) if (NAS-Identifier == "l2tp") -> FALSE (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = noop (5) } # policy filter_username = noop (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 145 length 136 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x5e51316b5ac02878 (5) eap: Finished EAP session with state 0x5e51316b5ac02878 (5) eap: Previous EAP request found for state 0x5e51316b5ac02878, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer indicated complete TLS record size will be 126 bytes (5) eap_peap: Got complete TLS record (126 bytes) (5) eap_peap: [eaptls verify] = length included (5) eap_peap: TLS_accept: SSLv3/TLS write server done (5) eap_peap: <<< recv TLS 1.2 [length 0046] (5) eap_peap: TLS_accept: SSLv3/TLS read client key exchange (5) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (5) eap_peap: <<< recv TLS 1.2 [length 0010] (5) eap_peap: TLS_accept: SSLv3/TLS read finished (5) eap_peap: >>> send TLS 1.2 [length 0001] (5) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (5) eap_peap: >>> send TLS 1.2 [length 0010] (5) eap_peap: TLS_accept: SSLv3/TLS write finished (5) eap_peap: (other): SSL negotiation finished successfully (5) eap_peap: SSL Connection Established (5) eap_peap: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 146 length 57 (5) eap: EAP session adding &reply:State = 0x5e51316b5bc32878 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 242 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (5) EAP-Message = 0x0192003919001403030001011603030028ea18c95cd37de77375a8409931448d30a669d35d71ef514cc8113319438b861347ec2dcbae19fbd2 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x5e51316b5bc328788145ae0a6b335879 (5) Finished request Waking up in 4.8 seconds. (6) Received Access-Request Id 243 from 10.10.10.10:57160 to 10.10.8.43:1812 length 176 (6) User-Name = "host/PC06820.example.com" (6) NAS-Identifier = "wifi" (6) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (6) NAS-Port-Type = Wireless-802.11 (6) NAS-Port = 1 (6) Calling-Station-Id = "20-68-9D-2E-7A-B3" (6) Connect-Info = "CONNECT 54Mbps 802.11g" (6) Framed-MTU = 1400 (6) EAP-Message = 0x029200061900 (6) State = 0x5e51316b5bc328788145ae0a6b335879 (6) Message-Authenticator = 0x95fb73155782147ca4a6007d09e9595f (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (6) authorize { (6) if (NAS-Identifier == "wifi") { (6) if (NAS-Identifier == "wifi") -> TRUE (6) if (NAS-Identifier == "wifi") { (6) update control { (6) Home-Server-Pool := "wifi-clients-pool" (6) } # update control = noop (6) } # if (NAS-Identifier == "wifi") = noop (6) if (NAS-Identifier == "l2tp") { (6) if (NAS-Identifier == "l2tp") -> FALSE (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = noop (6) } # policy filter_username = noop (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 146 length 6 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x5e51316b5bc32878 (6) eap: Finished EAP session with state 0x5e51316b5bc32878 (6) eap: Previous EAP request found for state 0x5e51316b5bc32878, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer ACKed our handshake fragment. handshake is finished (6) eap_peap: [eaptls verify] = success (6) eap_peap: [eaptls process] = success (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state TUNNEL ESTABLISHED (6) eap: Sending EAP Request (code 1) ID 147 length 40 (6) eap: EAP session adding &reply:State = 0x5e51316b58c22878 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 243 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (6) EAP-Message = 0x019300281900170303001dea18c95cd37de7741c1f033d3690de5ebf9c3014c7ebc2d98c1efe6dfc (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x5e51316b58c228788145ae0a6b335879 (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 244 from 10.10.10.10:57160 to 10.10.8.43:1812 length 229 (7) User-Name = "host/PC06820.example.com" (7) NAS-Identifier = "wifi" (7) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (7) NAS-Port-Type = Wireless-802.11 (7) NAS-Port = 1 (7) Calling-Station-Id = "20-68-9D-2E-7A-B3" (7) Connect-Info = "CONNECT 54Mbps 802.11g" (7) Framed-MTU = 1400 (7) EAP-Message = 0x0293003b1900170303003000000000000000013ac5e121636f637adab894280c3c70b36a6a97df20a3763e0235e4901dc8803dd2d28fdb7e6c9eb2 (7) State = 0x5e51316b58c228788145ae0a6b335879 (7) Message-Authenticator = 0x1a41158a0b11c1f6ac381eee74d27cda (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (7) authorize { (7) if (NAS-Identifier == "wifi") { (7) if (NAS-Identifier == "wifi") -> TRUE (7) if (NAS-Identifier == "wifi") { (7) update control { (7) Home-Server-Pool := "wifi-clients-pool" (7) } # update control = noop (7) } # if (NAS-Identifier == "wifi") = noop (7) if (NAS-Identifier == "l2tp") { (7) if (NAS-Identifier == "l2tp") -> FALSE (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = noop (7) } # policy filter_username = noop (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 147 length 59 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x5e51316b58c22878 (7) eap: Finished EAP session with state 0x5e51316b58c22878 (7) eap: Previous EAP request found for state 0x5e51316b58c22878, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - host/PC06820.example.com (7) eap_peap: Got inner identity 'host/PC06820.example.com' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0293001c01686f73742f504330363832302e67702e7669656c2e6465 (7) eap_peap: Setting User-Name to host/PC06820.example.com (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0293001c01686f73742f504330363832302e67702e7669656c2e6465 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "host/PC06820.example.com" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0293001c01686f73742f504330363832302e67702e7669656c2e6465 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "host/PC06820.example.com" (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel { (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) if (NAS-Identifier == "wifi") { (7) ERROR: Failed retrieving values required to evaluate condition (7) if (NAS-Identifier == "l2tp") { (7) ERROR: Failed retrieving values required to evaluate condition (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 147 length 28 (7) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Peer sent packet with method EAP Identity (1) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: Issuing Challenge (7) eap: Sending EAP Request (code 1) ID 148 length 43 (7) eap: EAP session adding &reply:State = 0x73d6eaa27342f033 (7) [eap] = handled (7) } # authenticate = handled (7) } # server inner-tunnel (7) Virtual server sending reply (7) EAP-Message = 0x0194002b1a01940026108e81c1dc719cb5a6dc04ab3e717fb3f8667265657261646975732d332e302e3136 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x73d6eaa27342f0333f753f1347dd3ef1 (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x0194002b1a01940026108e81c1dc719cb5a6dc04ab3e717fb3f8667265657261646975732d332e302e3136 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x73d6eaa27342f0333f753f1347dd3ef1 (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x0194002b1a01940026108e81c1dc719cb5a6dc04ab3e717fb3f8667265657261646975732d332e302e3136 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x73d6eaa27342f0333f753f1347dd3ef1 (7) eap_peap: Got tunneled Access-Challenge (7) eap: Sending EAP Request (code 1) ID 148 length 74 (7) eap: EAP session adding &reply:State = 0x5e51316b59c52878 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) Sent Access-Challenge Id 244 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (7) EAP-Message = 0x0194004a1900170303003fea18c95cd37de77590b9308a5dc3c0d13fd62e65f5e248cc907aecb057ea43f68178d1074e3f1520426d36799bf872c830cf0c68d1e5b12b604e6585a64235 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x5e51316b59c528788145ae0a6b335879 (7) Finished request Waking up in 4.8 seconds. (8) Received Access-Request Id 245 from 10.10.10.10:57160 to 10.10.8.43:1812 length 283 (8) User-Name = "host/PC06820.example.com" (8) NAS-Identifier = "wifi" (8) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (8) NAS-Port-Type = Wireless-802.11 (8) NAS-Port = 1 (8) Calling-Station-Id = "20-68-9D-2E-7A-B3" (8) Connect-Info = "CONNECT 54Mbps 802.11g" (8) Framed-MTU = 1400 (8) EAP-Message = 0x029400711900170303006600000000000000020576e39e705a6555abcc41cff88cf583ad668129f7fac93e6fe42e849f7866b4d85befe3c5e1ad30451a25dc0ea48716d4d51538423d41369925c918221c6d695d6e8099460ae640b62dfabcf328561b3b5604ee2e8a842b81e91adaa0cd (8) State = 0x5e51316b59c528788145ae0a6b335879 (8) Message-Authenticator = 0x44073011f5be0bc02c2a0439c4eeab5c (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (8) authorize { (8) if (NAS-Identifier == "wifi") { (8) if (NAS-Identifier == "wifi") -> TRUE (8) if (NAS-Identifier == "wifi") { (8) update control { (8) Home-Server-Pool := "wifi-clients-pool" (8) } # update control = noop (8) } # if (NAS-Identifier == "wifi") = noop (8) if (NAS-Identifier == "l2tp") { (8) if (NAS-Identifier == "l2tp") -> FALSE (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = noop (8) } # policy filter_username = noop (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 148 length 113 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x73d6eaa27342f033 (8) eap: Finished EAP session with state 0x5e51316b59c52878 (8) eap: Previous EAP request found for state 0x5e51316b59c52878, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x029400521a0294004d318bed1ddb66ac4a3b18f70c8c1d4cf465000000000000000003aa17ba22c8d0982d367e0f5870eff0a1ab5549a3322e6300686f73742f504330363832302e67702e7669656c2e6465 (8) eap_peap: Setting User-Name to host/PC06820.example.com (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x029400521a0294004d318bed1ddb66ac4a3b18f70c8c1d4cf465000000000000000003aa17ba22c8d0982d367e0f5870eff0a1ab5549a3322e6300686f73742f504330363832302e67702e7669656c2e6465 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "host/PC06820.example.com" (8) eap_peap: State = 0x73d6eaa27342f0333f753f1347dd3ef1 (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x029400521a0294004d318bed1ddb66ac4a3b18f70c8c1d4cf465000000000000000003aa17ba22c8d0982d367e0f5870eff0a1ab5549a3322e6300686f73742f504330363832302e67702e7669656c2e6465 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "host/PC06820.example.com" (8) State = 0x73d6eaa27342f0333f753f1347dd3ef1 (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authorize { (8) if (NAS-Identifier == "wifi") { (8) ERROR: Failed retrieving values required to evaluate condition (8) if (NAS-Identifier == "l2tp") { (8) ERROR: Failed retrieving values required to evaluate condition (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 148 length 82 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0x73d6eaa27342f033 (8) eap: Finished EAP session with state 0x73d6eaa27342f033 (8) eap: Previous EAP request found for state 0x73d6eaa27342f033, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Creating