- Freeradius-Users - lists.freeradius.org

rlm_perl chap-password
by Bassem Mettichi 12 Jan '18

12 Jan '18

Hello, could someone tell me how to impliment CHAP-Password authentication using rlm_perl? i would like to know how to impliment the authorize methode in rlm_perl to encrypt the cleartext-password with the CHAP-Challenge and see if it matches the CHAP-Password. Thanks in advance Mettichi B assem

1 0

Reply attributes from users file are being wiped
by Kennedy, Sean M 12 Jan '18

12 Jan '18

I am in the process of upgrading an OLD freeradius instance to version 3.0.16 and I am running into an issue where I am not seeing my extra reply attributes returned when the user is being proxied to another auth server. Here are some snippets from the debug... you can see the users file matches 2 sections and that is exactly the correct lines it should match on to append in my custom reply attributes. (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "xxx.net" for User-Name = "xxx(a)xxx.net" (1) suffix: Found realm "xxx.net" (1) suffix: Adding Realm = "xxx.net" (1) suffix: Proxying request from user xxx(a)xxx.net to realm xxx.net (1) suffix: Preparing to proxy authentication request to realm "xxx.net" (1) [suffix] = updated (1) eap: No EAP-Message, not doing EAP (1) [eap] = noop (1) files: EXPAND 216.126.204.* (1) files: --> 216.126.204.* (1) files: EXPAND 165.154.11.* (1) files: --> 165.154.11.* (1) files: EXPAND 209.244.* (1) files: --> 209.244.* (1) files: EXPAND 209.247.* (1) files: --> 209.247.* (1) files: EXPAND 209.253.* (1) files: --> 209.253.* (1) files: users: Matched entry DEFAULT at line 928 (1) files: users: Matched entry DEFAULT at line 940 The debug proceeds to send the request to the proxy: (1) Starting proxy to home server x.x.x.x port 1812 (1) Proxying request to home server x.x.x.x port 1812 timeout 30.000000 (1) Sent Access-Request Id 102 from 0.0.0.0:34505 to x.x.x.x:1812 length 116 (1) User-Name = "xxx(a)xxx.net" (1) User-Password = "xxx" (1) NAS-IP-Address = x.x.x.x (1) NAS-Port = 1 (1) Framed-Protocol = PPP (1) Service-Type = Framed-User (1) Event-Timestamp = "Jan 11 2018 20:08:34 MST" (1) Message-Authenticator := 0x00 (1) Proxy-State = 0x3838 It then wipes the reply attributes out: Waking up in 0.3 seconds. (1) Marking home server x.x.x.x port 1812 alive (1) Clearing existing &reply: attributes Why is this "Clearing existing &reply: attributes" happening? It seems that is my issue as the actual reply is missing my extra attributes that I defined in the "users" file. Thank you in advance, Sean

2 1

FilterID or Aruba-User-Role being returned for captive portal but not 802.1X authentication
by David Hendricks 11 Jan '18

