- Freeradius-Users - lists.freeradius.org

failover and groups in authenticate
by Louis Munro 08 Sep '16

08 Sep '16

Hello, I need to ask, even though I think this may be impossible. Is there a way to have groups of modules with failover in "authenticate"? The documentation does seem to be pretty explicit agains it: "authenticate{...}" itself is not a GROUP, even though it contains a list of Auth-Type GROUPs, because its semantics are totally different - it uses Auth-Type to decide which of its members to call, and their order is irrelevant. The reason I am asking is that I am trying to achieve something like a local cache of NT hashes (in redis) with failover to active directory. The idea is that getting the local hash from redis is much faster, but it may be outdated. So if the authentication fails, I'd like to try again using ntlm_auth (or the winbind libraries if possible). If both authentication attempts fail, then the user is rejected. This is something of a harebrained experiment around the performance limitations of Active-Directory. Feel free to tell me it's a bad idea. It probably is... Regards, -- Louis Munro lmunro(a)inverse.ca <mailto:lmunro@inverse.ca> :: www.inverse.ca <http://www.inverse.ca/> +1.514.447.4918 x125 :: +1 (866) 353-6153 x125 Inverse inc. :: Leaders behind SOGo (www.sogo.nu <http://www.sogo.nu/>) and PacketFence (www.packetfence.org <http://www.packetfence.org/>)

3 3

Salted SHA512
by Laurens Vets 08 Sep '16

08 Sep '16

Hello list, Does anyone have a tool or command to generate a salted SHA512 password for Freeradius 3.0.11? I'm using mkpasswd, but the resulting string does not seem to work. I'm trying to change Cleartext-Password attributes in radcheck to SSHA2-512-Password. Full debug output: Server was built with: accounting : yes authentication : yes ascend-binary-attributes : yes coa : yes control-socket : yes detail : yes dhcp : yes dynamic-clients : yes osfc2 : no proxy : yes regex-pcre : yes regex-posix : no regex-posix-extended : no session-management : yes stats : yes tcp : yes threads : yes tls : yes unlang : yes vmps : yes developer : no Server core libs: freeradius-server : 3.0.11 talloc : 2.0.* ssl : 1.0.1t release pcre : 8.35 2014-04-04 Endianness: little Compilation flags: cppflags : -D_FORTIFY_SOURCE=2 cflags : -I/home/laurens/freeradius3/freeradius-server-3.0.11 -I/home/laurens/freeradius3/freeradius-server-3.0.11/src -include /home/laurens/freeradius3/freeradius-server-3.0.11/src/freeradius-devel/autoconf.h -include /home/laurens/freeradius3/freeradius-server-3.0.11/src/freeradius-devel/build.h -include /home/laurens/freeradius3/freeradius-server-3.0.11/src/freeradius-devel/features.h -include /home/laurens/freeradius3/freeradius-server-3.0.11/src/freeradius-devel/radpaths.h -fno-strict-aliasing -g -O2 -fstack-protector-strong -Wformat -Werror=format-security -O2 -Wall -std=c99 -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG -DIS_MODULE=1 ldflags : -Wl,-z,relro libs : -lcrypto -lssl -ltalloc -lpcre -lcap -lnsl -lresolv -ldl -lpthread -lreadline Copyright (C) 1999-2016 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/sql including configuration file /etc/freeradius/mods-config/sql/main/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/dhcp_sqlippool including configuration file /etc/freeradius/mods-config/sql/ippool-dhcp/mysql/queries.conf including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/exec including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/accounting including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/eap including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/dhcp including configuration file /etc/freeradius/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 10.1.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client arali { ipaddr = 188.40.47.70 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = eap # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_sql # Loading module "sql" from file /etc/freeradius/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_sqlippool # Loading module "dhcp_sqlippool" from file /etc/freeradius/mods-enabled/dhcp_sqlippool sqlippool dhcp_sqlippool { sql_module_instance = "sql" lease_duration = 7200 pool_name = "" default_pool = "main_pool" allocate_begin = "START TRANSACTION" allocate_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE expiry_time <= NOW() - INTERVAL 1 SECOND AND nasipaddress = '%{Nas-IP-Address}'" allocate_find = "SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (callingstationid = '%{Calling-Station-Id}' or callingstationid = '') ORDER BY (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 FOR UPDATE" allocate_update = "UPDATE radippool SET nasipaddress = '%{NAS-IP-Address}', pool_key = '%{Calling-Station-Id}', callingstationid = '%{Calling-Station-Id}', username = '%{User-Name}', expiry_time = NOW() + INTERVAL 7200 SECOND WHERE framedipaddress = '%I'" allocate_commit = "COMMIT" pool_check = "SELECT id FROM radippool WHERE pool_name='%{control:Pool-Name}' LIMIT 1" start_begin = "START TRANSACTION" start_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 7200 SECOND WHERE nasipaddress = '%{NAS-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" start_commit = "COMMIT" alive_begin = "START TRANSACTION" alive_update = "UPDATE radippool SET expiry_time = NOW() + INTERVAL 7200 SECOND WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" alive_commit = "COMMIT" stop_begin = "START TRANSACTION" stop_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE nasipaddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND username = '%{User-Name}' AND callingstationid = '%{Calling-Station-Id}' AND framedipaddress = '%{Framed-IP-Address}'" stop_commit = "COMMIT" on_begin = "START TRANSACTION" on_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE nasipaddress = '%{Nas-IP-Address}'" on_commit = "COMMIT" off_begin = "START TRANSACTION" off_clear = "UPDATE radippool SET nasipaddress = '', pool_key = 0, callingstationid = '', username = '', expiry_time = NOW() WHERE nasipaddress = '%{Nas-IP-Address}'" off_commit = "COMMIT" messages { } } # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } instantiate { } # Instantiating module "files" from file /etc/freeradius/mods-enabled/files reading pairlist file /etc/freeradius/mods-config/files/authorize reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "sql" from file /etc/freeradius/mods-enabled/sql rlm_sql_mysql: libmysql version: 5.5.49 mysql { tls { } warnings = "auto" } rlm_sql (sql): Attempting to connect to database "radius" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no } rlm_sql (sql): Opening additional connection (0), 1 of 32 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.0.25-MariaDB-0+deb8u1, protocol version 10 rlm_sql (sql): Opening additional connection (1), 1 of 31 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.0.25-MariaDB-0+deb8u1, protocol version 10 rlm_sql (sql): Opening additional connection (2), 1 of 30 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.0.25-MariaDB-0+deb8u1, protocol version 10 rlm_sql (sql): Opening additional connection (3), 1 of 29 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.0.25-MariaDB-0+deb8u1, protocol version 10 rlm_sql (sql): Opening additional connection (4), 1 of 28 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.0.25-MariaDB-0+deb8u1, protocol version 10 # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "dhcp_sqlippool" from file /etc/freeradius/mods-enabled/dhcp_sqlippool # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server dhcp { # from file /etc/freeradius/sites-enabled/dhcp # Loading dhcp DHCP-Discover {...} # Loading dhcp DHCP-Request {...} # Loading dhcp DHCP-Decline {...} # Loading dhcp DHCP-Inform {...} # Loading dhcp DHCP-Release {...} # Loading dhcp DHCP-Lease-Query {...} } # server dhcp server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "dhcp" ipaddr = 10.1.0.1 port = 6700 No "interface" setting is defined. Only unicast DHCP will work src_ipaddr = 10.1.0.1 } listen { type = "auth" ipaddr = 10.1.0.1 port = 1812 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = 10.1.0.1 port = 1813 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on dhcp address 10.1.0.1 port 6700 bound to server dhcp Listening on auth address 10.1.0.1 port 1812 bound to server default Listening on acct address 10.1.0.1 port 1813 bound to server default Listening on proxy address * port 40485 Ready to process requests (0) Received Access-Request Id 135 from 10.1.0.1:53996 to 10.1.0.1:1812 length 158 (0) User-Name = "laurens6" (0) NAS-Port-Type = Virtual (0) Service-Type = Framed-User (0) NAS-Port = 71 (0) NAS-Port-Id = "iOS-radius" (0) NAS-IP-Address = 1.2.3.4 (0) Called-Station-Id = "1.2.3.4[4500]" (0) Calling-Station-Id = "70.69.64.246[43317]" (0) EAP-Message = 0x0200000d016c617572656e7336 (0) NAS-Identifier = "ipsec-gateway" (0) Message-Authenticator = 0x014256cba8dfdfd9ebbbaebac3f53415 (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "laurens6", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 0 length 13 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 1 length 22 (0) eap: EAP session adding &reply:State = 0x40dbe19240dae52c (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Sent Access-Challenge Id 135 from 10.1.0.1:1812 to 10.1.0.1:53996 length 0 (0) EAP-Message = 0x010100160410aae85d04591a4eaeacf79404a4ce893c (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x40dbe19240dae52cc735dff71d768d35 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 136 from 10.1.0.1:53996 to 10.1.0.1:1812 length 185 (1) User-Name = "laurens6" (1) NAS-Port-Type = Virtual (1) Service-Type = Framed-User (1) NAS-Port = 71 (1) NAS-Port-Id = "iOS-radius" (1) NAS-IP-Address = 1.2.3.4 (1) Called-Station-Id = "1.2.3.4[4500]" (1) Calling-Station-Id = "70.69.64.246[43317]" (1) EAP-Message = 0x0201001604101118ae196745e0209a6b8c8dc8257978 (1) NAS-Identifier = "ipsec-gateway" (1) State = 0x40dbe19240dae52cc735dff71d768d35 (1) Message-Authenticator = 0x6c0640a742dbbde883db2d603141ab7c (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "laurens6", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 1 length 22 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files: users: Matched entry DEFAULT at line 47 (1) [files] = ok (1) sql: EXPAND %{User-Name} (1) sql: --> laurens6 (1) sql: SQL-User-Name set to 'laurens6' rlm_sql (sql): Reserved connection (0) (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'laurens6' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'laurens6' ORDER BY id (1) sql: User found in radcheck table (1) sql: Conditional check items matched, merging assignment check items (1) sql: SSHA2-512-Password := 0x2436245a6a692e6e433373524f627424524667336a2f775964443779505535646d435552542e6c6f785352535a326a6a614246556a595a6f654d334b3234624b644f582f4266507976616d645444444d4a76414e35546b63376d784d586b4e515574626e6e30 (1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (1) sql: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'laurens6' ORDER BY id (1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'laurens6' ORDER BY id (1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (1) sql: --> SELECT groupname FROM radusergroup WHERE username = 'laurens6' ORDER BY priority (1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'laurens6' ORDER BY priority (1) sql: User not found in any groups rlm_sql (sql): Released connection (0) rlm_sql (sql): Need 5 more connections to reach 10 spares rlm_sql (sql): Opening additional connection (5), 1 of 27 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on Localhost via UNIX socket, server version 5.5.5-10.0.25-MariaDB-0+deb8u1, protocol version 10 (1) [sql] = ok (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x40dbe19240dae52c (1) eap: Finished EAP session with state 0x40dbe19240dae52c (1) eap: Previous EAP request found for state 0x40dbe19240dae52c, released from the list (1) eap: Peer sent packet with method EAP MD5 (4) (1) eap: Calling submodule eap_md5 to process data (1) eap_md5: Cleartext-Password is required for EAP-MD5 authentication (1) eap: ERROR: Failed continuing EAP MD5 (4) session. EAP sub-module failed (1) eap: Sending EAP Failure (code 4) ID 1 length 4 (1) eap: Failed in EAP select (1) [eap] = invalid (1) } # authenticate = invalid (1) Failed to authenticate the user (1) Using Post-Auth-Type Reject (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Post-Auth-Type REJECT { (1) sql: EXPAND .query (1) sql: --> .query (1) sql: Using query template 'query' rlm_sql (sql): Reserved connection (1) (1) sql: EXPAND %{User-Name} (1) sql: --> laurens6 (1) sql: SQL-User-Name set to 'laurens6' (1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') (1) sql: --> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'laurens6', '', 'Access-Reject', '2016-09-04 00:08:46') (1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'laurens6', '', 'Access-Reject', '2016-09-04 00:08:46') (1) sql: SQL query returned: success (1) sql: 1 record(s) updated rlm_sql (sql): Released connection (1) (1) [sql] = ok (1) attr_filter.access_reject: EXPAND %{User-Name} (1) attr_filter.access_reject: --> laurens6 (1) attr_filter.access_reject: Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) [eap] = noop (1) policy remove_reply_message_if_eap { (1) if (&reply:EAP-Message && &reply:Reply-Message) { (1) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (1) else { (1) [noop] = noop (1) } # else = noop (1) } # policy remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response (1) Sent Access-Reject Id 136 from 10.1.0.1:1812 to 10.1.0.1:53996 length 44 (1) EAP-Message = 0x04010004 (1) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) Cleaning up request packet ID 135 with timestamp +7 (1) Cleaning up request packet ID 136 with timestamp +7 Ready to process requests

5 11

Does MS-CHAP-Use-NTLM-Auth := 0 still work?
by Stefan Paetow 08 Sep '16

08 Sep '16

Hi, A question... since there have been some vast changes in how things are working, does the classic MS-CHAP-Use-NTLM-Auth := 0 trick as a check/control item still work? With Regards Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800.