challenge hash with username: host/PC06820.example.com (8) mschap: Client is using MS-CHAPv2 (8) mschap: EXPAND %{mschap:User-Name} (8) mschap: --> PC06820$ rlm_mschap (mschap): Reserved connection (0) (8) mschap: sending authentication request user='PC06820$' domain='GP.VIEL' rlm_mschap (mschap): Released connection (0) Need 5 more connections to reach 10 spares rlm_mschap (mschap): Opening additional connection (5), 1 of 27 pending slots used (8) mschap: Authenticated successfully (8) mschap: Adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # authenticate = ok (8) MSCHAP Success (8) eap: Sending EAP Request (code 1) ID 149 length 51 (8) eap: EAP session adding &reply:State = 0x73d6eaa27243f033 (8) [eap] = handled (8) } # authenticate = handled (8) } # server inner-tunnel (8) Virtual server sending reply (8) EAP-Message = 0x019500331a0394002e533d33383337354431354345383645334343323632393838304637344245313235353231323942313341 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x73d6eaa27243f0333f753f1347dd3ef1 (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: EAP-Message = 0x019500331a0394002e533d33383337354431354345383645334343323632393838304637344245313235353231323942313341 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x73d6eaa27243f0333f753f1347dd3ef1 (8) eap_peap: Got tunneled reply RADIUS code 11 (8) eap_peap: EAP-Message = 0x019500331a0394002e533d33383337354431354345383645334343323632393838304637344245313235353231323942313341 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x73d6eaa27243f0333f753f1347dd3ef1 (8) eap_peap: Got tunneled Access-Challenge (8) eap: Sending EAP Request (code 1) ID 149 length 82 (8) eap: EAP session adding &reply:State = 0x5e51316b56c42878 (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (8) Challenge { ... } # empty sub-section is ignored (8) Sent Access-Challenge Id 245 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (8) EAP-Message = 0x0195005219001703030047ea18c95cd37de776ecbe79e711ce8d2c7cec1c0e527fcf9d34c8a2d196b8bab68697cd9fd3e8fc7b8376cf3bb798edec62324e820eec7f538344013847ab2ab565325cfba96d52 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x5e51316b56c428788145ae0a6b335879 (8) Finished request Waking up in 4.8 seconds. (9) Received Access-Request Id 246 from 10.10.10.10:57160 to 10.10.8.43:1812 length 207 (9) User-Name = "host/PC06820.example.com" (9) NAS-Identifier = "wifi" (9) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (9) NAS-Port-Type = Wireless-802.11 (9) NAS-Port = 1 (9) Calling-Station-Id = "20-68-9D-2E-7A-B3" (9) Connect-Info = "CONNECT 54Mbps 802.11g" (9) Framed-MTU = 1400 (9) EAP-Message = 0x029500251900170303001a0000000000000003570c069dfd1675237fac367a5185ff32c595 (9) State = 0x5e51316b56c428788145ae0a6b335879 (9) Message-Authenticator = 0x9626d6b625d128bfc8588ac44f2a148a (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (9) authorize { (9) if (NAS-Identifier == "wifi") { (9) if (NAS-Identifier == "wifi") -> TRUE (9) if (NAS-Identifier == "wifi") { (9) update control { (9) Home-Server-Pool := "wifi-clients-pool" (9) } # update control = noop (9) } # if (NAS-Identifier == "wifi") = noop (9) if (NAS-Identifier == "l2tp") { (9) if (NAS-Identifier == "l2tp") -> FALSE (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = noop (9) } # policy filter_username = noop (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 149 length 37 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x73d6eaa27243f033 (9) eap: Finished EAP session with state 0x5e51316b56c42878 (9) eap: Previous EAP request found for state 0x5e51316b56c42878, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x029500061a03 (9) eap_peap: Setting User-Name to host/PC06820.example.com (9) eap_peap: Sending tunneled request to inner-tunnel (9) eap_peap: EAP-Message = 0x029500061a03 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "host/PC06820.example.com" (9) eap_peap: State = 0x73d6eaa27243f0333f753f1347dd3ef1 (9) Virtual server inner-tunnel received request (9) EAP-Message = 0x029500061a03 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "host/PC06820.example.com" (9) State = 0x73d6eaa27243f0333f753f1347dd3ef1 (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) authorize { (9) if (NAS-Identifier == "wifi") { (9) ERROR: Failed retrieving values required to evaluate condition (9) if (NAS-Identifier == "l2tp") { (9) ERROR: Failed retrieving values required to evaluate condition (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) update control { (9) &Proxy-To-Realm := LOCAL (9) } # update control = noop (9) eap: Peer sent EAP Response (code 2) ID 149 length 6 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) [files] = noop (9) [expiration] = noop (9) [logintime] = noop (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x73d6eaa27243f033 (9) eap: Finished EAP session with state 0x73d6eaa27243f033 (9) eap: Previous EAP request found for state 0x73d6eaa27243f033, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap: Sending EAP Success (code 3) ID 149 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) post-auth { (9) if (0) { (9) if (0) -> FALSE (9) } # post-auth = noop (9) } # server inner-tunnel (9) Virtual server sending reply (9) MS-MPPE-Encryption-Policy = Encryption-Allowed (9) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) MS-MPPE-Send-Key = 0x8211c970608352c6e9fa63a3d47b5904 (9) MS-MPPE-Recv-Key = 0xfb0e576ca3f9b4cc296423b66446606f (9) EAP-Message = 