11 Jan '18

I have a wireless lab with an Aruba 7005 Controller (ArubaOS 6.5.4.3), and now FreeRADIUS 3.0.15. Client authentication succeeds for both 802.1X and captive portal users. A rule at the controller that is supposed to assign user role based on returned Filter-Id works for the captive portal / guest users but not 802.1X users. Filter-Id = "labguest" but the assigned role is the 802.1X default, "authenticated". I posted the issue at https://stackoverflow.com/questions/47681051/server- derived-role-based-on-filterid-using-freeradius-not-working I simultaneously posted it on the Aruba Airheads blog at http://community. arubanetworks.com/t5/Security/Server-derived-rule-using- Filter-Id-from-FreeRADIUS-not-working/m-p/322046 With no resolution at either stackoverflow or Airheads, I opened an Aruba TAC case. After some troubleshooting, the Aruba engineer asks: "I would like to inform you that I went through the packet captures and I have attached the screenshots from the same based on what we observed; As seen in the CP-Accept screenshot, we see the Radius Accept, for when the user was authenticating with Captive Portal. We see in the accept packet, that the server is sending the attribute 'labguest' to the controller for the user role to be assigned. In the case of Dot1x-Accept screenshot, we do not see any attribute being sent by the server in the accept packet for when the user was authenticating with dot1x authentication. Please check on the server end if we need to enable sending attribute for MSCHAPv2 along with the PAP protocol, or if there are any specific configurations on the server that are handling the attributes to be sent based on the authentication type." users file entry: guest123 Cleartext-Password := guest123 Service-Type = Framed-User, Framed-Filter-Id = labguest # Aruba-User-Role = labguest freeradius -X >debug.txt (during 802.1X authentication) FreeRADIUS Version 3.0.15 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/date including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/preprocess including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/moonshot-targeted-ids including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 192.168.18.252/30 { require_message_authenticator = no secret = <<< secret >>> shortname = "controllers" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 192.168.18.252/30. Please fix your configuration Support for old-style clients will be removed in a future release Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_exec # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´Å“Ã¹Ã»Ã¼aÃ¿Ã„Ã‰Ã–ÃœÃŸÃ€Ã‚Ã†Ã‡ÃˆÃ‰ÃŠÃ‹ÃŽÃ Ã”Å’Ã™Ã›ÃœÅ¸" } # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } instantiate { } # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 52175 Listening on proxy address :: port 58823 Ready to process requests (0) Received Access-Request Id 25 from 192.168.18.254:34699 to 192.168.18.249:1812 length 175 (0) User-Name = "guest123" (0) NAS-IP-Address = 192.168.18.254 (0) NAS-Port = 0 (0) NAS-Identifier = "192.168.18.254" (0) NAS-Port-Type = Wireless-802.11 (0) Calling-Station-Id = "FCC2DE13D615" (0) Called-Station-Id = "000B86BE91F0" (0) Service-Type = Framed-User (0) Framed-MTU = 1100 (0) EAP-Message = 0x0201000d016775657374313233 (0) Aruba-Essid-Name = "Lab-Emp" (0) Aruba-Location-Id = "AP2" (0) Aruba-AP-Group = "Lab1" (0) Message-Authenticator = 0x925f4bb690888ecfb2ed0712e9dc2763 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "guest123", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 13 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 2 length 22 (0) eap: EAP session adding &reply:State = 0x2724385327263c5e (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 25 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (0) EAP-Message = 0x010200160410be92f80cde14421822c7aef9cddd92ad (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x2724385327263c5e98ac8b27aec7a2e9 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 26 from 192.168.18.254:34699 to 192.168.18.249:1812 length 186 (1) User-Name = "guest123" (1) NAS-IP-Address = 192.168.18.254 (1) NAS-Port = 0 (1) NAS-Identifier = "192.168.18.254" (1) NAS-Port-Type = Wireless-802.11 (1) Calling-Station-Id = "FCC2DE13D615" (1) Called-Station-Id = "000B86BE91F0" (1) Service-Type = Framed-User (1) Framed-MTU = 1100 (1) EAP-Message = 0x020200060319 (1) State = 0x2724385327263c5e98ac8b27aec7a2e9 (1) Aruba-Essid-Name = "Lab-Emp" (1) Aruba-Location-Id = "AP2" (1) Aruba-AP-Group = "Lab1" (1) Message-Authenticator = 0x4811f18d2df2e85e6331dc9706d6339a (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "guest123", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 2 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files: users: Matched entry guest123 at line 83 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x2724385327263c5e (1) eap: Finished EAP session with state 0x2724385327263c5e (1) eap: Previous EAP request found for state 0x2724385327263c5e, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Initiating new EAP-TLS session (1) eap_peap: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 3 length 6 (1) eap: EAP session adding &reply:State = 0x272438532627215e (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 26 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (1) Service-Type = Framed-User (1) Framed-Filter-Id = "labguest" (1) EAP-Message = 0x010300061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x272438532627215e98ac8b27aec7a2e9 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 27 from 192.168.18.254:34699 to 192.168.18.249:1812 length 348 (2) User-Name = "guest123" (2) NAS-IP-Address = 192.168.18.254 (2) NAS-Port = 0 (2) NAS-Identifier = "192.168.18.254" (2) NAS-Port-Type = Wireless-802.11 (2) Calling-Station-Id = "FCC2DE13D615" (2) Called-Station-Id = "000B86BE91F0" (2) Service-Type = Framed-User (2) Framed-MTU = 1100 (2) EAP-Message = 0x020300a819800000009e160301009901000095030351420a701c69b71e022bfefca1f2db978fea3b282c885e1fe769c98633b61bf200003cc02cc030009fc02bc02f009ec00ac024c014c0280039006bc009c023c013c02700330067c007c011009d009c0035003d002f003c00050004000a00ff010000 (2) State = 0x272438532627215e98ac8b27aec7a2e9 (2) Aruba-Essid-Name = "Lab-Emp" (2) Aruba-Location-Id = "AP2" (2) Aruba-AP-Group = "Lab1" (2) Message-Authenticator = 0x4de1e143ed6f87e69dd173b1b6b9badf (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "guest123", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 168 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x272438532627215e (2) eap: Finished EAP session with state 0x272438532627215e (2) eap: Previous EAP request found for state 0x272438532627215e, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 158 bytes (2) eap_peap: Got complete TLS record (158 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before/accept initialization (2) eap_peap: TLS_accept: before/accept initialization (2) eap_peap: <<< recv TLS 1.2 [length 0099] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 0039] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 08d3] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 014d] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: unknown state (2) eap_peap: TLS_accept: unknown state (2) eap_peap: TLS_accept: unknown state (2) eap_peap: TLS_accept: Need to read more data: unknown state (2) eap_peap: TLS_accept: Need to read more data: unknown state (2) eap_peap: In SSL Handshake Phase (2) eap_peap: In SSL Accept mode (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 1004 (2) eap: EAP session adding &reply:State = 0x272438532520215e (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 27 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (2) EAP-Message = 0x010403ec19c000000a7116030300390200003503038b8c255d818236f426c1840ad18a511f5766971605f11426679da99674863f3900c03000000dff01000100000b00040300010216030308d30b0008cf0008cc0003de308203da308202c2a003020102020101300d06092a864886f70d01010b050030 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x272438532520215e98ac8b27aec7a2e9 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 28 from 192.168.18.254:34699 to 192.168.18.249:1812 length 186 (3) User-Name = "guest123" (3) NAS-IP-Address = 192.168.18.254 (3) NAS-Port = 0 (3) NAS-Identifier = "192.168.18.254" (3) NAS-Port-Type = Wireless-802.11 (3) Calling-Station-Id = "FCC2DE13D615" (3) Called-Station-Id = "000B86BE91F0" (3) Service-Type = Framed-User (3) Framed-MTU = 1100 (3) EAP-Message = 0x020400061900 (3) State = 0x272438532520215e98ac8b27aec7a2e9 (3) Aruba-Essid-Name = "Lab-Emp" (3) Aruba-Location-Id = "AP2" (3) Aruba-AP-Group = "Lab1" (3) Message-Authenticator = 0x2599264e8586db5dae34da0eaef3289e (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "guest123", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 4 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x272438532520215e (3) eap: Finished EAP session with state 0x272438532520215e (3) eap: Previous EAP request found for state 0x272438532520215e, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 5 length 1000 (3) eap: EAP session adding &reply:State = 0x272438532421215e (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 28 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (3) EAP-Message = 0x010503e81940b3464a51b48237f903c224328639e85e5b770170059dee2e5f6262ea8eaa176d0b7375178b2fc5e2982d52109a1d28afa041936bbde97f01eb488c556c3ad793a3c05c4ce03ec60a250004e8308204e4308203cca003020102020900ba4d5f67b91400f4300d06092a864886f70d01010b (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x272438532421215e98ac8b27aec7a2e9 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 29 from 192.168.18.254:34699 to 192.168.18.249:1812 length 186 (4) User-Name = "guest123" (4) NAS-IP-Address = 192.168.18.254 (4) NAS-Port = 0 (4) NAS-Identifier = "192.168.18.254" (4) NAS-Port-Type = Wireless-802.11 (4) Calling-Station-Id = "FCC2DE13D615" (4) Called-Station-Id = "000B86BE91F0" (4) Service-Type = Framed-User (4) Framed-MTU = 1100 (4) EAP-Message = 0x020500061900 (4) State = 0x272438532421215e98ac8b27aec7a2e9 (4) Aruba-Essid-Name = "Lab-Emp" (4) Aruba-Location-Id = "AP2" (4) Aruba-AP-Group = "Lab1" (4) Message-Authenticator = 0x2a5dee3c82daff22fa3784aaa42efdeb (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "guest123", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 5 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x272438532421215e (4) eap: Finished EAP session with state 0x272438532421215e (4) eap: Previous EAP request found for state 