2 2

proxy keyed-balance setting
by Scott McLane Gardner 07 Sep '16

07 Sep '16

I'm attempting to proxy based on Calling-Station-Id using the pre-proxy config in sites-available/default and proxy.conf. I think I have it all configured correctly, but the proxy server always forwards to the first server in the home_server_pool regardless. Will the proxy server do the server calculation (server = (hash % num_servers_in_pool)) for every request, or only if a threshold of requests per second are coming in or something like that? Here is my relevant config: sites-available/default : <snip> pre-proxy { update control { Load-Balance-Key := "%{Calling-Station-Id}" } updated } </snip> proxy.conf : <snip> home_server_pool redrads { type = keyed-balance #type = client-port-balance home_server = redrad01 home_server = redrad02 home_server = redrad03 } </snip> How can I tell that the Load-Balance-Key is being set? I see the following in the debug, but it still just punts to the first server no matter what. (131) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (131) pre-proxy { (131) update control { (131) EXPAND %{Calling-Station-Id} (131) --> 6c:8d:c1:d1:65:65 (131) Load-Balance-Key := "6c:8d:c1:d1:65:65" (131) } # update control = noop (131) [updated] = updated (131) } # pre-proxy = updated (131) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 10.7.0.29 is redrad01 Here's the full debug output of one connection attempt: radiusd: FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu, built on Dec 28 2014 at 07:00:16 Copyright (C) 1999-2014 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server redrad01 { ipaddr = 10.7.0.29 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server redrad02 { ipaddr = 10.7.0.30 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server redrad03 { ipaddr = 10.7.0.31 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool redrads { type = keyed-balance home_server = redrad01 home_server = redrad02 home_server = redrad03 } realm DEFAULT { auth_pool = redrads } radiusd: #### Loading Clients #### client blue8510.myOrg.org { ipaddr = 10.250.0.18 require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } client red8510.myOrg.org { ipaddr = 10.250.0.19 require_message_authenticator = no secret = <<< secret >>> nas_type = "cisco" limit { max_connections = 16 lifetime = 0 idle_timeout = 0 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_exec # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:2 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:183 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:190 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:2 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:183 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:190 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}" passchange { } allow_retry = yes } # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading pre-proxy {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address :: port 1812 as server default Listening on acct address :: port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 58962 Ready to process requests Received Access-Request Id 133 from 10.250.0.19:32777 to 10.7.0.28:1812 length 290 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x0201000c0173676172646e65 Message-Authenticator = 0x0c7aa5f145c2a3a21a3d3599ebd65013 (0) Received Access-Request packet from host 10.250.0.19 port 32777, id=133, length=290 (0) User-Name = 'myUsername' (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = '88:63:df:a5:2a:c7' (0) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (0) NAS-Port = 4 (0) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (0) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (0) Cisco-AVPair = 'mDNS=true' (0) NAS-IP-Address = 10.250.0.19 (0) NAS-Identifier = 'Red 8510' (0) Airespace-Wlan-Id = 8 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = '477' (0) EAP-Message = 0x0201000c0173676172646e65 (0) Message-Authenticator = 0x0c7aa5f145c2a3a21a3d3599ebd65013 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (!&User-Name) (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\\.\\./ ) (0) if (&User-Name =~ /\\.\\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\\.$/) (0) if (&User-Name =~ /\\.$/) -> FALSE (0) if (&User-Name =~ /(a)\\./) (0) if (&User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Checking for suffix after "@" (0) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (0) suffix : Found realm "DEFAULT" (0) suffix : Adding Stripped-User-Name = "myUsername" (0) suffix : Adding Realm = "DEFAULT" (0) suffix : Proxying request from user myUsername to realm DEFAULT (0) suffix : Preparing to proxy authentication request to realm "DEFAULT" (0) [suffix] = updated (0) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (0) [eap] = noop (0) files : users: Matched entry DEFAULT at line 2 (0) [files] = ok (0) [expiration] = noop (0) [logintime] = noop (0) [pap] = noop (0) } # authorize = updated (0) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (0) pre-proxy { (0) update control { (0) EXPAND %{Calling-Station-Id} (0) --> 88:63:df:a5:2a:c7 (0) Load-Balance-Key := "88:63:df:a5:2a:c7" (0) } # update control = noop (0) [updated] = updated (0) } # pre-proxy = updated Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 32820 (0) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (0) Sending Access-Request packet to host 10.7.0.29 port 1812, id=81, length=0 (0) User-Name = 'myUsername' (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = '88:63:df:a5:2a:c7' (0) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (0) NAS-Port = 4 (0) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (0) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (0) Cisco-AVPair = 'mDNS=true' (0) NAS-IP-Address = 10.250.0.19 (0) NAS-Identifier = 'Red 8510' (0) Airespace-Wlan-Id = 8 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = '477' (0) EAP-Message = 0x0201000c0173676172646e65 (0) Message-Authenticator = 0x0c7aa5f145c2a3a21a3d3599ebd65013 (0) Event-Timestamp = 'Sep 7 2016 10:45:30 CDT' (0) Stripped-User-Name = 'myUsername' (0) Realm = 'DEFAULT' (0) EAP-Type = Identity (0) Proxy-State = 0x313333 Sending Access-Request Id 81 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x0201000c0173676172646e65 Message-Authenticator = 0x0c7aa5f145c2a3a21a3d3599ebd65013 Event-Timestamp = 'Sep 7 2016 10:45:30 CDT' Proxy-State = 0x313333 Waking up in 0.3 seconds. Received Access-Challenge Id 81 from 10.7.0.29:1812 to 10.7.0.28:32820 length 69 EAP-Message = 0x010200061920 Message-Authenticator = 0xe3e99e6b01a32aae781244fb9e9e1c79 State = 0x7f32d9747f30c071723770ef4b853a0b Proxy-State = 0x313333 (0) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=81, length=69 (0) EAP-Message = 0x010200061920 (0) Message-Authenticator = 0xe3e99e6b01a32aae781244fb9e9e1c79 (0) State = 0x7f32d9747f30c071723770ef4b853a0b (0) Proxy-State = 0x313333 (0) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (0) post-proxy { (0) eap : No pre-existing handler found (0) [eap] = noop (0) } # post-proxy = noop (0) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=133, length=0 (0) EAP-Message = 0x010200061920 (0) Message-Authenticator = 0xe3e99e6b01a32aae781244fb9e9e1c79 (0) State = 0x7f32d9747f30c071723770ef4b853a0b Sending Access-Challenge Id 133 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010200061920 Message-Authenticator = 0xe3e99e6b01a32aae781244fb9e9e1c79 State = 0x7f32d9747f30c071723770ef4b853a0b (0) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds. Received Access-Request Id 134 from 10.250.0.19:32777 to 10.7.0.28:1812 length 427 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x02020083198000000079160301007401000070030157d0361b7e203d57e5bcc6c45d4ef147e49fdfb1edc8cc23db3bfd77d3524dc600002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000050005010000000000120000 State = 0x7f32d9747f30c071723770ef4b853a0b Message-Authenticator = 0x0801e4ea24b0e67675287c8b67291e91 (1) Received Access-Request packet from host 10.250.0.19 port 32777, id=134, length=427 (1) User-Name = 'myUsername' (1) Chargeable-User-Identity = 0x00 (1) Location-Capable = Civix-Location (1) Calling-Station-Id = '88:63:df:a5:2a:c7' (1) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (1) NAS-Port = 4 (1) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (1) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (1) Cisco-AVPair = 'mDNS=true' (1) NAS-IP-Address = 10.250.0.19 (1) NAS-Identifier = 'Red 8510' (1) Airespace-Wlan-Id = 8 (1) Service-Type = Framed-User (1) Framed-MTU = 1300 (1) NAS-Port-Type = Wireless-802.11 (1) Tunnel-Type:0 = VLAN (1) Tunnel-Medium-Type:0 = IEEE-802 (1) Tunnel-Private-Group-Id:0 = '477' (1) EAP-Message = 0x02020083198000000079160301007401000070030157d0361b7e203d57e5bcc6c45d4ef147e49fdfb1edc8cc23db3bfd77d3524dc600002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000050005010000000000120000 (1) State = 0x7f32d9747f30c071723770ef4b853a0b (1) Message-Authenticator = 0x0801e4ea24b0e67675287c8b67291e91 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) if (!&User-Name) (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\\.\\./ ) (1) if (&User-Name =~ /\\.\\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\\.$/) (1) if (&User-Name =~ /\\.$/) -> FALSE (1) if (&User-Name =~ /(a)\\./) (1) if (&User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : Checking for suffix after "@" (1) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (1) suffix : Found realm "DEFAULT" (1) suffix : Adding Stripped-User-Name = "myUsername" (1) suffix : Adding Realm = "DEFAULT" (1) suffix : Proxying request from user myUsername to realm DEFAULT (1) suffix : Preparing to proxy authentication request to realm "DEFAULT" (1) [suffix] = updated (1) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (1) [eap] = noop (1) files : users: Matched entry DEFAULT at line 2 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) [pap] = noop (1) } # authorize = updated (1) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (1) pre-proxy { (1) update control { (1) EXPAND %{Calling-Station-Id} (1) --> 88:63:df:a5:2a:c7 (1) Load-Balance-Key := "88:63:df:a5:2a:c7" (1) } # update control = noop (1) [updated] = updated (1) } # pre-proxy = updated (1) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (1) Sending Access-Request packet to host 10.7.0.29 port 1812, id=20, length=0 (1) User-Name = 'myUsername' (1) Chargeable-User-Identity = 0x00 (1) Location-Capable = Civix-Location (1) Calling-Station-Id = '88:63:df:a5:2a:c7' (1) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (1) NAS-Port = 4 (1) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (1) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (1) Cisco-AVPair = 'mDNS=true' (1) NAS-IP-Address = 10.250.0.19 (1) NAS-Identifier = 'Red 8510' (1) Airespace-Wlan-Id = 8 (1) Service-Type = Framed-User (1) Framed-MTU = 1300 (1) NAS-Port-Type = Wireless-802.11 (1) Tunnel-Type:0 = VLAN (1) Tunnel-Medium-Type:0 = IEEE-802 (1) Tunnel-Private-Group-Id:0 = '477' (1) EAP-Message = 0x02020083198000000079160301007401000070030157d0361b7e203d57e5bcc6c45d4ef147e49fdfb1edc8cc23db3bfd77d3524dc600002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000050005010000000000120000 (1) State = 0x7f32d9747f30c071723770ef4b853a0b (1) Message-Authenticator = 0x0801e4ea24b0e67675287c8b67291e91 (1) Event-Timestamp = 'Sep 7 2016 10:45:31 CDT' (1) Stripped-User-Name = 'myUsername' (1) Realm = 'DEFAULT' (1) EAP-Type = PEAP (1) Proxy-State = 0x313334 Sending Access-Request Id 20 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x02020083198000000079160301007401000070030157d0361b7e203d57e5bcc6c45d4ef147e49fdfb1edc8cc23db3bfd77d3524dc600002800ffc024c023c00ac009c008c028c027c014c013c012003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000050005010000000000120000 State = 0x7f32d9747f30c071723770ef4b853a0b Message-Authenticator = 0x0801e4ea24b0e67675287c8b67291e91 Event-Timestamp = 'Sep 7 2016 10:45:31 CDT' Proxy-State = 0x313334 Waking up in 0.3 seconds. Received Access-Challenge Id 20 from 10.7.0.29:1812 to 10.7.0.28:32820 length 1073 EAP-Message = 0x010303ec19c000001709160301005902000055030157d0361aca92a67745d40e35156c7ad740c541016d178f5273f5af1f59a50b60204821ad3949787ca622cad771b3b67c02410b620893a6387c2c7b9571def4bfa3c01400000dff01000100000b000403000102160301154d0b001549001546000588308205843082046ca0030201020210202d6f1b7599d63a02581661d5a66855300d06092a864886f70d01010b05003076310b3009060355040613025553310b3009060355040813024d493112301006035504071309416e6e204172626f7231123010060355040a1309496e7465726e6574323111300f060355040b1308496e436f6d6d6f6e311f301d06035504031316496e436f6d6d6f6e2052534120536572766572204341301e170d3136303831383030303030305a170d3138303831383233353935395a3081bc310b3009060355040613025553310e300c060355041113053732373031310b3009060355040813024152311530130603550407130c4661796574746576696c6c65311f301d06035504091316556e6976657273697479206f662041726b616e736173311f301d060355040a1316556e6976657273697479206f662041726b616e736173311b3019060355040b131255495453202d204954205365727669636573311a30180603550403131172656472616430312e75617 Message-Authenticator = 0x5c78ba0db4500c1c263a70fd546949ec State = 0x7f32d9747e31c071723770ef4b853a0b Proxy-State = 0x313334 (1) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=20, length=1073 (1) EAP-Message = 0x010303ec19c000001709160301005902000055030157d0361aca92a67745d40e35156c7ad740c541016d178f5273f5af1f59a50b60204821ad3949787ca622cad771b3b67c02410b620893a6387c2c7b9571def4bfa3c01400000dff01000100000b000403000102160301154d0b001549001546000588308205843082046ca0030201020210202d6f1b7599d63a02581661d5a66855300d06092a864886f70d01010b05003076310b3009060355040613025553310b3009060355040813024d493112301006035504071309416e6e204172626f7231123010060355040a1309496e7465726e6574323111300f060355040b1308496e436f6d6d6f6e311f301d06035504031316496e436f6d6d6f6e2052534120536572766572204341301e170d3136303831383030303030305a170d3138303831383233353935395a3081bc310b3009060355040613025553310e300c060355041113053732373031310b3009060355040813024152311530130603550407130c4661796574746576696c6c65311f301d06035504091316556e6976657273697479206f662041726b616e736173311f301d060355040a1316556e6976657273697479206f662041726b616e736173311b3019060355040b131255495453202d204954205365727669636573311a30180603550403131172656472616430312e756172 (1) Message-Authenticator = 0x5c78ba0db4500c1c263a70fd546949ec (1) State = 0x7f32d9747e31c071723770ef4b853a0b (1) Proxy-State = 0x313334 (1) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (1) post-proxy { (1) eap : No pre-existing handler found (1) [eap] = noop (1) } # post-proxy = noop (1) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=134, length=0 (1) EAP-Message = 