0x03950004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "host/PC06820.example.com" (9) eap_peap: Got tunneled reply code 2 (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x8211c970608352c6e9fa63a3d47b5904 (9) eap_peap: MS-MPPE-Recv-Key = 0xfb0e576ca3f9b4cc296423b66446606f (9) eap_peap: EAP-Message = 0x03950004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "host/PC06820.example.com" (9) eap_peap: Got tunneled reply RADIUS code 2 (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x8211c970608352c6e9fa63a3d47b5904 (9) eap_peap: MS-MPPE-Recv-Key = 0xfb0e576ca3f9b4cc296423b66446606f (9) eap_peap: EAP-Message = 0x03950004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "host/PC06820.example.com" (9) eap_peap: Tunneled authentication was successful (9) eap_peap: SUCCESS (9) eap: Sending EAP Request (code 1) ID 150 length 46 (9) eap: EAP session adding &reply:State = 0x5e51316b57c72878 (9) [eap] = handled (9) } # authenticate = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (9) Challenge { ... } # empty sub-section is ignored (9) Sent Access-Challenge Id 246 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (9) EAP-Message = 0x0196002e19001703030023ea18c95cd37de7770fdb6426fd7f939e14b507e6ade4bb0dc9e72903001142807eca98 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x5e51316b57c728788145ae0a6b335879 (9) Finished request Waking up in 4.7 seconds. (10) Received Access-Request Id 247 from 10.10.10.10:57160 to 10.10.8.43:1812 length 216 (10) User-Name = "host/PC06820.example.com" (10) NAS-Identifier = "wifi" (10) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Port = 1 (10) Calling-Station-Id = "20-68-9D-2E-7A-B3" (10) Connect-Info = "CONNECT 54Mbps 802.11g" (10) Framed-MTU = 1400 (10) EAP-Message = 0x0296002e190017030300230000000000000004f22bfe8c72b2bccc5b493c3323112b025993cefd0c89460dbf04ee (10) State = 0x5e51316b57c728788145ae0a6b335879 (10) Message-Authenticator = 0xd691aed06663dd9f3ab08aee1964cf75 (10) session-state: No cached attributes (10) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (10) authorize { (10) if (NAS-Identifier == "wifi") { (10) if (NAS-Identifier == "wifi") -> TRUE (10) if (NAS-Identifier == "wifi") { (10) update control { (10) Home-Server-Pool := "wifi-clients-pool" (10) } # update control = noop (10) } # if (NAS-Identifier == "wifi") = noop (10) if (NAS-Identifier == "l2tp") { (10) if (NAS-Identifier == "l2tp") -> FALSE (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = noop (10) } # policy filter_username = noop (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent EAP Response (code 2) ID 150 length 46 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0x5e51316b57c72878 (10) eap: Finished EAP session with state 0x5e51316b57c72878 (10) eap: Previous EAP request found for state 0x5e51316b57c72878, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: Continuing EAP-TLS (10) eap_peap: [eaptls verify] = ok (10) eap_peap: Done initial handshake (10) eap_peap: [eaptls process] = ok (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv success (10) eap_peap: Received EAP-TLV response (10) eap_peap: Success (10) eap: Sending EAP Success (code 3) ID 150 length 4 (10) eap: Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (10) post-auth { (10) update { (10) No attributes updated (10) } # update = noop (10) [exec] = noop (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) } # post-auth = noop (10) Sent Access-Accept Id 247 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (10) MS-MPPE-Recv-Key = 0x079365360106572a0acb0616e57d73d1f14212409925d9612bc1740f3c2245e1 (10) MS-MPPE-Send-Key = 0x3856a656b9b7c8623fdebad64b041bc8e08cda385569d0fe96affd1f6b67cf74 (10) EAP-Message = 0x03960004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "host/PC06820.example.com" (10) Finished request Waking up in 4.7 seconds. (0) Cleaning up request packet ID 237 with timestamp +9 (1) Cleaning up request packet ID 238 with timestamp +9 (2) Cleaning up request packet ID 239 with timestamp +9 (3) Cleaning up request packet ID 240 with timestamp +9 (4) Cleaning up request packet ID 241 with timestamp +9 (5) Cleaning up request packet ID 242 with timestamp +9 (6) Cleaning up request packet ID 243 with timestamp +9 (7) Cleaning up request packet ID 244 with timestamp +9 (8) Cleaning up request packet ID 245 with timestamp +9 (9) Cleaning up request packet ID 246 with timestamp +9 (10) Cleaning up request packet ID 247 with timestamp +9 Ready to process requests Listing 2: FreeRADIUS Version 3.0.16 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/realm including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods-enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/detail.log including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/eap including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/ntlm_auth including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids including configuration file /etc/freeradius/3.0/policy.d/eap including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default including configuration file /etc/freeradius/3.0/sites-enabled/wifi-clients including configuration file /etc/freeradius/3.0/sites-enabled/vpn main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server wifi-clients { virtual_server = "wifi-clients" port = 0 type = "auth" response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server vpn { virtual_server = "vpn" port = 0 type = "auth" response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } home_server_pool wifi-clients-pool { type = fail-over home_server = wifi-clients } realm wifi-clients-realm { auth_pool = wifi-clients-pool nostrip } home_server_pool vpn-pool { type = fail-over home_server = vpn } realm vpn-realm { auth_pool = vpn-pool } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw03 { ipaddr = 10.10.10.10 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw02 { ipaddr = 10.10.40.