0x272438532421215e, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer ACKed our handshake fragment (4) eap_peap: [eaptls verify] = request (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 6 length 691 (4) eap: EAP session adding &reply:State = 0x272438532322215e (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 29 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (4) EAP-Message = 0x010602b319000530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b0500038201010014ce6047b11dc0496a6a34b1f3816e18cd01ac2674bcff0a863e13c4e9cbfc (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x272438532322215e98ac8b27aec7a2e9 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 30 from 192.168.18.254:34699 to 192.168.18.249:1812 length 316 (5) User-Name = "guest123" (5) NAS-IP-Address = 192.168.18.254 (5) NAS-Port = 0 (5) NAS-Identifier = "192.168.18.254" (5) NAS-Port-Type = Wireless-802.11 (5) Calling-Station-Id = "FCC2DE13D615" (5) Called-Station-Id = "000B86BE91F0" (5) Service-Type = Framed-User (5) Framed-MTU = 1100 (5) EAP-Message = 0x0206008819800000007e1603030046100000424104d0f9e8adeef83edd7b632876ad923ec186ae8b1e859ea4fa359dbd35de9642ba0f559498b3eddc2447904549bb594a13b88840d09e87251b5f80643854a7e2b614030300010116030300280000000000000000557431360d5361ce5e15b5371e31dd (5) State = 0x272438532322215e98ac8b27aec7a2e9 (5) Aruba-Essid-Name = "Lab-Emp" (5) Aruba-Location-Id = "AP2" (5) Aruba-AP-Group = "Lab1" (5) Message-Authenticator = 0x3564ee1b45184fc438f8f3bdf1b1fe1b (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "guest123", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 6 length 136 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x272438532322215e (5) eap: Finished EAP session with state 0x272438532322215e (5) eap: Previous EAP request found for state 0x272438532322215e, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer indicated complete TLS record size will be 126 bytes (5) eap_peap: Got complete TLS record (126 bytes) (5) eap_peap: [eaptls verify] = length included (5) eap_peap: <<< recv TLS 1.2 [length 0046] (5) eap_peap: TLS_accept: unknown state (5) eap_peap: TLS_accept: unknown state (5) eap_peap: <<< recv TLS 1.2 [length 0001] (5) eap_peap: <<< recv TLS 1.2 [length 0010] (5) eap_peap: TLS_accept: unknown state (5) eap_peap: >>> send TLS 1.2 [length 0001] (5) eap_peap: TLS_accept: unknown state (5) eap_peap: >>> send TLS 1.2 [length 0010] (5) eap_peap: TLS_accept: unknown state (5) eap_peap: TLS_accept: unknown state (5) eap_peap: (other): SSL negotiation finished successfully (5) eap_peap: SSL Connection Established (5) eap_peap: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 7 length 57 (5) eap: EAP session adding &reply:State = 0x272438532223215e (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 30 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (5) EAP-Message = 0x01070039190014030300010116030300289018523e94e9668064012fd528ca23ff74f19d11f0b81931e73f8f8196da044df416429f9ba7df00 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x272438532223215e98ac8b27aec7a2e9 (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 31 from 192.168.18.254:34699 to 192.168.18.249:1812 length 186 (6) User-Name = "guest123" (6) NAS-IP-Address = 192.168.18.254 (6) NAS-Port = 0 (6) NAS-Identifier = "192.168.18.254" (6) NAS-Port-Type = Wireless-802.11 (6) Calling-Station-Id = "FCC2DE13D615" (6) Called-Station-Id = "000B86BE91F0" (6) Service-Type = Framed-User (6) Framed-MTU = 1100 (6) EAP-Message = 0x020700061900 (6) State = 0x272438532223215e98ac8b27aec7a2e9 (6) Aruba-Essid-Name = "Lab-Emp" (6) Aruba-Location-Id = "AP2" (6) Aruba-AP-Group = "Lab1" (6) Message-Authenticator = 0x2d3960cecca5ad8f5711842e056644a8 (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/sites-enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /(a)\./) { (6) if (&User-Name =~ /(a)\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "guest123", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 6 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x272438532223215e (6) eap: Finished EAP session with state 0x272438532223215e (6) eap: Previous EAP request found for state 0x272438532223215e, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer ACKed our handshake fragment. handshake is finished (6) eap_peap: [eaptls verify] = success (6) eap_peap: [eaptls process] = success (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state TUNNEL ESTABLISHED (6) eap: Sending EAP Request (code 1) ID 8 length 40 (6) eap: EAP session adding &reply:State = 0x27243853212c215e (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/sites-enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 31 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (6) EAP-Message = 0x010800281900170303001d9018523e94e96681f327f9aab624fdd3fb220a996352a11c1c8bd3f09a (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x27243853212c215e98ac8b27aec7a2e9 (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 32 from 192.168.18.254:34699 to 192.168.18.249:1812 length 224 (7) User-Name = "guest123" (7) NAS-IP-Address = 192.168.18.254 (7) NAS-Port = 0 (7) NAS-Identifier = "192.168.18.254" (7) NAS-Port-Type = Wireless-802.11 (7) Calling-Station-Id = "FCC2DE13D615" (7) Called-Station-Id = "000B86BE91F0" (7) Service-Type = Framed-User (7) Framed-MTU = 1100 (7) EAP-Message = 0x0208002c190017030300210000000000000001baa0f292af6e46b9011ba57555d82552a599aa231fe0567668 (7) State = 0x27243853212c215e98ac8b27aec7a2e9 (7) Aruba-Essid-Name = "Lab-Emp" (7) Aruba-Location-Id = "AP2" (7) Aruba-AP-Group = "Lab1" (7) Message-Authenticator = 0x140fe08d897ef464a081fd62b9e1558a (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/sites-enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "guest123", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 8 length 44 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x27243853212c215e (7) eap: Finished EAP session with state 0x27243853212c215e (7) eap: Previous EAP request found for state 0x27243853212c215e, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - guest123 (7) eap_peap: Got inner identity 'guest123' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x0208000d016775657374313233 (7) eap_peap: Setting User-Name to guest123 (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x0208000d016775657374313233 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "guest123" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x0208000d016775657374313233 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "guest123" (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel { (7) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /(a)\./) { (7) if (&User-Name =~ /(a)\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "guest123", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 8 length 13 (7) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (7) authenticate { (7) eap: Peer sent packet with method EAP Identity (1) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: Issuing Challenge (7) eap: Sending EAP Request (code 1) ID 9 length 43 (7) eap: EAP session adding &reply:State = 0x7e55fae97e5ce062 (7) [eap] = handled (7) } # authenticate = handled (7) } # server inner-tunnel (7) Virtual server sending reply (7) EAP-Message = 0x0109002b1a010900261097922be676e49f82a77191d1f81936fd667265657261646975732d332e302e3135 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x7e55fae97e5ce062953a46e59f6aca5d (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x0109002b1a010900261097922be676e49f82a77191d1f81936fd667265657261646975732d332e302e3135 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x7e55fae97e5ce062953a46e59f6aca5d (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x0109002b1a010900261097922be676e49f82a77191d1f81936fd667265657261646975732d332e302e3135 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x7e55fae97e5ce062953a46e59f6aca5d (7) eap_peap: Got tunneled Access-Challenge (7) eap: Sending EAP Request (code 1) ID 9 length 74 (7) eap: EAP session adding &reply:State = 0x27243853202d215e (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/sites-enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) Sent Access-Challenge Id 32 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (7) EAP-Message = 0x0109004a1900170303003f9018523e94e96682367ce8727a8a9e14ec67e81247024d824abd55a3221de0086eb247f7b416ddbd8ed22a6f89317e7c4d61b0683d1b443f5fbd77b63489e1 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x27243853202d215e98ac8b27aec7a2e9 (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 33 from 192.168.18.254:34699 to 192.168.18.249:1812 length 278 (8) User-Name = "guest123" (8) NAS-IP-Address = 192.168.18.254 (8) NAS-Port = 0 (8) NAS-Identifier = "192.168.18.254" (8) NAS-Port-Type = Wireless-802.11 (8) Calling-Station-Id = "FCC2DE13D615" (8) Called-Station-Id = "000B86BE91F0" (8) Service-Type = Framed-User (8) Framed-MTU = 1100 (8) EAP-Message = 0x020900621900170303005700000000000000025b07e90041ca58d369208d24becfafc781f48ac97a8d3bcf6af4da664b59c3089af6f9bf7e3a4fe2958ddeddcd36ecf109b4e876af1bc4ed0413a81043dea336a6dfdbc1f082c226aa82674d7f2760 (8) State = 0x27243853202d215e98ac8b27aec7a2e9 (8) Aruba-Essid-Name = "Lab-Emp" (8) Aruba-Location-Id = "AP2" (8) Aruba-AP-Group = "Lab1" (8) Message-Authenticator = 0x1494d4f4e6f96b9d38954a5858f21942 (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/sites-enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "guest123", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 9 length 98 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/sites-enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x7e55fae97e5ce062 (8) eap: Finished EAP session with state 0x27243853202d215e (8) eap: Previous EAP request found for state 0x27243853202d215e, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x020900431a0209003e31a6e58c71825a239eba1d236b87edfbaf0000000000000000a490586c52df19fb3daed0ff3c660c65f4a0e42deda644e4006775657374313233 (8) eap_peap: Setting User-Name to guest123 (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x020900431a0209003e31a6e58c71825a239eba1d236b87edfbaf0000000000000000a490586c52df19fb3daed0ff3c660c65f4a0e42deda644e4006775657374313233 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "guest123" (8) eap_peap: State = 0x7e55fae97e5ce062953a46e59f6aca5d (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x020900431a0209003e31a6e58c71825a239eba1d236b87edfbaf0000000000000000a490586c52df19fb3daed0ff3c660c65f4a0e42deda644e4006775657374313233 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "guest123" (8) State = 0x7e55fae97e5ce062953a46e59f6aca5d (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /(a)\./) { (8) if (&User-Name =~ /(a)\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "guest123", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 9 length 67 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) files: users: Matched entry guest123 at line 83 (8) [files] = ok (8) [expiration] = noop (8) [logintime] = noop (8) pap: WARNING: Auth-Type already set. Not setting to PAP (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0x7e55fae97e5ce062 (8) eap: Finished EAP session with state 0x7e55fae97e5ce062 (8) eap: Previous EAP request found for state 0x7e55fae97e5ce062, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Found Cleartext-Password, hashing to create NT-Password (8) mschap: Found Cleartext-Password, hashing to create LM-Password (8) mschap: Creating challenge hash with username: guest123 (8) mschap: Client is using MS-CHAPv2 (8) mschap: Adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # authenticate = ok (8) MSCHAP Success (8) eap: Sending EAP Request (code 1) ID 10 length 51 (8) eap: EAP session adding &reply:State = 0x7e55fae97f5fe062 (8) [eap] = handled (8) } # authenticate = handled (8) } # server inner-tunnel (8) Virtual server sending reply (8) Service-Type = Framed-User (8) Framed-Filter-Id = "labguest" (8) EAP-Message = 0x010a00331a0309002e533d35333438383739343943363842353730453536434335453930373133303941383631384133353138 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x7e55fae97f5fe062953a46e59f6aca5d (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: Service-Type = Framed-User (8) eap_peap: Framed-Filter-Id = "labguest" (8) eap_peap: EAP-Message = 0x010a00331a0309002e533d35333438383739343943363842353730453536434335453930373133303941383631384133353138 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x7e55fae97f5fe062953a46e59f6aca5d (8) eap_peap: Got tunneled reply RADIUS code 11 (8) eap_peap: Service-Type = Framed-User (8) eap_peap: Framed-Filter-Id = "labguest" (8) eap_peap: EAP-Message = 0x010a00331a0309002e533d35333438383739343943363842353730453536434335453930373133303941383631384133353138 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x7e55fae97f5fe062953a46e59f6aca5d (8) eap_peap: Got tunneled Access-Challenge (8) eap: Sending EAP Request (code 1) ID 10 length 82 (8) eap: EAP session adding &reply:State = 0x272438532f2e215e (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /etc/freeradius/sites-enabled/default (8) Challenge { ... } # empty sub-section is ignored (8) Sent Access-Challenge Id 33 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (8) EAP-Message = 0x010a0052190017030300479018523e94e96683003a64f8c2fc607231faab888b7914d28511b61349fdf799e48fb5275a8279c3dad0dbfa972e89b71d70dd3b5f7f88fdabb45c2f7ed0eb35ff5458b62be6f3 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x272438532f2e215e98ac8b27aec7a2e9 (8) Finished request Waking up in 4.9 seconds. (9) Received Access-Request Id 34 from 192.168.18.254:34699 to 192.168.18.249:1812 length 217 (9) User-Name = "guest123" (9) NAS-IP-Address = 192.168.18.254 (9) NAS-Port = 0 (9) NAS-Identifier = "192.168.18.254" (9) NAS-Port-Type = Wireless-802.11 (9) Calling-Station-Id = "FCC2DE13D615" (9) Called-Station-Id = "000B86BE91F0" (9) Service-Type = Framed-User (9) Framed-MTU = 1100 (9) EAP-Message = 0x020a00251900170303001a00000000000000031a0db7fef0d6affebf275ef50f7c34ccbe4e (9) State = 0x272438532f2e215e98ac8b27aec7a2e9 (9) Aruba-Essid-Name = "Lab-Emp" (9) Aruba-Location-Id = "AP2" (9) Aruba-AP-Group = "Lab1" (9) Message-Authenticator = 0x2b3cc1b5e21a1cb3d3ccf39d0da2f8c1 (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/sites-enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "guest123", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 10 length 37 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/sites-enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x7e55fae97f5fe062 (9) eap: Finished EAP session with state 0x272438532f2e215e (9) eap: Previous EAP request found for state 0x272438532f2e215e, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x020a00061a03 (9) eap_peap: Setting User-Name to guest123 (9) eap_peap: Sending tunneled request to inner-tunnel (9) eap_peap: EAP-Message = 0x020a00061a03 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "guest123" (9) eap_peap: State = 0x7e55fae97f5fe062953a46e59f6aca5d (9) Virtual server inner-tunnel received request (9) EAP-Message = 0x020a00061a03 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "guest123" (9) State = 0x7e55fae97f5fe062953a46e59f6aca5d (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /(a)\./) { (9) if (&User-Name =~ /(a)\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "guest123", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) update control { (9) &Proxy-To-Realm := LOCAL (9) } # update control = noop (9) eap: Peer sent EAP Response (code 2) ID 10 length 6 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) files: users: Matched entry guest123 at line 83 (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) pap: WARNING: Auth-Type already set. Not setting to PAP (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x7e55fae97f5fe062 (9) eap: Finished EAP session with state 0x7e55fae97f5fe062 (9) eap: Previous EAP request found for state 0x7e55fae97f5fe062, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap: Sending EAP Success (code 3) ID 10 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel (9) post-auth { (9) if (0) { (9) if (0) -> FALSE (9) } # post-auth = noop (9) } # server inner-tunnel (9) Virtual server sending reply (9) Service-Type = Framed-User (9) Framed-Filter-Id = "labguest" (9) MS-MPPE-Encryption-Policy = Encryption-Allowed (9) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) MS-MPPE-Send-Key = 0x6b660abc849dd06d02c8666fb1df94e9 (9) MS-MPPE-Recv-Key = 0x7fc0b21fdd0d434e44d71e1ecffa48d0 (9) EAP-Message = 0x030a0004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "guest123" (9) eap_peap: Got tunneled reply code 2 (9) eap_peap: Service-Type = Framed-User (9) eap_peap: Framed-Filter-Id = "labguest" (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x6b660abc849dd06d02c8666fb1df94e9 (9) eap_peap: MS-MPPE-Recv-Key = 0x7fc0b21fdd0d434e44d71e1ecffa48d0 (9) eap_peap: EAP-Message = 0x030a0004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "guest123" (9) eap_peap: Got tunneled reply RADIUS code 2 (9) eap_peap: Service-Type = Framed-User (9) eap_peap: Framed-Filter-Id = "labguest" (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x6b660abc849dd06d02c8666fb1df94e9 (9) eap_peap: MS-MPPE-Recv-Key = 0x7fc0b21fdd0d434e44d71e1ecffa48d0 (9) eap_peap: EAP-Message = 0x030a0004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "guest123" (9) eap_peap: Tunneled authentication was successful (9) eap_peap: SUCCESS (9) eap: Sending EAP Request (code 1) ID 11 length 46 (9) eap: EAP session adding &reply:State = 0x272438532e2f215e (9) [eap] = handled (9) } # authenticate = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /etc/freeradius/sites-enabled/default (9) Challenge { ... } # empty sub-section is ignored (9) Sent Access-Challenge Id 34 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (9) EAP-Message = 0x010b002e190017030300239018523e94e96684fda2acd46fa344dfb4bd6e9dc2819017927fe688abfe208a8d651f (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x272438532e2f215e98ac8b27aec7a2e9 (9) Finished request Waking up in 4.9 seconds. (10) Received Access-Request Id 35 from 192.168.18.254:34699 to 192.168.18.249:1812 length 226 (10) User-Name = "guest123" (10) NAS-IP-Address = 192.168.18.254 (10) NAS-Port = 0 (10) NAS-Identifier = "192.168.18.254" (10) NAS-Port-Type = Wireless-802.11 (10) Calling-Station-Id = "FCC2DE13D615" (10) Called-Station-Id = "000B86BE91F0" (10) Service-Type = Framed-User (10) Framed-MTU = 1100 (10) EAP-Message = 0x020b002e190017030300230000000000000004f146d1ea0f8955fd7d856784ab41de9850863bcbb43418d874af5a (10) State = 0x272438532e2f215e98ac8b27aec7a2e9 (10) Aruba-Essid-Name = "Lab-Emp" (10) Aruba-Location-Id = "AP2" (10) Aruba-AP-Group = "Lab1" (10) Message-Authenticator = 0xc84dc673770cea5197b5288dd7635f1a (10) session-state: No cached attributes (10) # Executing section authorize from file /etc/freeradius/sites-enabled/default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /(a)\./) { (10) if (&User-Name =~ /(a)\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "guest123", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent EAP Response (code 2) ID 11 length 46 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /etc/freeradius/sites-enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0x272438532e2f215e (10) eap: Finished EAP session with state 0x272438532e2f215e (10) eap: Previous EAP request found for state 0x272438532e2f215e, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: Continuing EAP-TLS (10) eap_peap: [eaptls verify] = ok (10) eap_peap: Done initial handshake (10) eap_peap: [eaptls process] = ok (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv success (10) eap_peap: Received EAP-TLV response (10) eap_peap: Success (10) eap: Sending EAP Success (code 3) ID 11 length 4 (10) eap: Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (10) post-auth { (10) update { (10) No attributes updated (10) } # update = noop (10) [exec] = noop (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) } # post-auth = noop (10) Sent Access-Accept Id 35 from 192.168.18.249:1812 to 192.168.18.254:34699 length 0 (10) MS-MPPE-Recv-Key = 0x1898fd2108c78f60fdd3ebc6e998001935e960f785b5fcb3c1765ba0329c8b90 (10) MS-MPPE-Send-Key = 0xb027c9455d30fd20e58e1db39bea514d5b5deee855e215b8485be483be3060da (10) EAP-Message = 0x030b0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "guest123" (10) Finished request Waking up in 4.8 seconds. (0) Cleaning up request packet ID 25 with timestamp +22 (1) Cleaning up request packet ID 26 with timestamp +22 (2) Cleaning up request packet ID 27 with timestamp +22 (3) Cleaning up request packet ID 28 with timestamp +22 (4) Cleaning up request packet ID 29 with timestamp +22 (5) Cleaning up request packet ID 30 with timestamp +22 (6) Cleaning up request packet ID 31 with timestamp +22 (7) Cleaning up request packet ID 32 with timestamp +22 (8) Cleaning up request packet ID 33 with timestamp +22 (9) Cleaning up request packet ID 34 with timestamp +22 (10) Cleaning up request packet ID 35 with timestamp +22 Ready to process requests