0x010303ec19c000001709160301005902000055030157d0361aca92a67745d40e35156c7ad740c541016d178f5273f5af1f59a50b60204821ad3949787ca622cad771b3b67c02410b620893a6387c2c7b9571def4bfa3c01400000dff01000100000b000403000102160301154d0b001549001546000588308205843082046ca0030201020210202d6f1b7599d63a02581661d5a66855300d06092a864886f70d01010b05003076310b3009060355040613025553310b3009060355040813024d493112301006035504071309416e6e204172626f7231123010060355040a1309496e7465726e6574323111300f060355040b1308496e436f6d6d6f6e311f301d06035504031316496e436f6d6d6f6e2052534120536572766572204341301e170d3136303831383030303030305a170d3138303831383233353935395a3081bc310b3009060355040613025553310e300c060355041113053732373031310b3009060355040813024152311530130603550407130c4661796574746576696c6c65311f301d06035504091316556e6976657273697479206f662041726b616e736173311f301d060355040a1316556e6976657273697479206f662041726b616e736173311b3019060355040b131255495453202d204954205365727669636573311a30180603550403131172656472616430312e756172 (1) Message-Authenticator = 0x5c78ba0db4500c1c263a70fd546949ec (1) State = 0x7f32d9747e31c071723770ef4b853a0b Sending Access-Challenge Id 134 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010303ec19c000001709160301005902000055030157d0361aca92a67745d40e35156c7ad740c541016d178f5273f5af1f59a50b60204821ad3949787ca622cad771b3b67c02410b620893a6387c2c7b9571def4bfa3c01400000dff01000100000b000403000102160301154d0b001549001546000588308205843082046ca0030201020210202d6f1b7599d63a02581661d5a66855300d06092a864886f70d01010b05003076310b3009060355040613025553310b3009060355040813024d493112301006035504071309416e6e204172626f7231123010060355040a1309496e7465726e6574323111300f060355040b1308496e436f6d6d6f6e311f301d06035504031316496e436f6d6d6f6e2052534120536572766572204341301e170d3136303831383030303030305a170d3138303831383233353935395a3081bc310b3009060355040613025553310e300c060355041113053732373031310b3009060355040813024152311530130603550407130c4661796574746576696c6c65311f301d06035504091316556e6976657273697479206f662041726b616e736173311f301d060355040a1316556e6976657273697479206f662041726b616e736173311b3019060355040b131255495453202d204954205365727669636573311a30180603550403131172656472616430312e75617 Message-Authenticator = 0x5c78ba0db4500c1c263a70fd546949ec State = 0x7f32d9747e31c071723770ef4b853a0b (1) Finished request Waking up in 0.3 seconds. Waking up in 4.1 seconds. Received Access-Request Id 135 from 10.250.0.19:32777 to 10.7.0.28:1812 length 302 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020300061900 State = 0x7f32d9747e31c071723770ef4b853a0b Message-Authenticator = 0x55ffccc26bf1aa1a7b9317356e84ad62 (2) Received Access-Request packet from host 10.250.0.19 port 32777, id=135, length=302 (2) User-Name = 'myUsername' (2) Chargeable-User-Identity = 0x00 (2) Location-Capable = Civix-Location (2) Calling-Station-Id = '88:63:df:a5:2a:c7' (2) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (2) NAS-Port = 4 (2) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (2) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (2) Cisco-AVPair = 'mDNS=true' (2) NAS-IP-Address = 10.250.0.19 (2) NAS-Identifier = 'Red 8510' (2) Airespace-Wlan-Id = 8 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) Tunnel-Type:0 = VLAN (2) Tunnel-Medium-Type:0 = IEEE-802 (2) Tunnel-Private-Group-Id:0 = '477' (2) EAP-Message = 0x020300061900 (2) State = 0x7f32d9747e31c071723770ef4b853a0b (2) Message-Authenticator = 0x55ffccc26bf1aa1a7b9317356e84ad62 (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) if (!&User-Name) (2) if (!&User-Name) -> FALSE (2) if (&User-Name =~ / /) (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@.*@/ ) (2) if (&User-Name =~ /@.*@/ ) -> FALSE (2) if (&User-Name =~ /\\.\\./ ) (2) if (&User-Name =~ /\\.\\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\\.$/) (2) if (&User-Name =~ /\\.$/) -> FALSE (2) if (&User-Name =~ /(a)\\./) (2) if (&User-Name =~ /(a)\\./) -> FALSE (2) } # filter_username filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : Checking for suffix after "@" (2) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (2) suffix : Found realm "DEFAULT" (2) suffix : Adding Stripped-User-Name = "myUsername" (2) suffix : Adding Realm = "DEFAULT" (2) suffix : Proxying request from user myUsername to realm DEFAULT (2) suffix : Preparing to proxy authentication request to realm "DEFAULT" (2) [suffix] = updated (2) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (2) [eap] = noop (2) files : users: Matched entry DEFAULT at line 2 (2) [files] = ok (2) [expiration] = noop (2) [logintime] = noop (2) [pap] = noop (2) } # authorize = updated (2) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (2) pre-proxy { (2) update control { (2) EXPAND %{Calling-Station-Id} (2) --> 88:63:df:a5:2a:c7 (2) Load-Balance-Key := "88:63:df:a5:2a:c7" (2) } # update control = noop (2) [updated] = updated (2) } # pre-proxy = updated (2) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (2) Sending Access-Request packet to host 10.7.0.29 port 1812, id=113, length=0 (2) User-Name = 'myUsername' (2) Chargeable-User-Identity = 0x00 (2) Location-Capable = Civix-Location (2) Calling-Station-Id = '88:63:df:a5:2a:c7' (2) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (2) NAS-Port = 4 (2) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (2) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (2) Cisco-AVPair = 'mDNS=true' (2) NAS-IP-Address = 10.250.0.19 (2) NAS-Identifier = 'Red 8510' (2) Airespace-Wlan-Id = 8 (2) Service-Type = Framed-User (2) Framed-MTU = 1300 (2) NAS-Port-Type = Wireless-802.11 (2) Tunnel-Type:0 = VLAN (2) Tunnel-Medium-Type:0 = IEEE-802 (2) Tunnel-Private-Group-Id:0 = '477' (2) EAP-Message = 0x020300061900 (2) State = 0x7f32d9747e31c071723770ef4b853a0b (2) Message-Authenticator = 0x55ffccc26bf1aa1a7b9317356e84ad62 (2) Event-Timestamp = 'Sep 7 2016 10:45:31 CDT' (2) Stripped-User-Name = 'myUsername' (2) Realm = 'DEFAULT' (2) EAP-Type = PEAP (2) Proxy-State = 0x313335 Sending Access-Request Id 113 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020300061900 State = 0x7f32d9747e31c071723770ef4b853a0b Message-Authenticator = 0x55ffccc26bf1aa1a7b9317356e84ad62 Event-Timestamp = 'Sep 7 2016 10:45:31 CDT' Proxy-State = 0x313335 Waking up in 0.3 seconds. Received Access-Challenge Id 113 from 10.7.0.29:1812 to 10.7.0.28:32820 length 1069 EAP-Message = 0x010403e819406572742f7265706f7369746f72792f6370735f73736c2e7064663008060667810c01020230440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e696e636f6d6d6f6e2d7273612e6f72672f496e436f6d6d6f6e52534153657276657243412e63726c307506082b0601050507010104693067303e06082b060105050730028632687474703a2f2f6372742e7573657274727573742e636f6d2f496e436f6d6d6f6e52534153657276657243415f322e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d301c0603551d1104153013821172656472616430312e7561726b2e656475300d06092a864886f70d01010b050003820101002e8720c2323cd071993255679ffc7e2c1d795c9dcf3ab9f04f3f54d5696a23efd344d5e630ce4e74f3b85b2a9681309d7547ae1c6a06b59c371d06d7bb17d88261b8098420c51b59b4c7d6b95eb783a4cfd0db440f103a7ef4e99f3315063d3b448768ab63ff38b6492c61eef570ca451d69c6daffce6707d142e9565914a663aa1d52589f7c757e8f62d5f38bc54f746d8ed54b5aed57651863b7e054025d386814aef2d3a94b862b439aa68a4fa58c7b59bc1fdac5ede0d305cc349db069580eda39f1f117d8ba15d5f8665e935928af424ffa8c8789bfc2af9357bde Message-Authenticator = 0x31ce7af26188fa294fecde6ad695cc4a State = 0x7f32d9747d36c071723770ef4b853a0b Proxy-State = 0x313335 (2) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=113, length=1069 (2) EAP-Message = 0x010403e819406572742f7265706f7369746f72792f6370735f73736c2e7064663008060667810c01020230440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e696e636f6d6d6f6e2d7273612e6f72672f496e436f6d6d6f6e52534153657276657243412e63726c307506082b0601050507010104693067303e06082b060105050730028632687474703a2f2f6372742e7573657274727573742e636f6d2f496e436f6d6d6f6e52534153657276657243415f322e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d301c0603551d1104153013821172656472616430312e7561726b2e656475300d06092a864886f70d01010b050003820101002e8720c2323cd071993255679ffc7e2c1d795c9dcf3ab9f04f3f54d5696a23efd344d5e630ce4e74f3b85b2a9681309d7547ae1c6a06b59c371d06d7bb17d88261b8098420c51b59b4c7d6b95eb783a4cfd0db440f103a7ef4e99f3315063d3b448768ab63ff38b6492c61eef570ca451d69c6daffce6707d142e9565914a663aa1d52589f7c757e8f62d5f38bc54f746d8ed54b5aed57651863b7e054025d386814aef2d3a94b862b439aa68a4fa58c7b59bc1fdac5ede0d305cc349db069580eda39f1f117d8ba15d5f8665e935928af424ffa8c8789bfc2af9357bde1 (2) Message-Authenticator = 0x31ce7af26188fa294fecde6ad695cc4a (2) State = 0x7f32d9747d36c071723770ef4b853a0b (2) Proxy-State = 0x313335 (2) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (2) post-proxy { (2) eap : No pre-existing handler found (2) [eap] = noop (2) } # post-proxy = noop (2) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=135, length=0 (2) EAP-Message = 0x010403e819406572742f7265706f7369746f72792f6370735f73736c2e7064663008060667810c01020230440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e696e636f6d6d6f6e2d7273612e6f72672f496e436f6d6d6f6e52534153657276657243412e63726c307506082b0601050507010104693067303e06082b060105050730028632687474703a2f2f6372742e7573657274727573742e636f6d2f496e436f6d6d6f6e52534153657276657243415f322e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d301c0603551d1104153013821172656472616430312e7561726b2e656475300d06092a864886f70d01010b050003820101002e8720c2323cd071993255679ffc7e2c1d795c9dcf3ab9f04f3f54d5696a23efd344d5e630ce4e74f3b85b2a9681309d7547ae1c6a06b59c371d06d7bb17d88261b8098420c51b59b4c7d6b95eb783a4cfd0db440f103a7ef4e99f3315063d3b448768ab63ff38b6492c61eef570ca451d69c6daffce6707d142e9565914a663aa1d52589f7c757e8f62d5f38bc54f746d8ed54b5aed57651863b7e054025d386814aef2d3a94b862b439aa68a4fa58c7b59bc1fdac5ede0d305cc349db069580eda39f1f117d8ba15d5f8665e935928af424ffa8c8789bfc2af9357bde1 (2) Message-Authenticator = 0x31ce7af26188fa294fecde6ad695cc4a (2) State = 0x7f32d9747d36c071723770ef4b853a0b Sending Access-Challenge Id 135 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010403e819406572742f7265706f7369746f72792f6370735f73736c2e7064663008060667810c01020230440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e696e636f6d6d6f6e2d7273612e6f72672f496e436f6d6d6f6e52534153657276657243412e63726c307506082b0601050507010104693067303e06082b060105050730028632687474703a2f2f6372742e7573657274727573742e636f6d2f496e436f6d6d6f6e52534153657276657243415f322e637274302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d301c0603551d1104153013821172656472616430312e7561726b2e656475300d06092a864886f70d01010b050003820101002e8720c2323cd071993255679ffc7e2c1d795c9dcf3ab9f04f3f54d5696a23efd344d5e630ce4e74f3b85b2a9681309d7547ae1c6a06b59c371d06d7bb17d88261b8098420c51b59b4c7d6b95eb783a4cfd0db440f103a7ef4e99f3315063d3b448768ab63ff38b6492c61eef570ca451d69c6daffce6707d142e9565914a663aa1d52589f7c757e8f62d5f38bc54f746d8ed54b5aed57651863b7e054025d386814aef2d3a94b862b439aa68a4fa58c7b59bc1fdac5ede0d305cc349db069580eda39f1f117d8ba15d5f8665e935928af424ffa8c8789bfc2af9357bde Message-Authenticator = 0x31ce7af26188fa294fecde6ad695cc4a State = 0x7f32d9747d36c071723770ef4b853a0b (2) Finished request Waking up in 0.3 seconds. Waking up in 3.5 seconds. Received Access-Request Id 136 from 10.250.0.19:32777 to 10.7.0.28:1812 length 302 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020400061900 State = 0x7f32d9747d36c071723770ef4b853a0b Message-Authenticator = 0x0f2f551fdac847a020dfb7ba2f6b4a8d (3) Received Access-Request packet from host 10.250.0.19 port 32777, id=136, length=302 (3) User-Name = 'myUsername' (3) Chargeable-User-Identity = 0x00 (3) Location-Capable = Civix-Location (3) Calling-Station-Id = '88:63:df:a5:2a:c7' (3) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (3) NAS-Port = 4 (3) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (3) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (3) Cisco-AVPair = 'mDNS=true' (3) NAS-IP-Address = 10.250.0.19 (3) NAS-Identifier = 'Red 8510' (3) Airespace-Wlan-Id = 8 (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Wireless-802.11 (3) Tunnel-Type:0 = VLAN (3) Tunnel-Medium-Type:0 = IEEE-802 (3) Tunnel-Private-Group-Id:0 = '477' (3) EAP-Message = 0x020400061900 (3) State = 0x7f32d9747d36c071723770ef4b853a0b (3) Message-Authenticator = 0x0f2f551fdac847a020dfb7ba2f6b4a8d (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) filter_username filter_username { (3) if (!&User-Name) (3) if (!&User-Name) -> FALSE (3) if (&User-Name =~ / /) (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@.*@/ ) (3) if (&User-Name =~ /@.*@/ ) -> FALSE (3) if (&User-Name =~ /\\.\\./ ) (3) if (&User-Name =~ /\\.\\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\\.$/) (3) if (&User-Name =~ /\\.$/) -> FALSE (3) if (&User-Name =~ /(a)\\./) (3) if (&User-Name =~ /(a)\\./) -> FALSE (3) } # filter_username filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : Checking for suffix after "@" (3) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (3) suffix : Found realm "DEFAULT" (3) suffix : Adding Stripped-User-Name = "myUsername" (3) suffix : Adding Realm = "DEFAULT" (3) suffix : Proxying request from user myUsername to realm DEFAULT (3) suffix : Preparing to proxy authentication request to realm "DEFAULT" (3) [suffix] = updated (3) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (3) [eap] = noop (3) files : users: Matched entry DEFAULT at line 2 (3) [files] = ok (3) [expiration] = noop (3) [logintime] = noop (3) [pap] = noop (3) } # authorize = updated (3) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (3) pre-proxy { (3) update control { (3) EXPAND %{Calling-Station-Id} (3) --> 88:63:df:a5:2a:c7 (3) Load-Balance-Key := "88:63:df:a5:2a:c7" (3) } # update control = noop (3) [updated] = updated (3) } # pre-proxy = updated (3) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (3) Sending Access-Request packet to host 10.7.0.29 port 1812, id=152, length=0 (3) User-Name = 'myUsername' (3) Chargeable-User-Identity = 0x00 (3) Location-Capable = Civix-Location (3) Calling-Station-Id = '88:63:df:a5:2a:c7' (3) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (3) NAS-Port = 4 (3) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (3) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (3) Cisco-AVPair = 'mDNS=true' (3) NAS-IP-Address = 10.250.0.19 (3) NAS-Identifier = 'Red 8510' (3) Airespace-Wlan-Id = 8 (3) Service-Type = Framed-User (3) Framed-MTU = 1300 (3) NAS-Port-Type = Wireless-802.11 (3) Tunnel-Type:0 = VLAN (3) Tunnel-Medium-Type:0 = IEEE-802 (3) Tunnel-Private-Group-Id:0 = '477' (3) EAP-Message = 0x020400061900 (3) State = 0x7f32d9747d36c071723770ef4b853a0b (3) Message-Authenticator = 0x0f2f551fdac847a020dfb7ba2f6b4a8d (3) Event-Timestamp = 'Sep 7 2016 10:45:32 CDT' (3) Stripped-User-Name = 'myUsername' (3) Realm = 'DEFAULT' (3) EAP-Type = PEAP (3) Proxy-State = 0x313336 Sending Access-Request Id 152 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020400061900 State = 0x7f32d9747d36c071723770ef4b853a0b Message-Authenticator = 0x0f2f551fdac847a020dfb7ba2f6b4a8d Event-Timestamp = 'Sep 7 2016 10:45:32 CDT' Proxy-State = 0x313336 Waking up in 0.3 seconds. Received Access-Challenge Id 152 from 10.7.0.29:1812 to 10.7.0.28:32820 length 1069 EAP-Message = 