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw01 { ipaddr = 10.10.30.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw04 { ipaddr = 10.10.50.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw07 { ipaddr = 10.10.60.1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client sv-fw05 { ipaddr = 192.168.21.254 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest # Creating Auth-Type = ntlm_auth radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´Å“Ã¹Ã»Ã¼aÃ¿Ã„Ã‰Ã–ÃœÃŸÃ€Ã‚Ã†Ã‡ÃˆÃ‰ÃŠÃ‹ÃŽÃ Ã”Å’Ã™Ã›ÃœÅ¸" } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=GP.VIEL --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8 # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } instantiate { } # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap rlm_mschap (mschap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 86400 cleanup_interval = 300 idle_timeout = 600 retry_delay = 30 spread = no } rlm_mschap (mschap): Opening additional connection (0), 1 of 32 pending slots used rlm_mschap (mschap): Opening additional connection (1), 1 of 31 pending slots used rlm_mschap (mschap): Opening additional connection (2), 1 of 30 pending slots used rlm_mschap (mschap): Opening additional connection (3), 1 of 29 pending slots used rlm_mschap (mschap): Opening additional connection (4), 1 of 28 pending slots used rlm_mschap (mschap): authenticating directly to winbind # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/mykey.pem" certificate_file = "/etc/freeradius/3.0/certs/certificate.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" tls_max_version = "" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:353 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server wifi-clients { # from file /etc/freeradius/3.0/sites-enabled/wifi-clients # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server wifi-clients server vpn { # from file /etc/freeradius/3.0/sites-enabled/vpn # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server vpn radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 42161 Listening on proxy address :: port 47802 Ready to process requests (0) Received Access-Request Id 248 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (0) User-Name = "host/PC06820.example.com" (0) NAS-Identifier = "wifi" (0) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (0) NAS-Port-Type = Wireless-802.11 (0) NAS-Port = 1 (0) Calling-Station-Id = "20-68-9D-2E-7A-B3" (0) Connect-Info = "CONNECT 54Mbps 802.11g" (0) Framed-MTU = 1400 (0) EAP-Message = 0x0201001c01686f73742f504330363832302e67702e7669656c2e6465 (0) Message-Authenticator = 0x50812a4b43196de2d514e022692f83fe (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (0) authorize { (0) if (NAS-Identifier == "wifi") { (0) if (NAS-Identifier == "wifi") -> TRUE (0) if (NAS-Identifier == "wifi") { (0) update control { (0) Proxy-To-Realm := "wifi-clients-realm" (0) } # update control = noop (0) } # if (NAS-Identifier == "wifi") = noop (0) if (NAS-Identifier == "l2tp") { (0) if (NAS-Identifier == "l2tp") -> FALSE (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = noop (0) } # policy filter_username = noop (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Request is supposed to be proxied to Realm wifi-clients-realm. Not doing EAP. (0) [eap] = noop (0) [files] = noop (0) [expiration] = noop (0) [logintime] = noop (0) policy ntlm_auth.authorize { (0) if (!control:Auth-Type && User-Password) { (0) if (!control:Auth-Type && User-Password) -> FALSE (0) } # policy ntlm_auth.authorize = ok (0) } # authorize = ok (0) Starting proxy to home server (null) port 0 Proxying to virtual server wifi-clients (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/wifi-clients (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Request already has destination realm set. Ignoring (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 28 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 2 length 22 (0) eap: EAP session adding &reply:State = 0x84fcd24884fed687 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (0) Challenge { ... } # empty sub-section is ignored (0) Finished internally proxied request. (0) Clearing existing &reply: attributes (0) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (0) post-proxy { (0) eap: No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop (0) Clearing existing &reply: attributes (0) Found Post-Proxy-Type Fail-Authentication (0) Post-Proxy-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 248 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (0) State = 0xcc0a604ac658f11de08e2f27854526bf (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 248 with timestamp +2 Ready to process requests (1) Received Access-Request Id 249 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (1) User-Name = "host/PC06820.example.com" (1) NAS-Identifier = "wifi" (1) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (1) NAS-Port-Type = Wireless-802.11 (1) NAS-Port = 1 (1) Calling-Station-Id = "20-68-9D-2E-7A-B3" (1) Connect-Info = "CONNECT 54Mbps 802.11g" (1) Framed-MTU = 1400 (1) EAP-Message = 0x0210001c01686f73742f504330363832302e67702e7669656c2e6465 (1) Message-Authenticator = 0x2648407773283df8029c58cf3be4652b (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (1) authorize { (1) if (NAS-Identifier == "wifi") { (1) if (NAS-Identifier == "wifi") -> TRUE (1) if (NAS-Identifier == "wifi") { (1) update control { (1) Proxy-To-Realm := "wifi-clients-realm" (1) } # update control = noop (1) } # if (NAS-Identifier == "wifi") = noop (1) if (NAS-Identifier == "l2tp") { (1) if (NAS-Identifier == "l2tp") -> FALSE (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = noop (1) } # policy filter_username = noop (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Request is supposed to be proxied to Realm wifi-clients-realm. Not doing EAP. (1) [eap] = noop (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) policy ntlm_auth.authorize { (1) if (!control:Auth-Type && User-Password) { (1) if (!control:Auth-Type && User-Password) -> FALSE (1) } # policy ntlm_auth.authorize = ok (1) } # authorize = ok (1) Starting proxy to home server (null) port 0 Proxying to virtual server wifi-clients (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/wifi-clients (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Request already has destination realm set. Ignoring (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 16 length 28 (1) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (1) authenticate { (1) eap: Peer sent packet with method EAP Identity (1) (1) eap: Calling submodule eap_md5 to process data (1) eap_md5: Issuing MD5 Challenge (1) eap: Sending EAP Request (code 1) ID 17 length 22 (1) eap: EAP session adding &reply:State = 0x93a8563f93b95236 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (1) Challenge { ... } # empty sub-section is ignored (1) Finished internally proxied request. (1) Clearing existing &reply: attributes (1) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (1) post-proxy { (1) eap: No pre-existing handler found (1) [eap] = noop (1) } # post-proxy = noop (1) Clearing existing &reply: attributes (1) Found Post-Proxy-Type Fail-Authentication (1) Post-Proxy-Type sub-section not found. Ignoring. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 249 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (1) State = 0x7804fdcf7bc89872f2224c39194cb567 (1) Finished request Waking up in 4.9 seconds. (1) Cleaning up request packet ID 249 with timestamp +21 Ready to process requests (2) Received Access-Request Id 250 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (2) User-Name = "host/PC06820.example.com" (2) NAS-Identifier = "wifi" (2) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (2) NAS-Port-Type = Wireless-802.11 (2) NAS-Port = 1 (2) Calling-Station-Id = "20-68-9D-2E-7A-B3" (2) Connect-Info = "CONNECT 54Mbps 802.11g" (2) Framed-MTU = 1400 (2) EAP-Message = 0x0299001c01686f73742f504330363832302e67702e7669656c2e6465 (2) Message-Authenticator = 0x0fe8d59c93078d158b66ed6b36acdc02 (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (2) authorize { (2) if (NAS-Identifier == "wifi") { (2) if (NAS-Identifier == "wifi") -> TRUE (2) if (NAS-Identifier == "wifi") { (2) update control { (2) Proxy-To-Realm := "wifi-clients-realm" (2) } # update control = noop (2) } # if (NAS-Identifier == "wifi") = noop (2) if (NAS-Identifier == "l2tp") { (2) if (NAS-Identifier == "l2tp") -> FALSE (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = noop (2) } # policy filter_username = noop (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Request is supposed to be proxied to Realm wifi-clients-realm. Not doing EAP. (2) [eap] = noop (2) [files] = noop (2) [expiration] = noop (2) [logintime] = noop (2) policy ntlm_auth.authorize { (2) if (!control:Auth-Type && User-Password) { (2) if (!control:Auth-Type && User-Password) -> FALSE (2) } # policy ntlm_auth.authorize = ok (2) } # authorize = ok (2) Starting proxy to home server (null) port 0 Proxying to virtual server wifi-clients (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/wifi-clients (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Request already has destination realm set. Ignoring (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 153 length 28 (2) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (2) authenticate { (2) eap: Peer sent packet with method EAP Identity (1) (2) eap: Calling submodule eap_md5 to process data (2) eap_md5: Issuing MD5 Challenge (2) eap: Sending EAP Request (code 1) ID 154 length 22 (2) eap: EAP session adding &reply:State = 0xc526d466c5bcd065 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (2) Challenge { ... } # empty sub-section is ignored (2) Finished internally proxied request. (2) Clearing existing &reply: attributes (2) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (2) post-proxy { (2) eap: No pre-existing handler found (2) [eap] = noop (2) } # post-proxy = noop (2) Clearing existing &reply: attributes (2) Found Post-Proxy-Type Fail-Authentication (2) Post-Proxy-Type sub-section not found. Ignoring. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 250 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (2) State = 0xea19bb9f6a97a0de4457318706242998 (2) Finished request Waking up in 4.9 seconds. (2) Cleaning up request packet ID 250 with timestamp +40 Ready to process requests (3) Received Access-Request Id 251 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (3) User-Name = "host/PC06820.example.com" (3) NAS-Identifier = "wifi" (3) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (3) NAS-Port-Type = Wireless-802.11 (3) NAS-Port = 1 (3) Calling-Station-Id = "20-68-9D-2E-7A-B3" (3) Connect-Info = "CONNECT 54Mbps 802.11g" (3) Framed-MTU = 1400 (3) EAP-Message = 0x029f001c01686f73742f504330363832302e67702e7669656c2e6465 (3) Message-Authenticator = 0x09e41e9bc40b1a9bd5f40708ea9f5e4e (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (3) authorize { (3) if (NAS-Identifier == "wifi") { (3) if (NAS-Identifier == "wifi") -> TRUE (3) if (NAS-Identifier == "wifi") { (3) update control { (3) Proxy-To-Realm := "wifi-clients-realm" (3) } # update control = noop (3) } # if (NAS-Identifier == "wifi") = noop (3) if (NAS-Identifier == "l2tp") { (3) if (NAS-Identifier == "l2tp") -> FALSE (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = noop (3) } # policy filter_username = noop (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Request is supposed to be proxied to Realm wifi-clients-realm. Not doing EAP. (3) [eap] = noop (3) [files] = noop (3) [expiration] = noop (3) [logintime] = noop (3) policy ntlm_auth.authorize { (3) if (!control:Auth-Type && User-Password) { (3) if (!control:Auth-Type && User-Password) -> FALSE (3) } # policy ntlm_auth.authorize = ok (3) } # authorize = ok (3) Starting proxy to home server (null) port 0 Proxying to virtual server wifi-clients (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/wifi-clients (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Request already has destination realm set. Ignoring (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 159 length 28 (3) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (3) authenticate { (3) eap: Peer sent packet with method EAP Identity (1) (3) eap: Calling submodule eap_md5 to process data (3) eap_md5: Issuing MD5 Challenge (3) eap: Sending EAP Request (code 1) ID 160 length 22 (3) eap: EAP session adding &reply:State = 0xbc098a48bca98e33 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (3) Challenge { ... } # empty sub-section is ignored (3) Finished internally proxied request. (3) Clearing existing &reply: attributes (3) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (3) post-proxy { (3) eap: No pre-existing handler found (3) [eap] = noop (3) } # post-proxy = noop (3) Clearing existing &reply: attributes (3) Found Post-Proxy-Type Fail-Authentication (3) Post-Proxy-Type sub-section not found. Ignoring. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 251 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (3) State = 0x191ba4e0ef56de3a3e2fa9ad979524a5 (3) Finished request Waking up in 4.9 seconds. (3) Cleaning up request packet ID 251 with timestamp +59 Ready to process requests (4) Received Access-Request Id 252 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (4) User-Name = "host/PC06820.example.com" (4) NAS-Identifier = "wifi" (4) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (4) NAS-Port-Type = Wireless-802.11 (4) NAS-Port = 1 (4) Calling-Station-Id = "20-68-9D-2E-7A-B3" (4) Connect-Info = "CONNECT 54Mbps 802.11g" (4) Framed-MTU = 1400 (4) EAP-Message = 0x020a001c01686f73742f504330363832302e67702e7669656c2e6465 (4) Message-Authenticator = 0x46b8aeb3c590460ccbd4294412d219d5 (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (4) authorize { (4) if (NAS-Identifier == "wifi") { (4) if (NAS-Identifier == "wifi") -> TRUE (4) if (NAS-Identifier == "wifi") { (4) update control { (4) Proxy-To-Realm := "wifi-clients-realm" (4) } # update control = noop (4) } # if (NAS-Identifier == "wifi") = noop (4) if (NAS-Identifier == "l2tp") { (4) if (NAS-Identifier == "l2tp") -> FALSE (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = noop (4) } # policy filter_username = noop (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Request is supposed to be proxied to Realm wifi-clients-realm. Not doing EAP. (4) [eap] = noop (4) [files] = noop (4) [expiration] = noop (4) [logintime] = noop (4) policy ntlm_auth.authorize { (4) if (!control:Auth-Type && User-Password) { (4) if (!control:Auth-Type && User-Password) -> FALSE (4) } # policy ntlm_auth.authorize = ok (4) } # authorize = ok (4) Starting proxy to home server (null) port 0 Proxying to virtual server wifi-clients (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/wifi-clients (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Request already has destination realm set. Ignoring (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 10 length 28 (4) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (4) authenticate { (4) eap: Peer sent packet with method EAP Identity (1) (4) eap: Calling submodule eap_md5 to process data (4) eap_md5: Issuing MD5 Challenge (4) eap: Sending EAP Request (code 1) ID 11 length 22 (4) eap: EAP session adding &reply:State = 0x9cd322f39cd8262b (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (4) Challenge { ... } # empty sub-section is ignored (4) Finished internally proxied request. (4) Clearing existing &reply: attributes (4) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (4) post-proxy { (4) eap: No pre-existing handler found (4) [eap] = noop (4) } # post-proxy = noop (4) Clearing existing &reply: attributes (4) Found Post-Proxy-Type Fail-Authentication (4) Post-Proxy-Type sub-section not found. Ignoring. (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 252 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (4) State = 0x02acfce1055f93a3ed31d5c1f8fbf030 (4) Finished request Waking up in 4.9 seconds. (4) Cleaning up request packet ID 252 with timestamp +88 Ready to process requests (5) Received Access-Request Id 253 from 10.10.10.10:57160 to 10.10.8.43:1812 length 180 (5) User-Name = "host/PC06820.example.com" (5) NAS-Identifier = "wifi" (5) Called-Station-Id = "00-1A-8C-2C-EB-42:DV" (5) NAS-Port-Type = Wireless-802.11 (5) NAS-Port = 1 (5) Calling-Station-Id = "20-68-9D-2E-7A-B3" (5) Connect-Info = "CONNECT 54Mbps 802.11g" (5) Framed-MTU = 1400 (5) EAP-Message = 0x02bc001c01686f73742f504330363832302e67702e7669656c2e6465 (5) Message-Authenticator = 0x985d1b8da13d12e831481a1c68b7bd4a (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (5) authorize { (5) if (NAS-Identifier == "wifi") { (5) if (NAS-Identifier == "wifi") -> TRUE (5) if (NAS-Identifier == "wifi") { (5) update control { (5) Proxy-To-Realm := "wifi-clients-realm" (5) } # update control = noop (5) } # if (NAS-Identifier == "wifi") = noop (5) if (NAS-Identifier == "l2tp") { (5) if (NAS-Identifier == "l2tp") -> FALSE (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = noop (5) } # policy filter_username = noop (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "host/PC06820.example.com", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Request is supposed to be proxied to Realm wifi-clients-realm. Not doing EAP. (5) [eap] = noop (5) [files] = noop (5) [expiration] = noop (5) [logintime] = noop (5) policy ntlm_auth.authorize { (5) if (!control:Auth-Type && User-Password) { (5) if (!control:Auth-Type && User-Password) -> FALSE (5) } # policy ntlm_auth.authorize = ok (5) } # authorize = ok (5) Starting proxy to home server (null) port 0 Proxying to virtual server wifi-clients (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/wifi-clients (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Request already has destination realm set. Ignoring (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 188 length 28 (5) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (5) authenticate { (5) eap: Peer sent packet with method EAP Identity (1) (5) eap: Calling submodule eap_md5 to process data (5) eap_md5: Issuing MD5 Challenge (5) eap: Sending EAP Request (code 1) ID 189 length 22 (5) eap: EAP session adding &reply:State = 0x4d7d96634dc09250 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/wifi-clients (5) Challenge { ... } # empty sub-section is ignored (5) Finished internally proxied request. (5) Clearing existing &reply: attributes (5) # Executing section post-proxy from file /etc/freeradius/3.0/sites-enabled/default (5) post-proxy { (5) eap: No pre-existing handler found (5) [eap] = noop (5) } # post-proxy = noop (5) Clearing existing &reply: attributes (5) Found Post-Proxy-Type Fail-Authentication (5) Post-Proxy-Type sub-section not found. Ignoring. (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 253 from 10.10.8.43:1812 to 10.10.10.10:57160 length 0 (5) State = 0x9af9b7683dae0ca97a5c4c6d28349ebf (5) Finished request Waking up in 4.9 seconds. (5) Cleaning up request packet ID 253 with timestamp +107 Ready to process requests

2 3

Reg: radwho giving empty output for user information with free radius version 2.2.10
by Ramesh 11 May '20

11 May '20

Hi All , Currently my free radius server is upgraded 2.1.6 to 2.2.10 . After upgrade I couldn't able to get user information by using radwho command Please suggest me if i am missing something /my search is wrong . with 2.1.6 version : ============== radwho -R -u user0.0000.6401.0103 User-Name = "user0.0000.6401.0103" Acct-Session-Id = "2" NAS-IP-Address = 121.0.0.1 with 2.2.10 version: ======================== radwho -F /usr/local/etc/raddb/modules/radutmp -R -u user0.0000.6401.0102 [root@bsd ~]# <EMPTY> Thanks, Venkat

2 1

Freeradius Database Threads
by Aurélio de Souza Ribeiro Neto 08 May '20

08 May '20

Hello all, I'm using FreeRadius 3.0.19 and MySQL 5.7 In my radiusd.conf I have this for threads: thread pool { start_servers = 10 max_servers = 64 min_spare_servers = 6 max_spare_servers = 20 max_queue_size = 131072 max_requests_per_server = 0 auto_limit_acct = yes } Mysql is set to 2000 connections. Sometimes Freeradius open 2000 connections in database. Any hint? Thanks

2 1

Vendor-Specific attribute with rlm_rest
by Michael A Carpenter - macarpen＠us.ibm.com 08 May '20

08 May '20

I'm trying to return the Vendor-Specific attribute with value "H=4,I=4" using the rlm_rest module. I've tried the following authorization response payloads: {"Attr-26": "0x483d342c493d34"} {"Vendor-Specific": "H=4,I=4"} Both resulted in error: (0) aaa-api: Processing response header (0) aaa-api: Status : 200 (OK) (0) aaa-api: Type : json (application/json) (0) aaa-api: Parsing attribute "Attr-26" (0) aaa-api: EXPAND 0x483d342c493d34 (0) aaa-api: --> 0x483d342c493d34 (0) aaa-api: WARNING: Incompatible value assignment for attribute "Vendor-Specific", skipping... (1) aaa-api: Processing response header (1) aaa-api: Status : 200 (OK) (1) aaa-api: Type : json (application/json) (1) aaa-api: Parsing attribute "Vendor-Specific" (1) aaa-api: EXPAND H=4,I=4 (1) aaa-api: --> H=4,I=4 (1) aaa-api: WARNING: Incompatible value assignment for attribute "Vendor-Specific", skipping... Any suggestions for what might be incompatible about the value? # radiusd -v radiusd: FreeRADIUS Version 3.0.20, for host x86_64-alpine-linux-musl, built on Apr 20 2020 at 16:30:06

4 14