2 3

LDAP operations error
by Tom King 11 Jan '18

11 Jan '18

I am sure this question has been asked many times over, so please point me to a thread if it's already answered. We are connected to an AD-backed LDAP service. I've configured these two options in the ldap module config: Chase_referrals=yes Rebind=yes LDAP authentication is fine for about 10 minutes. After a while, freeradius LDAP authentication begins failing: rad_recv: Access-Request packet from host 10.144.15.2 port 52361, id=92, length=98 User-Name = "redacted-user" User-Password = "redacted-password" NAS-Port-Id = "ssh" Calling-Station-Id = "redacted-fqdn" Service-Type = NAS-Prompt-User NAS-Port = 0 NAS-IP-Address = 10.144.15.2 # Executing section authorize from file /etc/freeradius/radiusd.conf +group authorize { ++[preprocess] = ok [ldap] performing user authorization for redacted-user [ldap] expand: (SamAccountName=%u) -> (SamAccountName=redacted-user) [ldap] expand: dc=redacted,dc=redacted,dc=com -> dc=redacted,dc=redacted,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] closing existing LDAP connection [ldap] (re)connect to ldaps://redacted-ldaps-server-url, authentication 0 [ldap] setting TLS Require Cert to never [ldap] bind as _binduser/bindpassword to ldaps://redacted-ldaps-server-url [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=redacted,dc=Redacted,dc=com, with filter (SamAccountName=redacted-user) WARNING: Please set 'chase_referrals=yes' and 'rebind=yes' WARNING: See the ldap module configuration for details [ldap] ldap_search() failed: Operations error [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = fail +} # group authorize = fail Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.4 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 92 to 10.144.15.2 port 52361 Waking up in 4.9 seconds. Cleaning up request 4 ID 92 with timestamp +2501 Ready to process requests. It works fine for a while - what causes it to fail after a while? Does having a loadbalancer in front of the LDAP server make a difference? Thanks! [https://cdn.f5.com/webcommon/email-signature/images/f5-logo-rgb-30x30.jpg]<https://f5.com/> Thomas King | Sr Lab Network Engineer D +1-303-305-0228 M +1-206-384-0698 [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-twitter.jpg]<https://twitter.com/F5Networks/> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-linkedin.jpg]<https://www.linkedin.com/companies/f5-networks> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-facebook.jpg]<https://www.facebook.com/f5networksinc> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-youtube.jpg]<https://www.youtube.com/f5networksinc> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-devcentral.jpg]<https://devcentral.f5.com/> [https://cdn.f5.com/webcommon/email-signature/images/f5-sig-wmag-lockup.jpg]<https://f5.com/we-make-apps-go?utm_source=WMAGSIG/>

2 3

ippool excluded IP addresses
by Artur Jaroschek 10 Jan '18

10 Jan '18

We are using freeradius version (debian) 2.1.12+dfsg-1.2 (we will consider to upgrade to min. 2.2.10 soon) We want to manage the IP pool for our ipsec client on radius side. For this I have set start-ip: 10.150.0.0 end-ip: 10.150.255.255 netmask: 255.255.255.0 Will this automatically exclude all IPs ending with .0 and .255??? e.g.: 10.150.0.0 10.150.0.255 10.150.1.0 10.150.1.255 . . . 10.150.255.0 10.150.255.255 Thank you.

5 6

Re: IPSec client is alternating between two IP addresses
by Artur Jaroschek 10 Jan '18

10 Jan '18

> > > > > We are using freeradius version (debian) 2.1.12+dfsg-1.2 > > You really need to upgrade to 2.2.10. You don't have to change > anything in your configuration. > > > to manage an > > ip-pool for an ipsec vpn gateway. The gateway does xauth to the > > radius > > server for authentication and IP assignment as well as accounting > > to > > e.g. clean up the IP address. Upon re-keying the user gets a new IP > > address (which is the same as the second to last one), so its > > basically > > alternating between two IP addresses. We are using the ippool- > > module > > (not SQL) and I already found the notes on the key-parameter. Its > > currently set to "%{NAS-IP-Address} %{User-Name}" which is unique > > for > > each dailed in client. Before we configured accounting on the vpn > > gateway the reason for the alternating IPs was quite obvious to me > > (from looking at the module code: "Found a stale entry for ip") but > > with accounting properly configured I can't find a reason why its > > still > > the same: > > If the IP is still active, AND the query uses the same IP, then it > should be renewed. Even when I manually disconnect my VPN client (causing a deallocation message on freeradius-server side), and reconnect again (after a while) I will get the "other" IP. Is this inteded? What must our VPN client send while re-keying to not cause freeradius to swap the IP but to just "renew" it? BTW does "renew" mean it just updates some meta-date in the DB? > > But... 2.1.12 is 6 years old. You should really upgrade. And take > a serious look at v3, too. > > > Now with accounting its looking like this upon re-keying: > > > > Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] > > #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 > > Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] > > MD5 > > on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 > > Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] > > Searching for an entry for key: '1.1.1.2 C023A0667' > > Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] > > Deallocated entry for ip: 10.151.222.215 > > In 2.2.10, it only prints "Deallocated entry" when the NAS sends an > accounting STOP. i.e. when the session is closed. > > Running the server in debugging mode will tell you what's going > on... The submitted logs were captured while running the server with "-xx" > > But if the NAS sends a STOP before renewing the IP, well, that > explains everything. The original session is gone, so a new lease is > allocated. When the old session is gone, why not handing out the same IP again for the new session, as long its the same requester, e.g. 4d7b2dcc10b9fa1a049fc4d1d05170c0 in my example? > > Alan DeKok. > Thank you very much for your response.