0x010503e81940f4a834dbe242c8a5db37d5b5e7e442723fb413cf8b0724451e8c918346b909a6fc18a30602ec348d32669527eae197e8db35a32b56eb57e8f01059df6d700c666ad064e5a8a39831ad1d62d5fa92e39a43cd2d35fbd99e335b457dc486282c6612c8db0f19300d3fe9f0ea4a5e4007c7f6207a537881647a7e456a166ff49358c962fb29277da17f21cee74f47d68a56e0e366f8ecdd89dc268c19683b8d8be2fb47230b7f370203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604141e05a3778f6c96e25b874ba6b486ac71000ce738300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f55534552547275737452534141646454727573744 Message-Authenticator = 0xffe356a1b5de045026b21b97d6531288 State = 0x7f32d9747c37c071723770ef4b853a0b Proxy-State = 0x313336 (3) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=152, length=1069 (3) EAP-Message = 0x010503e81940f4a834dbe242c8a5db37d5b5e7e442723fb413cf8b0724451e8c918346b909a6fc18a30602ec348d32669527eae197e8db35a32b56eb57e8f01059df6d700c666ad064e5a8a39831ad1d62d5fa92e39a43cd2d35fbd99e335b457dc486282c6612c8db0f19300d3fe9f0ea4a5e4007c7f6207a537881647a7e456a166ff49358c962fb29277da17f21cee74f47d68a56e0e366f8ecdd89dc268c19683b8d8be2fb47230b7f370203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604141e05a3778f6c96e25b874ba6b486ac71000ce738300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443 (3) Message-Authenticator = 0xffe356a1b5de045026b21b97d6531288 (3) State = 0x7f32d9747c37c071723770ef4b853a0b (3) Proxy-State = 0x313336 (3) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (3) post-proxy { (3) eap : No pre-existing handler found (3) [eap] = noop (3) } # post-proxy = noop (3) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=136, length=0 (3) EAP-Message = 0x010503e81940f4a834dbe242c8a5db37d5b5e7e442723fb413cf8b0724451e8c918346b909a6fc18a30602ec348d32669527eae197e8db35a32b56eb57e8f01059df6d700c666ad064e5a8a39831ad1d62d5fa92e39a43cd2d35fbd99e335b457dc486282c6612c8db0f19300d3fe9f0ea4a5e4007c7f6207a537881647a7e456a166ff49358c962fb29277da17f21cee74f47d68a56e0e366f8ecdd89dc268c19683b8d8be2fb47230b7f370203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604141e05a3778f6c96e25b874ba6b486ac71000ce738300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f555345525472757374525341416464547275737443 (3) Message-Authenticator = 0xffe356a1b5de045026b21b97d6531288 (3) State = 0x7f32d9747c37c071723770ef4b853a0b Sending Access-Challenge Id 136 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010503e81940f4a834dbe242c8a5db37d5b5e7e442723fb413cf8b0724451e8c918346b909a6fc18a30602ec348d32669527eae197e8db35a32b56eb57e8f01059df6d700c666ad064e5a8a39831ad1d62d5fa92e39a43cd2d35fbd99e335b457dc486282c6612c8db0f19300d3fe9f0ea4a5e4007c7f6207a537881647a7e456a166ff49358c962fb29277da17f21cee74f47d68a56e0e366f8ecdd89dc268c19683b8d8be2fb47230b7f370203010001a382016e3082016a301f0603551d230418301680145379bf5aaa2b4acf5480e1d89bc09df2b20366cb301d0603551d0e041604141e05a3778f6c96e25b874ba6b486ac71000ce738300e0603551d0f0101ff04040302018630120603551d130101ff040830060101ff020100301d0603551d250416301406082b0601050507030106082b06010505070302301b0603551d200414301230060604551d20003008060667810c01020230500603551d1f044930473045a043a041863f687474703a2f2f63726c2e7573657274727573742e636f6d2f55534552547275737452534143657274696669636174696f6e417574686f726974792e63726c307606082b06010505070101046a3068303f06082b060105050730028633687474703a2f2f6372742e7573657274727573742e636f6d2f55534552547275737452534141646454727573744 Message-Authenticator = 0xffe356a1b5de045026b21b97d6531288 State = 0x7f32d9747c37c071723770ef4b853a0b (3) Finished request Waking up in 0.3 seconds. Waking up in 2.9 seconds. Received Access-Request Id 137 from 10.250.0.19:32777 to 10.7.0.28:1812 length 302 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020500061900 State = 0x7f32d9747c37c071723770ef4b853a0b Message-Authenticator = 0x179c27dcfcb213745451499ae90edcce (4) Received Access-Request packet from host 10.250.0.19 port 32777, id=137, length=302 (4) User-Name = 'myUsername' (4) Chargeable-User-Identity = 0x00 (4) Location-Capable = Civix-Location (4) Calling-Station-Id = '88:63:df:a5:2a:c7' (4) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (4) NAS-Port = 4 (4) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (4) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (4) Cisco-AVPair = 'mDNS=true' (4) NAS-IP-Address = 10.250.0.19 (4) NAS-Identifier = 'Red 8510' (4) Airespace-Wlan-Id = 8 (4) Service-Type = Framed-User (4) Framed-MTU = 1300 (4) NAS-Port-Type = Wireless-802.11 (4) Tunnel-Type:0 = VLAN (4) Tunnel-Medium-Type:0 = IEEE-802 (4) Tunnel-Private-Group-Id:0 = '477' (4) EAP-Message = 0x020500061900 (4) State = 0x7f32d9747c37c071723770ef4b853a0b (4) Message-Authenticator = 0x179c27dcfcb213745451499ae90edcce (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4) authorize { (4) filter_username filter_username { (4) if (!&User-Name) (4) if (!&User-Name) -> FALSE (4) if (&User-Name =~ / /) (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@.*@/ ) (4) if (&User-Name =~ /@.*@/ ) -> FALSE (4) if (&User-Name =~ /\\.\\./ ) (4) if (&User-Name =~ /\\.\\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\\.$/) (4) if (&User-Name =~ /\\.$/) -> FALSE (4) if (&User-Name =~ /(a)\\./) (4) if (&User-Name =~ /(a)\\./) -> FALSE (4) } # filter_username filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : Checking for suffix after "@" (4) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (4) suffix : Found realm "DEFAULT" (4) suffix : Adding Stripped-User-Name = "myUsername" (4) suffix : Adding Realm = "DEFAULT" (4) suffix : Proxying request from user myUsername to realm DEFAULT (4) suffix : Preparing to proxy authentication request to realm "DEFAULT" (4) [suffix] = updated (4) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (4) [eap] = noop (4) files : users: Matched entry DEFAULT at line 2 (4) [files] = ok (4) [expiration] = noop (4) [logintime] = noop (4) [pap] = noop (4) } # authorize = updated (4) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (4) pre-proxy { (4) update control { (4) EXPAND %{Calling-Station-Id} (4) --> 88:63:df:a5:2a:c7 (4) Load-Balance-Key := "88:63:df:a5:2a:c7" (4) } # update control = noop (4) [updated] = updated (4) } # pre-proxy = updated (4) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (4) Sending Access-Request packet to host 10.7.0.29 port 1812, id=121, length=0 (4) User-Name = 'myUsername' (4) Chargeable-User-Identity = 0x00 (4) Location-Capable = Civix-Location (4) Calling-Station-Id = '88:63:df:a5:2a:c7' (4) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (4) NAS-Port = 4 (4) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (4) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (4) Cisco-AVPair = 'mDNS=true' (4) NAS-IP-Address = 10.250.0.19 (4) NAS-Identifier = 'Red 8510' (4) Airespace-Wlan-Id = 8 (4) Service-Type = Framed-User (4) Framed-MTU = 1300 (4) NAS-Port-Type = Wireless-802.11 (4) Tunnel-Type:0 = VLAN (4) Tunnel-Medium-Type:0 = IEEE-802 (4) Tunnel-Private-Group-Id:0 = '477' (4) EAP-Message = 0x020500061900 (4) State = 0x7f32d9747c37c071723770ef4b853a0b (4) Message-Authenticator = 0x179c27dcfcb213745451499ae90edcce (4) Event-Timestamp = 'Sep 7 2016 10:45:32 CDT' (4) Stripped-User-Name = 'myUsername' (4) Realm = 'DEFAULT' (4) EAP-Type = PEAP (4) Proxy-State = 0x313337 Sending Access-Request Id 121 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020500061900 State = 0x7f32d9747c37c071723770ef4b853a0b Message-Authenticator = 0x179c27dcfcb213745451499ae90edcce Event-Timestamp = 'Sep 7 2016 10:45:32 CDT' Proxy-State = 0x313337 Waking up in 0.3 seconds. Received Access-Challenge Id 121 from 10.7.0.29:1812 to 10.7.0.28:32820 length 1069 EAP-Message = 0x010603e819402a87b95ccaf2834c4003b2521a79210837184ed98d5f99c6055ff16aaeba755a78473a3a655ee5c4d0e3dad2eb5a282db9029960a26f3c2f667c98459cc9fa01ef328e7c3ef9f4037b24a656098c2400057b308205773082045fa003020102021013ea28705bf4eced0c36630980614336300d06092a864886f70d01010c0500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b37281 Message-Authenticator = 0x21ea0b5359ce13b7be9dec242663548a State = 0x7f32d9747b34c071723770ef4b853a0b Proxy-State = 0x313337 (4) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=121, length=1069 (4) EAP-Message = 0x010603e819402a87b95ccaf2834c4003b2521a79210837184ed98d5f99c6055ff16aaeba755a78473a3a655ee5c4d0e3dad2eb5a282db9029960a26f3c2f667c98459cc9fa01ef328e7c3ef9f4037b24a656098c2400057b308205773082045fa003020102021013ea28705bf4eced0c36630980614336300d06092a864886f70d01010c0500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b372811 (4) Message-Authenticator = 0x21ea0b5359ce13b7be9dec242663548a (4) State = 0x7f32d9747b34c071723770ef4b853a0b (4) Proxy-State = 0x313337 (4) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (4) post-proxy { (4) eap : No pre-existing handler found (4) [eap] = noop (4) } # post-proxy = noop (4) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=137, length=0 (4) EAP-Message = 0x010603e819402a87b95ccaf2834c4003b2521a79210837184ed98d5f99c6055ff16aaeba755a78473a3a655ee5c4d0e3dad2eb5a282db9029960a26f3c2f667c98459cc9fa01ef328e7c3ef9f4037b24a656098c2400057b308205773082045fa003020102021013ea28705bf4eced0c36630980614336300d06092a864886f70d01010c0500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b372811 (4) Message-Authenticator = 0x21ea0b5359ce13b7be9dec242663548a (4) State = 0x7f32d9747b34c071723770ef4b853a0b Sending Access-Challenge Id 137 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010603e819402a87b95ccaf2834c4003b2521a79210837184ed98d5f99c6055ff16aaeba755a78473a3a655ee5c4d0e3dad2eb5a282db9029960a26f3c2f667c98459cc9fa01ef328e7c3ef9f4037b24a656098c2400057b308205773082045fa003020102021013ea28705bf4eced0c36630980614336300d06092a864886f70d01010c0500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b37281 Message-Authenticator = 0x21ea0b5359ce13b7be9dec242663548a State = 0x7f32d9747b34c071723770ef4b853a0b (4) Finished request Waking up in 0.3 seconds. Waking up in 2.3 seconds. Received Access-Request Id 138 from 10.250.0.19:32777 to 10.7.0.28:1812 length 302 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020600061900 State = 0x7f32d9747b34c071723770ef4b853a0b Message-Authenticator = 0x793941bee6d2a20c5e40eab7187ed082 (5) Received Access-Request packet from host 10.250.0.19 port 32777, id=138, length=302 (5) User-Name = 'myUsername' (5) Chargeable-User-Identity = 0x00 (5) Location-Capable = Civix-Location (5) Calling-Station-Id = '88:63:df:a5:2a:c7' (5) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (5) NAS-Port = 4 (5) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (5) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (5) Cisco-AVPair = 'mDNS=true' (5) NAS-IP-Address = 10.250.0.19 (5) NAS-Identifier = 'Red 8510' (5) Airespace-Wlan-Id = 8 (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Wireless-802.11 (5) Tunnel-Type:0 = VLAN (5) Tunnel-Medium-Type:0 = IEEE-802 (5) Tunnel-Private-Group-Id:0 = '477' (5) EAP-Message = 0x020600061900 (5) State = 0x7f32d9747b34c071723770ef4b853a0b (5) Message-Authenticator = 0x793941bee6d2a20c5e40eab7187ed082 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) if (!&User-Name) (5) if (!&User-Name) -> FALSE (5) if (&User-Name =~ / /) (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@.*@/ ) (5) if (&User-Name =~ /@.*@/ ) -> FALSE (5) if (&User-Name =~ /\\.\\./ ) (5) if (&User-Name =~ /\\.\\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\\.$/) (5) if (&User-Name =~ /\\.$/) -> FALSE (5) if (&User-Name =~ /(a)\\./) (5) if (&User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : Checking for suffix after "@" (5) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (5) suffix : Found realm "DEFAULT" (5) suffix : Adding Stripped-User-Name = "myUsername" (5) suffix : Adding Realm = "DEFAULT" (5) suffix : Proxying request from user myUsername to realm DEFAULT (5) suffix : Preparing to proxy authentication request to realm "DEFAULT" (5) [suffix] = updated (5) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (5) [eap] = noop (5) files : users: Matched entry DEFAULT at line 2 (5) [files] = ok (5) [expiration] = noop (5) [logintime] = noop (5) [pap] = noop (5) } # authorize = updated (5) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (5) pre-proxy { (5) update control { (5) EXPAND %{Calling-Station-Id} (5) --> 88:63:df:a5:2a:c7 (5) Load-Balance-Key := "88:63:df:a5:2a:c7" (5) } # update control = noop (5) [updated] = updated (5) } # pre-proxy = updated (5) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (5) Sending Access-Request packet to host 10.7.0.29 port 1812, id=212, length=0 (5) User-Name = 'myUsername' (5) Chargeable-User-Identity = 0x00 (5) Location-Capable = Civix-Location (5) Calling-Station-Id = '88:63:df:a5:2a:c7' (5) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (5) NAS-Port = 4 (5) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (5) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (5) Cisco-AVPair = 'mDNS=true' (5) NAS-IP-Address = 10.250.0.19 (5) NAS-Identifier = 'Red 8510' (5) Airespace-Wlan-Id = 8 (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Wireless-802.11 (5) Tunnel-Type:0 = VLAN (5) Tunnel-Medium-Type:0 = IEEE-802 (5) Tunnel-Private-Group-Id:0 = '477' (5) EAP-Message = 0x020600061900 (5) State = 0x7f32d9747b34c071723770ef4b853a0b (5) Message-Authenticator = 0x793941bee6d2a20c5e40eab7187ed082 (5) Event-Timestamp = 'Sep 7 2016 10:45:33 CDT' (5) Stripped-User-Name = 'myUsername' (5) Realm = 'DEFAULT' (5) EAP-Type = PEAP (5) Proxy-State = 0x313338 Sending Access-Request Id 212 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020600061900 State = 0x7f32d9747b34c071723770ef4b853a0b Message-Authenticator = 0x793941bee6d2a20c5e40eab7187ed082 Event-Timestamp = 'Sep 7 2016 10:45:33 CDT' Proxy-State = 0x313338 Waking up in 0.3 seconds. Received Access-Challenge Id 212 from 10.7.0.29:1812 to 10.7.0.28:32820 length 1069 EAP-Message = 0x010703e8194003bde024cb541a301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820101009365f63783950f5ec3821c1fd677e73c8ac0aa09f0e90b26f1e0c26a75a1c779c9b95260c829120ef0ad03d609c476dfe5a68195a746da8257a99592c5b68f03226c3377c17b32176e07ce5a14413a05241bf614063ba825240ebbcc2a75ddb970413f7cd0633621071f46ff60a491e167bcde1f7e1914c9636791ea67076bb48f8bc06e437dc3a1806cb21ebc53857ddc90a1a4bc2def4672573505bfbb46bb6e6d3799b6ff239291c66e40f88f2956ea5fd55f1453acf04f61eaf722cca7560be2b8341f26d97b1905683fba3cd43806a2d3e68f0ee3b4716d4042c584b440952bf465a04879f61d8163969d4f75e0f87ce48ea9d1f2ad8ab38cc721cdc2ef00043a30820 Message-Authenticator = 0x7cbe966dd0238f8b291b7a1c48ddeb42 State = 0x7f32d9747a35c071723770ef4b853a0b Proxy-State = 0x313338 (5) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=212, length=1069 (5) EAP-Message = 0x010703e8194003bde024cb541a301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820101009365f63783950f5ec3821c1fd677e73c8ac0aa09f0e90b26f1e0c26a75a1c779c9b95260c829120ef0ad03d609c476dfe5a68195a746da8257a99592c5b68f03226c3377c17b32176e07ce5a14413a05241bf614063ba825240ebbcc2a75ddb970413f7cd0633621071f46ff60a491e167bcde1f7e1914c9636791ea67076bb48f8bc06e437dc3a1806cb21ebc53857ddc90a1a4bc2def4672573505bfbb46bb6e6d3799b6ff239291c66e40f88f2956ea5fd55f1453acf04f61eaf722cca7560be2b8341f26d97b1905683fba3cd43806a2d3e68f0ee3b4716d4042c584b440952bf465a04879f61d8163969d4f75e0f87ce48ea9d1f2ad8ab38cc721cdc2ef00043a308204 (5) Message-Authenticator = 0x7cbe966dd0238f8b291b7a1c48ddeb42 (5) State = 0x7f32d9747a35c071723770ef4b853a0b (5) Proxy-State = 0x313338 (5) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (5) post-proxy { (5) eap : No pre-existing handler found (5) [eap] = noop (5) } # post-proxy = noop (5) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=138, length=0 (5) EAP-Message = 0x010703e8194003bde024cb541a301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820101009365f63783950f5ec3821c1fd677e73c8ac0aa09f0e90b26f1e0c26a75a1c779c9b95260c829120ef0ad03d609c476dfe5a68195a746da8257a99592c5b68f03226c3377c17b32176e07ce5a14413a05241bf614063ba825240ebbcc2a75ddb970413f7cd0633621071f46ff60a491e167bcde1f7e1914c9636791ea67076bb48f8bc06e437dc3a1806cb21ebc53857ddc90a1a4bc2def4672573505bfbb46bb6e6d3799b6ff239291c66e40f88f2956ea5fd55f1453acf04f61eaf722cca7560be2b8341f26d97b1905683fba3cd43806a2d3e68f0ee3b4716d4042c584b440952bf465a04879f61d8163969d4f75e0f87ce48ea9d1f2ad8ab38cc721cdc2ef00043a308204 (5) Message-Authenticator = 0x7cbe966dd0238f8b291b7a1c48ddeb42 (5) State = 0x7f32d9747a35c071723770ef4b853a0b Sending Access-Challenge Id 138 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010703e8194003bde024cb541a301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d01010c050003820101009365f63783950f5ec3821c1fd677e73c8ac0aa09f0e90b26f1e0c26a75a1c779c9b95260c829120ef0ad03d609c476dfe5a68195a746da8257a99592c5b68f03226c3377c17b32176e07ce5a14413a05241bf614063ba825240ebbcc2a75ddb970413f7cd0633621071f46ff60a491e167bcde1f7e1914c9636791ea67076bb48f8bc06e437dc3a1806cb21ebc53857ddc90a1a4bc2def4672573505bfbb46bb6e6d3799b6ff239291c66e40f88f2956ea5fd55f1453acf04f61eaf722cca7560be2b8341f26d97b1905683fba3cd43806a2d3e68f0ee3b4716d4042c584b440952bf465a04879f61d8163969d4f75e0f87ce48ea9d1f2ad8ab38cc721cdc2ef00043a30820 Message-Authenticator = 0x7cbe966dd0238f8b291b7a1c48ddeb42 State = 0x7f32d9747a35c071723770ef4b853a0b (5) Finished request Waking up in 0.3 seconds. Waking up in 1.8 seconds. Received Access-Request Id 139 from 10.250.0.19:32777 to 10.7.0.28:1812 length 302 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020700061900 State = 0x7f32d9747a35c071723770ef4b853a0b Message-Authenticator = 0x1d34b533c22550014d8a2b2c2368443f (6) Received Access-Request packet from host 10.250.0.19 port 32777, id=139, length=302 (6) User-Name = 'myUsername' (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civix-Location (6) Calling-Station-Id = '88:63:df:a5:2a:c7' (6) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (6) NAS-Port = 4 (6) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (6) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (6) Cisco-AVPair = 'mDNS=true' (6) NAS-IP-Address = 10.250.0.19 (6) NAS-Identifier = 'Red 8510' (6) Airespace-Wlan-Id = 8 (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = '477' (6) EAP-Message = 0x020700061900 (6) State = 0x7f32d9747a35c071723770ef4b853a0b (6) Message-Authenticator = 0x1d34b533c22550014d8a2b2c2368443f (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (!&User-Name) (6) if (!&User-Name) -> FALSE (6) if (&User-Name =~ / /) (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@.*@/ ) (6) if (&User-Name =~ /@.*@/ ) -> FALSE (6) if (&User-Name =~ /\\.\\./ ) (6) if (&User-Name =~ /\\.\\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\\.$/) (6) if (&User-Name =~ /\\.$/) -> FALSE (6) if (&User-Name =~ /(a)\\./) (6) if (&User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (6) suffix : Found realm "DEFAULT" (6) suffix : Adding Stripped-User-Name = "myUsername" (6) suffix : Adding Realm = "DEFAULT" (6) suffix : Proxying request from user myUsername to realm DEFAULT (6) suffix : Preparing to proxy authentication request to realm "DEFAULT" (6) [suffix] = updated (6) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (6) [eap] = noop (6) files : users: Matched entry DEFAULT at line 2 (6) [files] = ok (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = updated (6) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (6) pre-proxy { (6) update control { (6) EXPAND %{Calling-Station-Id} (6) --> 88:63:df:a5:2a:c7 (6) Load-Balance-Key := "88:63:df:a5:2a:c7" (6) } # update control = noop (6) [updated] = updated (6) } # pre-proxy = updated (6) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (6) Sending Access-Request packet to host 10.7.0.29 port 1812, id=103, length=0 (6) User-Name = 'myUsername' (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civix-Location (6) Calling-Station-Id = '88:63:df:a5:2a:c7' (6) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (6) NAS-Port = 4 (6) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (6) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (6) Cisco-AVPair = 'mDNS=true' (6) NAS-IP-Address = 10.250.0.19 (6) NAS-Identifier = 'Red 8510' (6) Airespace-Wlan-Id = 8 (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = '477' (6) EAP-Message = 0x020700061900 (6) State = 0x7f32d9747a35c071723770ef4b853a0b (6) Message-Authenticator = 0x1d34b533c22550014d8a2b2c2368443f (6) Event-Timestamp = 'Sep 7 2016 10:45:34 CDT' (6) Stripped-User-Name = 'myUsername' (6) Realm = 'DEFAULT' (6) EAP-Type = PEAP (6) Proxy-State = 0x313339 Sending Access-Request Id 103 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020700061900 State = 0x7f32d9747a35c071723770ef4b853a0b Message-Authenticator = 0x1d34b533c22550014d8a2b2c2368443f Event-Timestamp = 'Sep 7 2016 10:45:34 CDT' Proxy-State = 0x313339 Waking up in 0.3 seconds. Received Access-Challenge Id 103 from 10.7.0.29:1812 to 10.7.0.28:32820 length 1002 EAP-Message = 0x010803a519009437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa7622168152 Message-Authenticator = 0x9f268fb0f8593cd72abd7cfbad1d29ac State = 0x7f32d974793ac071723770ef4b853a0b Proxy-State = 0x313339 (6) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=103, length=1002 (6) EAP-Message = 0x010803a519009437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520 (6) Message-Authenticator = 0x9f268fb0f8593cd72abd7cfbad1d29ac (6) State = 0x7f32d974793ac071723770ef4b853a0b (6) Proxy-State = 0x313339 (6) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (6) post-proxy { (6) eap : No pre-existing handler found (6) [eap] = noop (6) } # post-proxy = noop (6) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=139, length=0 (6) EAP-Message = 0x010803a519009437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520 (6) Message-Authenticator = 0x9f268fb0f8593cd72abd7cfbad1d29ac (6) State = 0x7f32d974793ac071723770ef4b853a0b Sending Access-Challenge Id 139 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010803a519009437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa7622168152 Message-Authenticator = 0x9f268fb0f8593cd72abd7cfbad1d29ac State = 0x7f32d974793ac071723770ef4b853a0b (6) Finished request Waking up in 0.3 seconds. Waking up in 1.2 seconds. Received Access-Request Id 140 from 10.250.0.19:32777 to 10.7.0.28:1812 length 440 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x02080090198000000086160301004610000042410429e8c93c050497d3c969d24265991784e53f8e974d047c0afe53fe094be8aebf1cdb5c532b66bca8e62c0a4de444911ee842ef54549de8d6f1bab50ab3c027e214030100010116030100304ceb36a7e8d6f0939c12ecc9d58fcb1cd48e6ff0c0554cdd9b69c189dd0fc9dcfe74da9b32db30a4ad253d91db07be92 State = 0x7f32d974793ac071723770ef4b853a0b Message-Authenticator = 0xa163342ab96eda59991b0b6c9b4d1ac8 (7) Received Access-Request packet from host 10.250.0.19 port 32777, id=140, length=440 (7) User-Name = 'myUsername' (7) Chargeable-User-Identity = 0x00 (7) Location-Capable = Civix-Location (7) Calling-Station-Id = '88:63:df:a5:2a:c7' (7) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (7) NAS-Port = 4 (7) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (7) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (7) Cisco-AVPair = 'mDNS=true' (7) NAS-IP-Address = 10.250.0.19 (7) NAS-Identifier = 'Red 8510' (7) Airespace-Wlan-Id = 8 (7) Service-Type = Framed-User (7) Framed-MTU = 1300 (7) NAS-Port-Type = Wireless-802.11 (7) Tunnel-Type:0 = VLAN (7) Tunnel-Medium-Type:0 = IEEE-802 (7) Tunnel-Private-Group-Id:0 = '477' (7) EAP-Message = 0x02080090198000000086160301004610000042410429e8c93c050497d3c969d24265991784e53f8e974d047c0afe53fe094be8aebf1cdb5c532b66bca8e62c0a4de444911ee842ef54549de8d6f1bab50ab3c027e214030100010116030100304ceb36a7e8d6f0939c12ecc9d58fcb1cd48e6ff0c0554cdd9b69c189dd0fc9dcfe74da9b32db30a4ad253d91db07be92 (7) State = 0x7f32d974793ac071723770ef4b853a0b (7) Message-Authenticator = 0xa163342ab96eda59991b0b6c9b4d1ac8 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (7) suffix : Found realm "DEFAULT" (7) suffix : Adding Stripped-User-Name = "myUsername" (7) suffix : Adding Realm = "DEFAULT" (7) suffix : Proxying request from user myUsername to realm DEFAULT (7) suffix : Preparing to proxy authentication request to realm "DEFAULT" (7) [suffix] = updated (7) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (7) [eap] = noop (7) files : users: Matched entry DEFAULT at line 2 (7) [files] = ok (7) [expiration] = noop (7) [logintime] = noop (7) [pap] = noop (7) } # authorize = updated (7) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (7) pre-proxy { (7) update control { (7) EXPAND %{Calling-Station-Id} (7) --> 88:63:df:a5:2a:c7 (7) Load-Balance-Key := "88:63:df:a5:2a:c7" (7) } # update control = noop (7) [updated] = updated (7) } # pre-proxy = updated (7) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (7) Sending Access-Request packet to host 10.7.0.29 port 1812, id=156, length=0 (7) User-Name = 'myUsername' (7) Chargeable-User-Identity = 0x00 (7) Location-Capable = Civix-Location (7) Calling-Station-Id = '88:63:df:a5:2a:c7' (7) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (7) NAS-Port = 4 (7) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (7) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (7) Cisco-AVPair = 'mDNS=true' (7) NAS-IP-Address = 10.250.0.19 (7) NAS-Identifier = 'Red 8510' (7) Airespace-Wlan-Id = 8 (7) Service-Type = Framed-User (7) Framed-MTU = 1300 (7) NAS-Port-Type = Wireless-802.11 (7) Tunnel-Type:0 = VLAN (7) Tunnel-Medium-Type:0 = IEEE-802 (7) Tunnel-Private-Group-Id:0 = '477' (7) EAP-Message = 0x02080090198000000086160301004610000042410429e8c93c050497d3c969d24265991784e53f8e974d047c0afe53fe094be8aebf1cdb5c532b66bca8e62c0a4de444911ee842ef54549de8d6f1bab50ab3c027e214030100010116030100304ceb36a7e8d6f0939c12ecc9d58fcb1cd48e6ff0c0554cdd9b69c189dd0fc9dcfe74da9b32db30a4ad253d91db07be92 (7) State = 0x7f32d974793ac071723770ef4b853a0b (7) Message-Authenticator = 0xa163342ab96eda59991b0b6c9b4d1ac8 (7) Event-Timestamp = 'Sep 7 2016 10:45:34 CDT' (7) Stripped-User-Name = 'myUsername' (7) Realm = 'DEFAULT' (7) EAP-Type = PEAP (7) Proxy-State = 0x313430 Sending Access-Request Id 156 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x02080090198000000086160301004610000042410429e8c93c050497d3c969d24265991784e53f8e974d047c0afe53fe094be8aebf1cdb5c532b66bca8e62c0a4de444911ee842ef54549de8d6f1bab50ab3c027e214030100010116030100304ceb36a7e8d6f0939c12ecc9d58fcb1cd48e6ff0c0554cdd9b69c189dd0fc9dcfe74da9b32db30a4ad253d91db07be92 State = 0x7f32d974793ac071723770ef4b853a0b Message-Authenticator = 0xa163342ab96eda59991b0b6c9b4d1ac8 Event-Timestamp = 'Sep 7 2016 10:45:34 CDT' Proxy-State = 0x313430 Waking up in 0.3 seconds. Received Access-Challenge Id 156 from 10.7.0.29:1812 to 10.7.0.28:32820 length 128 EAP-Message = 0x0109004119001403010001011603010030319532f72d4702e3e7168c18318061baa1178d4104ec7b8ff01fd4de7837730400f8c867195e19123d7820fbe26de308 Message-Authenticator = 0xaa8fb77da2b03ee73c0cfacb26d9543a State = 0x7f32d974783bc071723770ef4b853a0b Proxy-State = 0x313430 (7) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=156, length=128 (7) EAP-Message = 0x0109004119001403010001011603010030319532f72d4702e3e7168c18318061baa1178d4104ec7b8ff01fd4de7837730400f8c867195e19123d7820fbe26de308 (7) Message-Authenticator = 0xaa8fb77da2b03ee73c0cfacb26d9543a (7) State = 0x7f32d974783bc071723770ef4b853a0b (7) Proxy-State = 0x313430 (7) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (7) post-proxy { (7) eap : No pre-existing handler found (7) [eap] = noop (7) } # post-proxy = noop (7) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=140, length=0 (7) EAP-Message = 0x0109004119001403010001011603010030319532f72d4702e3e7168c18318061baa1178d4104ec7b8ff01fd4de7837730400f8c867195e19123d7820fbe26de308 (7) Message-Authenticator = 0xaa8fb77da2b03ee73c0cfacb26d9543a (7) State = 0x7f32d974783bc071723770ef4b853a0b Sending Access-Challenge Id 140 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x0109004119001403010001011603010030319532f72d4702e3e7168c18318061baa1178d4104ec7b8ff01fd4de7837730400f8c867195e19123d7820fbe26de308 Message-Authenticator = 0xaa8fb77da2b03ee73c0cfacb26d9543a State = 0x7f32d974783bc071723770ef4b853a0b (7) Finished request Waking up in 0.3 seconds. Waking up in 0.6 seconds. Received Access-Request Id 141 from 10.250.0.19:32777 to 10.7.0.28:1812 length 302 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020900061900 State = 0x7f32d974783bc071723770ef4b853a0b Message-Authenticator = 0x5a346273cf37875c673969c7831b84ec (8) Received Access-Request packet from host 10.250.0.19 port 32777, id=141, length=302 (8) User-Name = 'myUsername' (8) Chargeable-User-Identity = 0x00 (8) Location-Capable = Civix-Location (8) Calling-Station-Id = '88:63:df:a5:2a:c7' (8) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (8) NAS-Port = 4 (8) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (8) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (8) Cisco-AVPair = 'mDNS=true' (8) NAS-IP-Address = 10.250.0.19 (8) NAS-Identifier = 'Red 8510' (8) Airespace-Wlan-Id = 8 (8) Service-Type = Framed-User (8) Framed-MTU = 1300 (8) NAS-Port-Type = Wireless-802.11 (8) Tunnel-Type:0 = VLAN (8) Tunnel-Medium-Type:0 = IEEE-802 (8) Tunnel-Private-Group-Id:0 = '477' (8) EAP-Message = 0x020900061900 (8) State = 0x7f32d974783bc071723770ef4b853a0b (8) Message-Authenticator = 0x5a346273cf37875c673969c7831b84ec (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) filter_username filter_username { (8) if (!&User-Name) (8) if (!&User-Name) -> FALSE (8) if (&User-Name =~ / /) (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@.*@/ ) (8) if (&User-Name =~ /@.*@/ ) -> FALSE (8) if (&User-Name =~ /\\.\\./ ) (8) if (&User-Name =~ /\\.\\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\\.$/) (8) if (&User-Name =~ /\\.