4 5

Looking for an up-to-date client library
by Scott Neugroschl 09 Jan '18

09 Jan '18

Hi, I'm looking for a client library that supports the latest RADIUS spec. All I can find seems to be the FreeRADIUS client 1.1.8, which is very old and doesn't fully support IPv6, TCP, or encryption. Can anyone give me a pointer? Thanks, ScottN --- Scott Neugroschl | XYPRO Technology Corporation 4100 Guardian Street | Suite 100 |Simi Valley, CA 93063 | Phone 805 583-2874|Fax 805 583-0124 |

1 0

CoA Over TLS (radsec) Support
by Yusuf Güngör 09 Jan '18

09 Jan '18

Hi, Radius clients who are behind NAT can successfully initiate traffic to radius server over freeradius proxy. Can radius server initiate traffic for CoA requests to clients which are behind NAT over freeradius (via already established TLS connection with the clients) ? Does freeradius support CoA-Requests over tls? (RFC 3576 - RFC 5176) I have found a similar question which sent to mail list at 2014. ( http://lists.freeradius.org/pipermail/freeradius-users/2014-June/072715.html ) Can i learn if it is not supported still? Thanks for replies.

2 3

rlm_couchbase skipping attribute with no map entry
by Mike Lopes 08 Jan '18

08 Jan '18

Hi, I am trying to set up a new freeradius server (v3.0.15) so that it will send directly to a couchbase server instead of my current old radius server setup that is sending accounting via a radius-proxy server. Any help would be appreciated in trying to figure this out. I have enabled the following environment settings: LCB_OPTIONS="detailed_errcodes=1" && export LCB_OPTIONS LCB_CNTL_DETAILED_ERRCODES=1 && export LCB_CNTL_DETAILED_ERRCODES LCB_LOGLEVEL=5 && export LCB_LOGLEVEL Here is the trimmed output from radius -X: (0) Received Accounting-Request Id 65 from 127.0.0.1:55005 to 127.0.0.1:1813 length 715 (0) User-Name = "noneexistent123(a)domain.com" (0) Acct-Status-Type = Interim-Update (0) Acct-Session-Id = "25466609" (0) Acct-Input-Octets = 211016095 (0) Acct-Output-Octets = 3081069646 (0) Acct-Session-Time = 2047177 (0) Acct-Input-Packets = 179269685 (0) Acct-Output-Packets = 322301129 (0) Service-Type = Framed-User (0) Framed-Protocol = PPP (0) Filter-Id = "IPV4-ingress:dsl-default-in-si-1/1/0.1073813193-in" (0) Filter-Id = "IPV4-egress:dsl-default-out-si-1/1/0.1073813193-out" (0) Attr-26.4874.177 = 0x506f72742053706565643a2031303030303030306b (0) Tunnel-Type:0 = L2TP (0) Tunnel-Medium-Type:0 = IPv4 (0) Tunnel-Client-Endpoint:0 = "192.168.242.189" (0) Tunnel-Server-Endpoint:0 = "192.168.80.106" (0) Tunnel-Assignment-Id:0 = "57524" (0) Tunnel-Client-Auth-Id:0 = "AR09" (0) Tunnel-Server-Auth-Id:0 = "company" (0) Acct-Tunnel-Connection = "0002758216" (0) Acct-Authentic = RADIUS (0) Acct-Delay-Time = 0 (0) Calling-Station-Id = "GigabitEthernet 1/0.12502026:1250-2026#587204111###pppoe 4c:9e:ff:27:41:4c#" (0) ERX-Dhcp-Mac-Addr = "0000.0000.0000" (0) Event-Timestamp = "Dec 12 2017 11:35:30 EST" (0) Framed-IP-Address = 192.168.225.42 (0) Framed-IP-Netmask = 255.255.254.0 (0) ERX-Input-Gigapkts = 0 (0) Acct-Input-Gigawords = 4 (0) NAS-Identifier = "lns01" (0) NAS-Port = 268439551 (0) NAS-Port-Id = "Ip:192.168.80.106:192.168.242.189:57524:10046:22601:33289:2758216" (0) NAS-Port-Type = Virtual (0) ERX-Output-Gigapkts = 0 (0) Acct-Output-Gigawords = 103 (0) ERX-IPv6-Acct-Input-Octets = 0 (0) ERX-IPv6-Acct-Output-Octets = 0 (0) ERX-IPv6-Acct-Input-Packets = 0 (0) ERX-IPv6-Acct-Output-Packets = 0 (0) ERX-IPv6-Acct-Input-Gigawords = 0 (0) ERX-IPv6-Acct-Output-Gigawords = 0 (0) ERX-Tx-Connect-Speed = 13277755 (0) Attr-26.4874.163 = 0x000000 (0) ERX-Pppoe-Description = "pppoe 00:00:00:00:00:00" (0) NAS-IP-Address = 192.168.191.4 (0) # Executing section preacct from file /etc/raddb/sites-enabled/company (0) preacct { (0) policy username_lower_domain { (0) update request { (0) EXPAND %{tolower:%{User-Name}} (0) --> noneexistent123(a)company.com (0) Stripped-User-Name := noneexistent123(a)company.com (0) } # update request = noop (0) if (User-Name =~ /^([^@]*)(@([-[:alnum:]]+\\.[-[:alnum:].]+))?$/){ (0) if (User-Name =~ /^([^@]*)(@([-[:alnum:]]+\\.[-[:alnum:].]+))?$/) -> FALSE (0) else { (0) [noop] = noop (0) } # else = noop (0) } # policy username_lower_domain = noop (0) policy acct_counters64_preacct { (0) update request { (0) EXPAND %{expr:(%{%{Acct-Input-Gigawords}:-0} * 4294967296) + %{%{Acct-Input-Octets}:-0}} (0) --> 17390885279 (0) Acct-Input-Octets64 = 17390885279 (0) EXPAND %{expr:(%{%{Acct-Output-Gigawords}:-0} * 4294967296) + %{%{Acct-Output-Octets}:-0}} (0) --> 445462701134 (0) Acct-Output-Octets64 = 445462701134 (0) } # update request = noop (0) } # policy acct_counters64_preacct = noop (0) policy acct_unique { (0) update request { (0) EXPAND %{md5:%{Stripped-User-Name},%{Acct-Session-ID},%{NAS-IP-Address}} (0) --> 51dc686492632c94c03d1346eb471bf5 (0) Acct-Unique-Session-Id := 51dc686492632c94c03d1346eb471bf5 (0) } # update request = noop (0) } # policy acct_unique = noop (0) if (NAS-Port-Id =~ /:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):/) { (0) if (NAS-Port-Id =~ /:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):/) -> TRUE (0) if (NAS-Port-Id =~ /:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):/) { (0) update request { (0) EXPAND %{1} (0) --> 192.168.80.106 (0) NAS-Port-Id := 192.168.80.106 (0) EXPAND %{2} (0) --> 192.168.242.189 (0) NAS-Identifier := 192.168.242.189 (0) } # update request = noop (0) } # if (NAS-Port-Id =~ /:([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}):/) = noop (0) } # preacct = noop (0) # Executing section accounting from file /etc/raddb/sites-enabled/company (0) accounting { rlm_couchbase (couchtsi): Reserved connection (0) (0) couchtsi: EXPAND radacct_%{%{Acct-Unique-Session-Id}:-%{Acct-Session-Id}} (0) couchtsi: --> radacct_51dc686492632c94c03d1346eb471bf5 32450ms [I0] {32348} [INFO] (lcbio_mgr - L:410) <10.0.2.207:11210> (HE=0x5652b23dde40) Found ready connection in pool. Reusing socket and not creating new connection 32450ms [I0] {32348} [TRACE] (bootstrap - L:143) Background-polling for new configuration 32450ms [I0] {32348} [TRACE] (confmon - L:272) Refreshing current cluster map 32450ms [I0] {32348} [DEBUG] (lcbio_mgr - L:247) <10.0.2.207:11210> (HE=0x5652b23dde40) Assigning R=0x5652b2445930 SOCKET=0x5652b23df380 32450ms [I0] {32348} [DEBUG] (ioctx - L:99) <10.0.2.207:11210> (CTX=0x5652b26410d0,unknown) Pairing with SOCK=0x5652b23df380 32450ms [I0] {32348} [TRACE] (confmon - L:259) Attempting to retrieve cluster map via CCCP 32450ms [I0] {32348} [TRACE] (cccp - L:144) Re-Issuing CCCP Command on server struct 0x5652b23ebaf0 (10.0.2.207:11210) rlm_couchbase: (get_callback) got 93 bytes 32451ms [I0] {32348} [TRACE] (confmon - L:150) Not applying configuration received via CCCP. No changes detected. A.rev=25, B.rev=25 rlm_couchbase: skipping attribute with no map entry - User-Name rlm_couchbase: skipping attribute with no map entry - Acct-Status-Type rlm_couchbase: skipping attribute with no map entry - Acct-Session-Id rlm_couchbase: skipping attribute with no map entry - Acct-Input-Octets rlm_couchbase: skipping attribute with no map entry - Acct-Output-Octets rlm_couchbase: skipping attribute with no map entry - Acct-Session-Time rlm_couchbase: skipping attribute with no map entry - Acct-Input-Packets rlm_couchbase: skipping attribute with no map entry - Acct-Output-Packets rlm_couchbase: skipping attribute with no map entry - Service-Type rlm_couchbase: skipping attribute with no map entry - Framed-Protocol rlm_couchbase: skipping attribute with no map entry - Filter-Id rlm_couchbase: skipping attribute with no map entry - Filter-Id rlm_couchbase: skipping attribute with no map entry - Attr-26.4874.177 rlm_couchbase: skipping attribute with no map entry - Tunnel-Type rlm_couchbase: skipping attribute with no map entry - Tunnel-Medium-Type rlm_couchbase: skipping attribute with no map entry - Tunnel-Client-Endpoint rlm_couchbase: skipping attribute with no map entry - Tunnel-Server-Endpoint rlm_couchbase: skipping attribute with no map entry - Tunnel-Assignment-Id rlm_couchbase: skipping attribute with no map entry - Tunnel-Client-Auth-Id rlm_couchbase: skipping attribute with no map entry - Tunnel-Server-Auth-Id rlm_couchbase: skipping attribute with no map entry - Acct-Tunnel-Connection rlm_couchbase: skipping attribute with no map entry - Acct-Authentic rlm_couchbase: skipping attribute with no map entry - Acct-Delay-Time rlm_couchbase: skipping attribute with no map entry - Calling-Station-Id rlm_couchbase: skipping attribute with no map entry - ERX-Dhcp-Mac-Addr rlm_couchbase: skipping attribute with no map entry - Event-Timestamp rlm_couchbase: skipping attribute with no map entry - Framed-IP-Address rlm_couchbase: skipping attribute with no map entry - Framed-IP-Netmask rlm_couchbase: skipping attribute with no map entry - ERX-Input-Gigapkts rlm_couchbase: skipping attribute with no map entry - Acct-Input-Gigawords rlm_couchbase: skipping attribute with no map entry - NAS-Identifier rlm_couchbase: skipping attribute with no map entry - NAS-Port rlm_couchbase: skipping attribute with no map entry - NAS-Port-Id rlm_couchbase: skipping attribute with no map entry - NAS-Port-Type rlm_couchbase: skipping attribute with no map entry - ERX-Output-Gigapkts rlm_couchbase: skipping attribute with no map entry - Acct-Output-Gigawords rlm_couchbase: skipping attribute with no map entry - ERX-IPv6-Acct-Input-Octets rlm_couchbase: skipping attribute with no map entry - ERX-IPv6-Acct-Output-Octets rlm_couchbase: skipping attribute with no map entry - ERX-IPv6-Acct-Input-Packets rlm_couchbase: skipping attribute with no map entry - ERX-IPv6-Acct-Output-Packets rlm_couchbase: skipping attribute with no map entry - ERX-IPv6-Acct-Input-Gigawords rlm_couchbase: skipping attribute with no map entry - ERX-IPv6-Acct-Output-Gigawords rlm_couchbase: skipping attribute with no map entry - ERX-Tx-Connect-Speed rlm_couchbase: skipping attribute with no map entry - Attr-26.4874.163 rlm_couchbase: skipping attribute with no map entry - ERX-Pppoe-Description rlm_couchbase: skipping attribute with no map entry - NAS-IP-Address rlm_couchbase: skipping attribute with no map entry - Stripped-User-Name rlm_couchbase: skipping attribute with no map entry - Acct-Input-Octets64 rlm_couchbase: skipping attribute with no map entry - Acct-Output-Octets64 rlm_couchbase: skipping attribute with no map entry - Acct-Unique-Session-Id rlm_couchbase (couchtsi): Released connection (0) Need 10 more connections to reach 15 spares rlm_couchbase (couchtsi): Opening additional connection (5), 1 of 15 pending slots used 32452ms [I15] {32348} [INFO] (instance - L:423) Version=2.8.3, Changeset=8ce52f9294cfef59b9ff44f3cfc18cc3ca8c2860 32452ms [I15] {32348} [INFO] (instance - L:424) Effective connection string: couchbase+explicit://10.0.2.207,/radius?. Bucket=radius 32452ms [I15] {32348} [DEBUG] (instance - L:284) Applying initial cntl detailed_errcodes=1 32566ms [I15] {32348} [INFO] (instance - L:137) DNS SRV lookup failed: DNS/Hostname lookup failed. Ignore this if not relying on DNS SRV records 32566ms [I15] {32348} [DEBUG] (instance - L:77) Adding host 10.0.2.207:8091 to initial HTTP bootstrap list 32566ms [I15] {32348} [DEBUG] (instance - L:77) Adding host 10.0.2.207:11210 to initial CCCP bootstrap list 32566ms [I15] {32348} [TRACE] (instance - L:117) Bootstrap hosts loaded (cccp:1, http:1) 32566ms [I15] {32348} [DEBUG] (confmon - L:85) Preparing providers (this may be called multiple times) 32566ms [I15] {32348} [DEBUG] (confmon - L:92) Provider CCCP is ENABLED 32566ms [I15] {32348} [DEBUG] (confmon - L:92) Provider HTTP is ENABLED 32566ms [I15] {32348} [TRACE] (confmon - L:272) Refreshing current cluster map 32566ms [I15] {32348} [TRACE] (confmon - L:259) Attempting to retrieve cluster map via CCCP 32566ms [I15] {32348} [INFO] (cccp - L:151) Requesting connection to node 10.0.2.207:11210 for CCCP configuration 32566ms [I15] {32348} [DEBUG] (lcbio_mgr - L:417) <10.0.2.207:11210> (HE=0x5652b2657c70) Creating new connection because none are available in the pool 32566ms [I15] {32348} [TRACE] (lcbio_mgr - L:328) <10.0.2.207:11210> (HE=0x5652b2657c70) New pool entry: I=0x5652b2658ed0 32566ms [I15] {32348} [INFO] (connection - L:467) <10.0.2.207:11210> (SOCK=0x5652b2659070) Starting. Timeout=2000000us 32566ms [I15] {32348} [DEBUG] (connection - L:232) <10.0.2.207:11210> (SOCK=0x5652b2659070) Created new socket with FD=25 32566ms [I15] {32348} [TRACE] (connection - L:333) <10.0.2.207:11210> (SOCK=0x5652b2659070) Scheduling I/O watcher for asynchronous connection completion. 32567ms [I15] {32348} [INFO] (connection - L:141) <10.0.2.207:11210> (SOCK=0x5652b2659070) Connected established 32567ms [I15] {32348} [DEBUG] (connection - L:100) <10.0.2.207:11210> (SOCK=0x5652b2659070) Successfully set TCP_NODELAY 32567ms [I15] {32348} [DEBUG] (connection - L:100) <10.0.2.207:11210> (SOCK=0x5652b2659070) Successfully set TCP_KEEPALIVE 32567ms [I15] {32348} [DEBUG] (lcbio_mgr - L:287) <10.0.2.207:11210> (HE=0x5652b2657c70) Received result for I=0x5652b2658ed0,C=(nil); E=0x0 32567ms [I15] {32348} [DEBUG] (lcbio_mgr - L:247) <10.0.2.207:11210> (HE=0x5652b2657c70) Assigning R=0x5652b2657d20 SOCKET=0x5652b2659070 32567ms [I15] {32348} [DEBUG] (ioctx - L:99) <10.0.2.207:11210> (CTX=0x5652b2659870,unknown) Pairing with SOCK=0x5652b2659070 32567ms [I15] {32348} [DEBUG] (negotiation - L:390) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) HELLO identificator: "libcouchbase/2.8.3" 32567ms [I15] {32348} [DEBUG] (negotiation - L:394) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) Request feature: 0x2 (TLS) 32567ms [I15] {32348} [DEBUG] (negotiation - L:394) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) Request feature: 0x6 (XATTR) 32567ms [I15] {32348} [DEBUG] (negotiation - L:394) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) Request feature: 0x8 (Select Bucket) 32567ms [I15] {32348} [DEBUG] (negotiation - L:394) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) Request feature: 0x7 (Error Map) 32567ms [I15] {32348} [DEBUG] (negotiation - L:394) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) Request feature: 0x3 (TCP NODELAY) 32567ms [I15] {32348} [DEBUG] (negotiation - L:420) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) Server supports feature: 0x3 (TCP NODELAY) 32567ms [I15] {32348} [TRACE] (negotiation - L:565) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl,SASLREQ=0x5652b2659690) GET_ERRORMAP unsupported/disabled 32568ms [I15] {32348} [DEBUG] (ioctx - L:149) <10.0.2.207:11210> (CTX=0x5652b2659870,sasl) Destroying context. Pending Writes=0, Entered=true, Socket Refcount=1 32568ms [I15] {32348} [DEBUG] (ioctx - L:99) <10.0.2.207:11210> (CTX=0x5652b2661d80,unknown) Pairing with SOCK=0x5652b2659070 32568ms [I15] {32348} [DEBUG] (ioctx - L:149) <10.0.2.207:11210> (CTX=0x5652b2661d80,bc_cccp) Destroying context. Pending Writes=0, Entered=true, Socket Refcount=1 32568ms [I15] {32348} [INFO] (lcbio_mgr - L:467) <10.0.2.207:11210> (HE=0x5652b2657c70) Placing socket back into the pool. I=0x5652b2658ed0,C=0x5652b2659070 32569ms [I15] {32348} [INFO] (confmon - L:158) Setting new configuration. Received via CCCP 32569ms [I15] {32348} [DEBUG] (bootstrap - L:56) Instance configured 32569ms [I15] {32348} [DEBUG] (confmon - L:85) Preparing providers (this may be called multiple times) 32569ms [I15] {32348} [DEBUG] (confmon - L:92) Provider CCCP is ENABLED (0) [couchtsi] = ok (0) [ok] = ok (0) } # accounting = ok (0) Sent Accounting-Response Id 65 from 127.0.0.1:1813 to 127.0.0.1:55005 length 0 (0) Finished request (0) Cleaning up request packet ID 65 with timestamp +31 Ready to process requests ************************************************** cat /etc/raddb/mods-enabled/couchbase couchbase { server = "http://10.0.2.207:8091/pools" bucket = "radius" password = "PasswordString" acct_key = "radacct_%{%{Acct-Unique-Session-Id}:-%{Acct-Session-Id}}" doctype = "radacct" expire = 2592000 update { sessionId = 'Acct-Session-Id' uniqueId = 'Acct-Unique-Session-Id' lastStatus = 'Acct-Status-Type' userName = 'User-Name' lowercaseUser = 'Stripped-User-Name' userDomain = 'Stripped-User-Domain' nasIpAddress = 'NAS-IP-Address' nasIdentifier = 'NAS-Identifier' nasPort = 'NAS-Port-Id' calledStationId = 'Called-Station-Id' callingStationId = 'Calling-Station-Id' framedIpAddress = 'Framed-IP-Address' framedRoute = 'Framed-Route' framedIpv6Address = 'Framed-IPv6-Prefix' framedIpv6Id = 'Framed-Interface-Id' framedV6Route = 'Delegated-IPv6-Prefix' multiSessionId = 'Acct-Multi-Session-Id' multiSessionCount = 'Acct-Link-Count' TerminateCause = 'Acct-Terminate-Cause' sessionTime = 'Acct-Session-Time' lastUpdated = 'Event-Timestamp' } usage { lastStatus = 'Acct-Status-Type' timeStamp = 'Event-Timestamp' download = 'Acct-Output-Octets64' upload = 'Acct-Input-Octets64' } user_key = "raduser_%{md5:%{tolower:%{%{Stripped-User-Name}:-%{User-Name}}}}" pool { start = 5 min = 5 max = 20 spare = 15 uses = 0 lifetime = 0 idle_timeout = 1200 } } Thanks. -Mike