$/) -> FALSE (8) if (&User-Name =~ /(a)\\./) (8) if (&User-Name =~ /(a)\\./) -> FALSE (8) } # filter_username filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : Checking for suffix after "@" (8) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (8) suffix : Found realm "DEFAULT" (8) suffix : Adding Stripped-User-Name = "myUsername" (8) suffix : Adding Realm = "DEFAULT" (8) suffix : Proxying request from user myUsername to realm DEFAULT (8) suffix : Preparing to proxy authentication request to realm "DEFAULT" (8) [suffix] = updated (8) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (8) [eap] = noop (8) files : users: Matched entry DEFAULT at line 2 (8) [files] = ok (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (8) pre-proxy { (8) update control { (8) EXPAND %{Calling-Station-Id} (8) --> 88:63:df:a5:2a:c7 (8) Load-Balance-Key := "88:63:df:a5:2a:c7" (8) } # update control = noop (8) [updated] = updated (8) } # pre-proxy = updated (8) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (8) Sending Access-Request packet to host 10.7.0.29 port 1812, id=156, length=0 (8) User-Name = 'myUsername' (8) Chargeable-User-Identity = 0x00 (8) Location-Capable = Civix-Location (8) Calling-Station-Id = '88:63:df:a5:2a:c7' (8) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (8) NAS-Port = 4 (8) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (8) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (8) Cisco-AVPair = 'mDNS=true' (8) NAS-IP-Address = 10.250.0.19 (8) NAS-Identifier = 'Red 8510' (8) Airespace-Wlan-Id = 8 (8) Service-Type = Framed-User (8) Framed-MTU = 1300 (8) NAS-Port-Type = Wireless-802.11 (8) Tunnel-Type:0 = VLAN (8) Tunnel-Medium-Type:0 = IEEE-802 (8) Tunnel-Private-Group-Id:0 = '477' (8) EAP-Message = 0x020900061900 (8) State = 0x7f32d974783bc071723770ef4b853a0b (8) Message-Authenticator = 0x5a346273cf37875c673969c7831b84ec (8) Event-Timestamp = 'Sep 7 2016 10:45:35 CDT' (8) Stripped-User-Name = 'myUsername' (8) Realm = 'DEFAULT' (8) EAP-Type = PEAP (8) Proxy-State = 0x313431 Sending Access-Request Id 156 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020900061900 State = 0x7f32d974783bc071723770ef4b853a0b Message-Authenticator = 0x5a346273cf37875c673969c7831b84ec Event-Timestamp = 'Sep 7 2016 10:45:35 CDT' Proxy-State = 0x313431 Waking up in 0.3 seconds. Received Access-Challenge Id 156 from 10.7.0.29:1812 to 10.7.0.28:32820 length 106 EAP-Message = 0x010a002b19001703010020b994d439e402f8844ffc35d40e1619b45ea52ecc4503846b6479e88004f5b2f6 Message-Authenticator = 0xb559b631e9a05ff09a132b9b18d5f41d State = 0x7f32d9747738c071723770ef4b853a0b Proxy-State = 0x313431 (8) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=156, length=106 (8) EAP-Message = 0x010a002b19001703010020b994d439e402f8844ffc35d40e1619b45ea52ecc4503846b6479e88004f5b2f6 (8) Message-Authenticator = 0xb559b631e9a05ff09a132b9b18d5f41d (8) State = 0x7f32d9747738c071723770ef4b853a0b (8) Proxy-State = 0x313431 (8) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (8) post-proxy { (8) eap : No pre-existing handler found (8) [eap] = noop (8) } # post-proxy = noop (8) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=141, length=0 (8) EAP-Message = 0x010a002b19001703010020b994d439e402f8844ffc35d40e1619b45ea52ecc4503846b6479e88004f5b2f6 (8) Message-Authenticator = 0xb559b631e9a05ff09a132b9b18d5f41d (8) State = 0x7f32d9747738c071723770ef4b853a0b Sending Access-Challenge Id 141 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010a002b19001703010020b994d439e402f8844ffc35d40e1619b45ea52ecc4503846b6479e88004f5b2f6 Message-Authenticator = 0xb559b631e9a05ff09a132b9b18d5f41d State = 0x7f32d9747738c071723770ef4b853a0b (8) Finished request Waking up in 0.3 seconds. Waking up in 0.1 seconds. (0) Cleaning up request packet ID 133 with timestamp +8 Waking up in 0.5 seconds. Received Access-Request Id 142 from 10.250.0.19:32777 to 10.7.0.28:1812 length 339 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020a002b19001703010020e9cb715bd5ec105e20f76cac2c01c5f99230edaa4d52b0e9d1c853dba7ab4aa1 State = 0x7f32d9747738c071723770ef4b853a0b Message-Authenticator = 0xfc94b778553fb1128fab89148506888f (9) Received Access-Request packet from host 10.250.0.19 port 32777, id=142, length=339 (9) User-Name = 'myUsername' (9) Chargeable-User-Identity = 0x00 (9) Location-Capable = Civix-Location (9) Calling-Station-Id = '88:63:df:a5:2a:c7' (9) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (9) NAS-Port = 4 (9) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (9) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (9) Cisco-AVPair = 'mDNS=true' (9) NAS-IP-Address = 10.250.0.19 (9) NAS-Identifier = 'Red 8510' (9) Airespace-Wlan-Id = 8 (9) Service-Type = Framed-User (9) Framed-MTU = 1300 (9) NAS-Port-Type = Wireless-802.11 (9) Tunnel-Type:0 = VLAN (9) Tunnel-Medium-Type:0 = IEEE-802 (9) Tunnel-Private-Group-Id:0 = '477' (9) EAP-Message = 0x020a002b19001703010020e9cb715bd5ec105e20f76cac2c01c5f99230edaa4d52b0e9d1c853dba7ab4aa1 (9) State = 0x7f32d9747738c071723770ef4b853a0b (9) Message-Authenticator = 0xfc94b778553fb1128fab89148506888f (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) filter_username filter_username { (9) if (!&User-Name) (9) if (!&User-Name) -> FALSE (9) if (&User-Name =~ / /) (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@.*@/ ) (9) if (&User-Name =~ /@.*@/ ) -> FALSE (9) if (&User-Name =~ /\\.\\./ ) (9) if (&User-Name =~ /\\.\\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (9) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\\.$/) (9) if (&User-Name =~ /\\.$/) -> FALSE (9) if (&User-Name =~ /(a)\\./) (9) if (&User-Name =~ /(a)\\./) -> FALSE (9) } # filter_username filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : Checking for suffix after "@" (9) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (9) suffix : Found realm "DEFAULT" (9) suffix : Adding Stripped-User-Name = "myUsername" (9) suffix : Adding Realm = "DEFAULT" (9) suffix : Proxying request from user myUsername to realm DEFAULT (9) suffix : Preparing to proxy authentication request to realm "DEFAULT" (9) [suffix] = updated (9) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (9) [eap] = noop (9) files : users: Matched entry DEFAULT at line 2 (9) [files] = ok (9) [expiration] = noop (9) [logintime] = noop (9) [pap] = noop (9) } # authorize = updated (9) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (9) pre-proxy { (9) update control { (9) EXPAND %{Calling-Station-Id} (9) --> 88:63:df:a5:2a:c7 (9) Load-Balance-Key := "88:63:df:a5:2a:c7" (9) } # update control = noop (9) [updated] = updated (9) } # pre-proxy = updated (9) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (9) Sending Access-Request packet to host 10.7.0.29 port 1812, id=14, length=0 (9) User-Name = 'myUsername' (9) Chargeable-User-Identity = 0x00 (9) Location-Capable = Civix-Location (9) Calling-Station-Id = '88:63:df:a5:2a:c7' (9) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (9) NAS-Port = 4 (9) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (9) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (9) Cisco-AVPair = 'mDNS=true' (9) NAS-IP-Address = 10.250.0.19 (9) NAS-Identifier = 'Red 8510' (9) Airespace-Wlan-Id = 8 (9) Service-Type = Framed-User (9) Framed-MTU = 1300 (9) NAS-Port-Type = Wireless-802.11 (9) Tunnel-Type:0 = VLAN (9) Tunnel-Medium-Type:0 = IEEE-802 (9) Tunnel-Private-Group-Id:0 = '477' (9) EAP-Message = 0x020a002b19001703010020e9cb715bd5ec105e20f76cac2c01c5f99230edaa4d52b0e9d1c853dba7ab4aa1 (9) State = 0x7f32d9747738c071723770ef4b853a0b (9) Message-Authenticator = 0xfc94b778553fb1128fab89148506888f (9) Event-Timestamp = 'Sep 7 2016 10:45:35 CDT' (9) Stripped-User-Name = 'myUsername' (9) Realm = 'DEFAULT' (9) EAP-Type = PEAP (9) Proxy-State = 0x313432 Sending Access-Request Id 14 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020a002b19001703010020e9cb715bd5ec105e20f76cac2c01c5f99230edaa4d52b0e9d1c853dba7ab4aa1 State = 0x7f32d9747738c071723770ef4b853a0b Message-Authenticator = 0xfc94b778553fb1128fab89148506888f Event-Timestamp = 'Sep 7 2016 10:45:35 CDT' Proxy-State = 0x313432 Waking up in 0.3 seconds. Received Access-Challenge Id 14 from 10.7.0.29:1812 to 10.7.0.28:32820 length 138 EAP-Message = 0x010b004b190017030100402a952dce06857b01c71e6b3c96bac014777efadb450b19ba9a517729c72562591ede479beb1284a533b040ffb50df9de4b05dbf09b2842cafe56771e0ffb557f Message-Authenticator = 0xa42225b2698c5d719e9068b81cd29a54 State = 0x7f32d9747639c071723770ef4b853a0b Proxy-State = 0x313432 (9) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=14, length=138 (9) EAP-Message = 0x010b004b190017030100402a952dce06857b01c71e6b3c96bac014777efadb450b19ba9a517729c72562591ede479beb1284a533b040ffb50df9de4b05dbf09b2842cafe56771e0ffb557f (9) Message-Authenticator = 0xa42225b2698c5d719e9068b81cd29a54 (9) State = 0x7f32d9747639c071723770ef4b853a0b (9) Proxy-State = 0x313432 (9) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (9) post-proxy { (9) eap : No pre-existing handler found (9) [eap] = noop (9) } # post-proxy = noop (9) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=142, length=0 (9) EAP-Message = 0x010b004b190017030100402a952dce06857b01c71e6b3c96bac014777efadb450b19ba9a517729c72562591ede479beb1284a533b040ffb50df9de4b05dbf09b2842cafe56771e0ffb557f (9) Message-Authenticator = 0xa42225b2698c5d719e9068b81cd29a54 (9) State = 0x7f32d9747639c071723770ef4b853a0b Sending Access-Challenge Id 142 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010b004b190017030100402a952dce06857b01c71e6b3c96bac014777efadb450b19ba9a517729c72562591ede479beb1284a533b040ffb50df9de4b05dbf09b2842cafe56771e0ffb557f Message-Authenticator = 0xa42225b2698c5d719e9068b81cd29a54 State = 0x7f32d9747639c071723770ef4b853a0b (9) Finished request Waking up in 0.3 seconds. Waking up in 0.1 seconds. (1) Cleaning up request packet ID 134 with timestamp +9 Waking up in 0.5 seconds. Received Access-Request Id 143 from 10.250.0.19:32777 to 10.7.0.28:1812 length 403 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020b006b190017030100602da275e2c0a123497d8f596416abddf9cc8541b7f81ea401e9f1cd2ca4a58622009c16cdb4fecaab55fcbd546ea4a4ab945805dd9bdf5806893b788e67e76f3dddcdaf38e70b1e1742270592e954b3fca8c138c6d7e5f257868cc3722d3c2895 State = 0x7f32d9747639c071723770ef4b853a0b Message-Authenticator = 0xc242bff0076b825acf333cbe51605d0d (10) Received Access-Request packet from host 10.250.0.19 port 32777, id=143, length=403 (10) User-Name = 'myUsername' (10) Chargeable-User-Identity = 0x00 (10) Location-Capable = Civix-Location (10) Calling-Station-Id = '88:63:df:a5:2a:c7' (10) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (10) NAS-Port = 4 (10) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (10) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (10) Cisco-AVPair = 'mDNS=true' (10) NAS-IP-Address = 10.250.0.19 (10) NAS-Identifier = 'Red 8510' (10) Airespace-Wlan-Id = 8 (10) Service-Type = Framed-User (10) Framed-MTU = 1300 (10) NAS-Port-Type = Wireless-802.11 (10) Tunnel-Type:0 = VLAN (10) Tunnel-Medium-Type:0 = IEEE-802 (10) Tunnel-Private-Group-Id:0 = '477' (10) EAP-Message = 0x020b006b190017030100602da275e2c0a123497d8f596416abddf9cc8541b7f81ea401e9f1cd2ca4a58622009c16cdb4fecaab55fcbd546ea4a4ab945805dd9bdf5806893b788e67e76f3dddcdaf38e70b1e1742270592e954b3fca8c138c6d7e5f257868cc3722d3c2895 (10) State = 0x7f32d9747639c071723770ef4b853a0b (10) Message-Authenticator = 0xc242bff0076b825acf333cbe51605d0d (10) # Executing section authorize from file /etc/raddb/sites-enabled/default (10) authorize { (10) filter_username filter_username { (10) if (!&User-Name) (10) if (!&User-Name) -> FALSE (10) if (&User-Name =~ / /) (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@.*@/ ) (10) if (&User-Name =~ /@.*@/ ) -> FALSE (10) if (&User-Name =~ /\\.\\./ ) (10) if (&User-Name =~ /\\.\\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (10) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\\.$/) (10) if (&User-Name =~ /\\.$/) -> FALSE (10) if (&User-Name =~ /(a)\\./) (10) if (&User-Name =~ /(a)\\./) -> FALSE (10) } # filter_username filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix : Checking for suffix after "@" (10) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (10) suffix : Found realm "DEFAULT" (10) suffix : Adding Stripped-User-Name = "myUsername" (10) suffix : Adding Realm = "DEFAULT" (10) suffix : Proxying request from user myUsername to realm DEFAULT (10) suffix : Preparing to proxy authentication request to realm "DEFAULT" (10) [suffix] = updated (10) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (10) [eap] = noop (10) files : users: Matched entry DEFAULT at line 2 (10) [files] = ok (10) [expiration] = noop (10) [logintime] = noop (10) [pap] = noop (10) } # authorize = updated (10) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (10) pre-proxy { (10) update control { (10) EXPAND %{Calling-Station-Id} (10) --> 88:63:df:a5:2a:c7 (10) Load-Balance-Key := "88:63:df:a5:2a:c7" (10) } # update control = noop (10) [updated] = updated (10) } # pre-proxy = updated (10) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (10) Sending Access-Request packet to host 10.7.0.29 port 1812, id=183, length=0 (10) User-Name = 'myUsername' (10) Chargeable-User-Identity = 0x00 (10) Location-Capable = Civix-Location (10) Calling-Station-Id = '88:63:df:a5:2a:c7' (10) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (10) NAS-Port = 4 (10) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (10) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (10) Cisco-AVPair = 'mDNS=true' (10) NAS-IP-Address = 10.250.0.19 (10) NAS-Identifier = 'Red 8510' (10) Airespace-Wlan-Id = 8 (10) Service-Type = Framed-User (10) Framed-MTU = 1300 (10) NAS-Port-Type = Wireless-802.11 (10) Tunnel-Type:0 = VLAN (10) Tunnel-Medium-Type:0 = IEEE-802 (10) Tunnel-Private-Group-Id:0 = '477' (10) EAP-Message = 0x020b006b190017030100602da275e2c0a123497d8f596416abddf9cc8541b7f81ea401e9f1cd2ca4a58622009c16cdb4fecaab55fcbd546ea4a4ab945805dd9bdf5806893b788e67e76f3dddcdaf38e70b1e1742270592e954b3fca8c138c6d7e5f257868cc3722d3c2895 (10) State = 0x7f32d9747639c071723770ef4b853a0b (10) Message-Authenticator = 0xc242bff0076b825acf333cbe51605d0d (10) Event-Timestamp = 'Sep 7 2016 10:45:36 CDT' (10) Stripped-User-Name = 'myUsername' (10) Realm = 'DEFAULT' (10) EAP-Type = PEAP (10) Proxy-State = 0x313433 Sending Access-Request Id 183 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020b006b190017030100602da275e2c0a123497d8f596416abddf9cc8541b7f81ea401e9f1cd2ca4a58622009c16cdb4fecaab55fcbd546ea4a4ab945805dd9bdf5806893b788e67e76f3dddcdaf38e70b1e1742270592e954b3fca8c138c6d7e5f257868cc3722d3c2895 State = 0x7f32d9747639c071723770ef4b853a0b Message-Authenticator = 0xc242bff0076b825acf333cbe51605d0d Event-Timestamp = 'Sep 7 2016 10:45:36 CDT' Proxy-State = 0x313433 Waking up in 0.3 seconds. Waking up in 0.1 seconds. (10) Expecting proxy response no later than 19.499791 seconds from now (2) Cleaning up request packet ID 135 with timestamp +9 Waking up in 0.5 seconds. Received Access-Challenge Id 183 from 10.7.0.29:1812 to 10.7.0.28:32820 length 154 EAP-Message = 0x010c005b19001703010050e28c28af0b5f0499c200f091c5e6c4b4c6692a23e0a5b08c3a79b24afbf72c73c0d044c22dbeca8c2b8f6d6299df9c0ace358170c817f2e82ead03f44fa56c38bfc8bb4677604d57caf831c27c7ea841 Message-Authenticator = 0x60dce85f1339f1fa27a3d9b3015d5395 State = 0x7f32d974753ec071723770ef4b853a0b Proxy-State = 0x313433 (10) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=183, length=154 (10) EAP-Message = 0x010c005b19001703010050e28c28af0b5f0499c200f091c5e6c4b4c6692a23e0a5b08c3a79b24afbf72c73c0d044c22dbeca8c2b8f6d6299df9c0ace358170c817f2e82ead03f44fa56c38bfc8bb4677604d57caf831c27c7ea841 (10) Message-Authenticator = 0x60dce85f1339f1fa27a3d9b3015d5395 (10) State = 0x7f32d974753ec071723770ef4b853a0b (10) Proxy-State = 0x313433 (10) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (10) post-proxy { (10) eap : No pre-existing handler found (10) [eap] = noop (10) } # post-proxy = noop (10) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=143, length=0 (10) EAP-Message = 0x010c005b19001703010050e28c28af0b5f0499c200f091c5e6c4b4c6692a23e0a5b08c3a79b24afbf72c73c0d044c22dbeca8c2b8f6d6299df9c0ace358170c817f2e82ead03f44fa56c38bfc8bb4677604d57caf831c27c7ea841 (10) Message-Authenticator = 0x60dce85f1339f1fa27a3d9b3015d5395 (10) State = 0x7f32d974753ec071723770ef4b853a0b Sending Access-Challenge Id 143 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010c005b19001703010050e28c28af0b5f0499c200f091c5e6c4b4c6692a23e0a5b08c3a79b24afbf72c73c0d044c22dbeca8c2b8f6d6299df9c0ace358170c817f2e82ead03f44fa56c38bfc8bb4677604d57caf831c27c7ea841 Message-Authenticator = 0x60dce85f1339f1fa27a3d9b3015d5395 State = 0x7f32d974753ec071723770ef4b853a0b (10) Finished request (3) Cleaning up request packet ID 136 with timestamp +10 Waking up in 0.3 seconds. Waking up in 0.2 seconds. Received Access-Request Id 144 from 10.250.0.19:32777 to 10.7.0.28:1812 length 339 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020c002b19001703010020911ecd2d497a5e7dae6ad8d5c34f8a92e478d38e2983c8df3ada40d274fc1590 State = 0x7f32d974753ec071723770ef4b853a0b Message-Authenticator = 0x578cbfc6ebd90cea760bf130e5c2b704 (11) Received Access-Request packet from host 10.250.0.19 port 32777, id=144, length=339 (11) User-Name = 'myUsername' (11) Chargeable-User-Identity = 0x00 (11) Location-Capable = Civix-Location (11) Calling-Station-Id = '88:63:df:a5:2a:c7' (11) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (11) NAS-Port = 4 (11) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (11) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (11) Cisco-AVPair = 'mDNS=true' (11) NAS-IP-Address = 10.250.0.19 (11) NAS-Identifier = 'Red 8510' (11) Airespace-Wlan-Id = 8 (11) Service-Type = Framed-User (11) Framed-MTU = 1300 (11) NAS-Port-Type = Wireless-802.11 (11) Tunnel-Type:0 = VLAN (11) Tunnel-Medium-Type:0 = IEEE-802 (11) Tunnel-Private-Group-Id:0 = '477' (11) EAP-Message = 0x020c002b19001703010020911ecd2d497a5e7dae6ad8d5c34f8a92e478d38e2983c8df3ada40d274fc1590 (11) State = 0x7f32d974753ec071723770ef4b853a0b (11) Message-Authenticator = 0x578cbfc6ebd90cea760bf130e5c2b704 (11) # Executing section authorize from file /etc/raddb/sites-enabled/default (11) authorize { (11) filter_username filter_username { (11) if (!&User-Name) (11) if (!&User-Name) -> FALSE (11) if (&User-Name =~ / /) (11) if (&User-Name =~ / /) -> FALSE (11) if (&User-Name =~ /@.*@/ ) (11) if (&User-Name =~ /@.*@/ ) -> FALSE (11) if (&User-Name =~ /\\.\\./ ) (11) if (&User-Name =~ /\\.\\./ ) -> FALSE (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (11) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (11) if (&User-Name =~ /\\.$/) (11) if (&User-Name =~ /\\.$/) -> FALSE (11) if (&User-Name =~ /(a)\\./) (11) if (&User-Name =~ /(a)\\./) -> FALSE (11) } # filter_username filter_username = notfound (11) [preprocess] = ok (11) [chap] = noop (11) [mschap] = noop (11) [digest] = noop (11) suffix : Checking for suffix after "@" (11) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (11) suffix : Found realm "DEFAULT" (11) suffix : Adding Stripped-User-Name = "myUsername" (11) suffix : Adding Realm = "DEFAULT" (11) suffix : Proxying request from user myUsername to realm DEFAULT (11) suffix : Preparing to proxy authentication request to realm "DEFAULT" (11) [suffix] = updated (11) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (11) [eap] = noop (11) files : users: Matched entry DEFAULT at line 2 (11) [files] = ok (11) [expiration] = noop (11) [logintime] = noop (11) [pap] = noop (11) } # authorize = updated (11) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (11) pre-proxy { (11) update control { (11) EXPAND %{Calling-Station-Id} (11) --> 88:63:df:a5:2a:c7 (11) Load-Balance-Key := "88:63:df:a5:2a:c7" (11) } # update control = noop (11) [updated] = updated (11) } # pre-proxy = updated (11) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (11) Sending Access-Request packet to host 10.7.0.29 port 1812, id=253, length=0 (11) User-Name = 'myUsername' (11) Chargeable-User-Identity = 0x00 (11) Location-Capable = Civix-Location (11) Calling-Station-Id = '88:63:df:a5:2a:c7' (11) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (11) NAS-Port = 4 (11) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (11) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (11) Cisco-AVPair = 'mDNS=true' (11) NAS-IP-Address = 10.250.0.19 (11) NAS-Identifier = 'Red 8510' (11) Airespace-Wlan-Id = 8 (11) Service-Type = Framed-User (11) Framed-MTU = 1300 (11) NAS-Port-Type = Wireless-802.11 (11) Tunnel-Type:0 = VLAN (11) Tunnel-Medium-Type:0 = IEEE-802 (11) Tunnel-Private-Group-Id:0 = '477' (11) EAP-Message = 0x020c002b19001703010020911ecd2d497a5e7dae6ad8d5c34f8a92e478d38e2983c8df3ada40d274fc1590 (11) State = 0x7f32d974753ec071723770ef4b853a0b (11) Message-Authenticator = 0x578cbfc6ebd90cea760bf130e5c2b704 (11) Event-Timestamp = 'Sep 7 2016 10:45:37 CDT' (11) Stripped-User-Name = 'myUsername' (11) Realm = 'DEFAULT' (11) EAP-Type = PEAP (11) Proxy-State = 0x313434 Sending Access-Request Id 253 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020c002b19001703010020911ecd2d497a5e7dae6ad8d5c34f8a92e478d38e2983c8df3ada40d274fc1590 State = 0x7f32d974753ec071723770ef4b853a0b Message-Authenticator = 0x578cbfc6ebd90cea760bf130e5c2b704 Event-Timestamp = 'Sep 7 2016 10:45:37 CDT' Proxy-State = 0x313434 (4) Cleaning up request packet ID 137 with timestamp +10 Waking up in 0.2 seconds. Waking up in 0.1 seconds. (11) Expecting proxy response no later than 19.499789 seconds from now Waking up in 0.1 seconds. (5) Cleaning up request packet ID 138 with timestamp +11 Waking up in 0.5 seconds. Received Access-Challenge Id 253 from 10.7.0.29:1812 to 10.7.0.28:32820 length 106 EAP-Message = 0x010d002b190017030100200403349d9bc7d3fcb0026f77dec021dab2ea898176664dd8b72b2a4f5a3a05c2 Message-Authenticator = 0x300f82004967dab208d08d9bc44e0faa State = 0x7f32d974743fc071723770ef4b853a0b Proxy-State = 0x313434 (11) Received Access-Challenge packet from host 10.7.0.29 port 1812, id=253, length=106 (11) EAP-Message = 0x010d002b190017030100200403349d9bc7d3fcb0026f77dec021dab2ea898176664dd8b72b2a4f5a3a05c2 (11) Message-Authenticator = 0x300f82004967dab208d08d9bc44e0faa (11) State = 0x7f32d974743fc071723770ef4b853a0b (11) Proxy-State = 0x313434 (11) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (11) post-proxy { (11) eap : No pre-existing handler found (11) [eap] = noop (11) } # post-proxy = noop (11) Sending Access-Challenge packet to host 10.250.0.19 port 32777, id=144, length=0 (11) EAP-Message = 0x010d002b190017030100200403349d9bc7d3fcb0026f77dec021dab2ea898176664dd8b72b2a4f5a3a05c2 (11) Message-Authenticator = 0x300f82004967dab208d08d9bc44e0faa (11) State = 0x7f32d974743fc071723770ef4b853a0b Sending Access-Challenge Id 144 from 10.7.0.28:1812 to 10.250.0.19:32777 EAP-Message = 0x010d002b190017030100200403349d9bc7d3fcb0026f77dec021dab2ea898176664dd8b72b2a4f5a3a05c2 Message-Authenticator = 0x300f82004967dab208d08d9bc44e0faa State = 0x7f32d974743fc071723770ef4b853a0b (11) Finished request (6) Cleaning up request packet ID 139 with timestamp +12 Waking up in 0.2 seconds. Waking up in 0.3 seconds. Received Access-Request Id 145 from 10.250.0.19:32777 to 10.7.0.28:1812 length 339 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020d002b19001703010020f5be6094de8c99ffc9a8273924c8a31d6ff7972691b7ada6632f5872eedfbb55 State = 0x7f32d974743fc071723770ef4b853a0b Message-Authenticator = 0xfcfa5d93078a1affcb6cb3e7b745229e (12) Received Access-Request packet from host 10.250.0.19 port 32777, id=145, length=339 (12) User-Name = 'myUsername' (12) Chargeable-User-Identity = 0x00 (12) Location-Capable = Civix-Location (12) Calling-Station-Id = '88:63:df:a5:2a:c7' (12) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (12) NAS-Port = 4 (12) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (12) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (12) Cisco-AVPair = 'mDNS=true' (12) NAS-IP-Address = 10.250.0.19 (12) NAS-Identifier = 'Red 8510' (12) Airespace-Wlan-Id = 8 (12) Service-Type = Framed-User (12) Framed-MTU = 1300 (12) NAS-Port-Type = Wireless-802.11 (12) Tunnel-Type:0 = VLAN (12) Tunnel-Medium-Type:0 = IEEE-802 (12) Tunnel-Private-Group-Id:0 = '477' (12) EAP-Message = 0x020d002b19001703010020f5be6094de8c99ffc9a8273924c8a31d6ff7972691b7ada6632f5872eedfbb55 (12) State = 0x7f32d974743fc071723770ef4b853a0b (12) Message-Authenticator = 0xfcfa5d93078a1affcb6cb3e7b745229e (12) # Executing section authorize from file /etc/raddb/sites-enabled/default (12) authorize { (12) filter_username filter_username { (12) if (!&User-Name) (12) if (!&User-Name) -> FALSE (12) if (&User-Name =~ / /) (12) if (&User-Name =~ / /) -> FALSE (12) if (&User-Name =~ /@.*@/ ) (12) if (&User-Name =~ /@.*@/ ) -> FALSE (12) if (&User-Name =~ /\\.\\./ ) (12) if (&User-Name =~ /\\.\\./ ) -> FALSE (12) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (12) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (12) if (&User-Name =~ /\\.$/) (12) if (&User-Name =~ /\\.$/) -> FALSE (12) if (&User-Name =~ /(a)\\./) (12) if (&User-Name =~ /(a)\\./) -> FALSE (12) } # filter_username filter_username = notfound (12) [preprocess] = ok (12) [chap] = noop (12) [mschap] = noop (12) [digest] = noop (12) suffix : Checking for suffix after "@" (12) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (12) suffix : Found realm "DEFAULT" (12) suffix : Adding Stripped-User-Name = "myUsername" (12) suffix : Adding Realm = "DEFAULT" (12) suffix : Proxying request from user myUsername to realm DEFAULT (12) suffix : Preparing to proxy authentication request to realm "DEFAULT" (12) [suffix] = updated (12) eap : Request is supposed to be proxied to Realm DEFAULT. Not doing EAP. (12) [eap] = noop (12) files : users: Matched entry DEFAULT at line 2 (12) [files] = ok (12) [expiration] = noop (12) [logintime] = noop (12) [pap] = noop (12) } # authorize = updated (12) # Executing section pre-proxy from file /etc/raddb/sites-enabled/default (12) pre-proxy { (12) update control { (12) EXPAND %{Calling-Station-Id} (12) --> 88:63:df:a5:2a:c7 (12) Load-Balance-Key := "88:63:df:a5:2a:c7" (12) } # update control = noop (12) [updated] = updated (12) } # pre-proxy = updated (12) Proxying request to home server 10.7.0.29 port 1812 timeout 20.000000 (12) Sending Access-Request packet to host 10.7.0.29 port 1812, id=118, length=0 (12) User-Name = 'myUsername' (12) Chargeable-User-Identity = 0x00 (12) Location-Capable = Civix-Location (12) Calling-Station-Id = '88:63:df:a5:2a:c7' (12) Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' (12) NAS-Port = 4 (12) Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' (12) Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' (12) Cisco-AVPair = 'mDNS=true' (12) NAS-IP-Address = 10.250.0.19 (12) NAS-Identifier = 'Red 8510' (12) Airespace-Wlan-Id = 8 (12) Service-Type = Framed-User (12) Framed-MTU = 1300 (12) NAS-Port-Type = Wireless-802.11 (12) Tunnel-Type:0 = VLAN (12) Tunnel-Medium-Type:0 = IEEE-802 (12) Tunnel-Private-Group-Id:0 = '477' (12) EAP-Message = 0x020d002b19001703010020f5be6094de8c99ffc9a8273924c8a31d6ff7972691b7ada6632f5872eedfbb55 (12) State = 0x7f32d974743fc071723770ef4b853a0b (12) Message-Authenticator = 0xfcfa5d93078a1affcb6cb3e7b745229e (12) Event-Timestamp = 'Sep 7 2016 10:45:39 CDT' (12) Stripped-User-Name = 'myUsername' (12) Realm = 'DEFAULT' (12) EAP-Type = PEAP (12) Proxy-State = 0x313435 Sending Access-Request Id 118 from 0.0.0.0:32820 to 10.7.0.29:1812 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '88:63:df:a5:2a:c7' Called-Station-Id = '7c:95:f3:74:d7:00:myOrg Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a0123a7ea281ed057' Acct-Session-Id = '57d01e28/88:63:df:a5:2a:c7/12483975' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.250.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020d002b19001703010020f5be6094de8c99ffc9a8273924c8a31d6ff7972691b7ada6632f5872eedfbb55 State = 0x7f32d974743fc071723770ef4b853a0b Message-Authenticator = 0xfcfa5d93078a1affcb6cb3e7b745229e Event-Timestamp = 'Sep 7 2016 10:45:39 CDT' Proxy-State = 0x313435 Received Access-Accept Id 118 from 10.7.0.29:1812 to 10.7.0.28:32820 length 174 MS-MPPE-Recv-Key = 0x87d6d56616f17435791ec25e960ef9fcbb21bd47bdb2eb1c15159c36c9bb784f MS-MPPE-Send-Key = 0x307ca9d1487812fefdd04427922b02676fde3978a1525dd9fdfc1580209c606f EAP-Message = 0x030d0004 Message-Authenticator = 0x724b9960b386632612c62d9408baf6f5 User-Name = 'myUsername' Proxy-State = 0x313435 (12) Received Access-Accept packet from host 10.7.0.29 port 1812, id=118, length=174 (12) MS-MPPE-Recv-Key = 0x87d6d56616f17435791ec25e960ef9fcbb21bd47bdb2eb1c15159c36c9bb784f (12) MS-MPPE-Send-Key = 0x307ca9d1487812fefdd04427922b02676fde3978a1525dd9fdfc1580209c606f (12) EAP-Message = 0x030d0004 (12) Message-Authenticator = 0x724b9960b386632612c62d9408baf6f5 (12) User-Name = 'myUsername' (12) Proxy-State = 0x313435 (12) # Executing section post-proxy from file /etc/raddb/sites-enabled/default (12) post-proxy { (12) eap : No pre-existing handler found (12) [eap] = noop (12) } # post-proxy = noop (12) Found Auth-Type = Accept (12) Auth-Type = Accept, accepting the user (12) # Executing section post-auth from file /etc/raddb/sites-enabled/default (12) post-auth { (12) [exec] = noop (12) remove_reply_message_if_eap remove_reply_message_if_eap { (12) if (&reply:EAP-Message && &reply:Reply-Message) (12) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (12) else else { (12) [noop] = noop (12) } # else else = noop (12) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (12) } # post-auth = noop (12) Sending Access-Accept packet to host 10.250.0.19 port 32777, id=145, length=0 (12) MS-MPPE-Recv-Key = 0x87d6d56616f17435791ec25e960ef9fcbb21bd47bdb2eb1c15159c36c9bb784f (12) MS-MPPE-Send-Key = 0x307ca9d1487812fefdd04427922b02676fde3978a1525dd9fdfc1580209c606f (12) EAP-Message = 0x030d0004 (12) Message-Authenticator = 0x724b9960b386632612c62d9408baf6f5 (12) User-Name = 'myUsername' Sending Access-Accept Id 145 from 10.7.0.28:1812 to 10.250.0.19:32777 MS-MPPE-Recv-Key = 0x87d6d56616f17435791ec25e960ef9fcbb21bd47bdb2eb1c15159c36c9bb784f MS-MPPE-Send-Key = 0x307ca9d1487812fefdd04427922b02676fde3978a1525dd9fdfc1580209c606f EAP-Message = 0x030d0004 Message-Authenticator = 0x724b9960b386632612c62d9408baf6f5 User-Name = 'myUsername' (12) Finished request (7) Cleaning up request packet ID 140 with timestamp +12 Waking up in 0.2 seconds. Waking up in 0.3 seconds. (8) Cleaning up request packet ID 141 with timestamp +13 Waking up in 0.5 seconds. (9) Cleaning up request packet ID 142 with timestamp +13 Waking up in 1.6 seconds. (10) Cleaning up request packet ID 143 with timestamp +14 Waking up in 1.6 seconds. https://directory.uark.edu/people/sgardne Senior Network Engineer University of Arkansas, ITS-NET