2 7

IPSec client is alternating between two IP addresses
by Artur Jaroschek 08 Jan '18

08 Jan '18

We are using freeradius version (debian) 2.1.12+dfsg-1.2 to manage an ip-pool for an ipsec vpn gateway. The gateway does xauth to the radius server for authentication and IP assignment as well as accounting to e.g. clean up the IP address. Upon re-keying the user gets a new IP address (which is the same as the second to last one), so its basically alternating between two IP addresses. We are using the ippool-module (not SQL) and I already found the notes on the key-parameter. Its currently set to "%{NAS-IP-Address} %{User-Name}" which is unique for each dailed in client. Before we configured accounting on the vpn gateway the reason for the alternating IPs was quite obvious to me (from looking at the module code: "Found a stale entry for ip") but with accounting properly configured I can't find a reason why its still the same: Before accounting was on: Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] Searching for an entry for key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] Found a stale entry for ip: 10.151.222.215 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] num: 0 Jan 5 14:52:43 s030v0047 freeradius[26299]: rlm_ippool: Allocating ip to key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] num: 1 Jan 5 14:52:43 s030v0047 freeradius[26299]: [s030v0047-test_pool] Allocated ip 10.151.222.20 to client key: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 5 14:52:43 s030v0047 freeradius[26299]: +++[s030v0047-test_pool] returns ok Now with accounting its looking like this upon re-keying: Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Searching for an entry for key: '1.1.1.2 C023A0667' Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Deallocated entry for ip: 10.151.222.215 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] num: 0 ... Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] #011expand: %{NAS-IP-Address} %{User-Name} -> 1.1.1.2 C023A0667 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] MD5 on 'key' directive maps to: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Searching for an entry for key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 8 21:37:37 s030v0047 freeradius[30859]: rlm_ippool: Allocating ip to key: '4d7b2dcc10b9fa1a049fc4d1d05170c0' Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] num: 1 Jan 8 21:37:37 s030v0047 freeradius[30859]: [s030v0047-test_pool] Allocated ip 10.151.222.39 to client key: 4d7b2dcc10b9fa1a049fc4d1d05170c0 Jan 8 21:37:37 s030v0047 freeradius[30859]: +++[s030v0047-test_pool] returns ok Is it because deallocation and reallocation are to close (in time) to each other? Thank you.

2 1