2 6

Lots and lots of elseifs in sites-enabled/default
by Clayton Knorr 07 Sep '16

07 Sep '16

I'm working on setting up a radius environment for wifi authentication with an LDAP backend. It is a multi-location deal and I'm going to have over 500 different SSIDs each requiring different LDAP attributes to match. So, there will be a long list something like the below. Anybody think that is going to cause significant delays or make freeradius poop itself? post-auth { ldap.authorize if ( Called-Station-Id =~ /AC-86-74-76-21-.*:SSID1/ && reply:My-Local-String == "140599" ) { noop } elsif ( Called-Station-Id =~ /AC-86-74-90-AD-.*:SSID2/ && reply:My-Local-String == "330492" ) { noop } .....Repeat 500 times else { reject }

3 2

Change to Samba default config in Samba 4.5.0
by Matthew Newton 07 Sep '16

07 Sep '16

Just for this lists attention as it may affect some people here. Note the warning at the top of the latest Samba Release Notes, copied below. I haven't tested it, but it could potentially affect people authenticating against Samba as a domain controller (but probably not winbind to Microsoft AD). Probably another good hint that MSCHAPv2 is ancient, and something like EAP-TLS would be more appropriate today... :) Thanks, Matthew Release Announcements --------------------- This is the first stable release of the Samba 4.5 release series. UPGRADING ========= NTLMv1 authentication disabled by default ----------------------------------------- In order to improve security we have changed the default value for the "ntlm auth" option from "yes" to "no". This may have impact on very old clients which doesn't support NTLMv2 yet. The primary user of NTLMv1 is MSCHAPv2 for VPNs and 802.1x. By default, Samba will only allow NTLMv2 via NTLMSSP now, as we have the following default "lanman auth = no", "ntlm auth = no" and "raw NTLMv2 auth = no". ..... ----- End forwarded message ----- -- Matthew Newton, Ph.D. <mcn4(a)leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0

Windows: Client Certificate but User Password
by Michael Schwartzkopff 07 Sep '16

07 Sep '16

Hi, I want to use FreeRADIUS as the AAA backend for 802.1x portsecurity. The windows clients should send the username/password (PEAP/MS-CHAPv2) when a user is logged in. If no user is logged in, the windows client should send its client certificate. FR can check that certificate and authorize the client. My problem is: In Windows 7 I can configure either to use PEAP (Password) OR certificates. But I cannot choose PEAP for user and certificate for client authentication. Has anybody seen this? Anybody for a solution to that problem? Mit freundlichen Grüßen, Michael Schwartzkopff -- [*] sys4 AG http://sys4.de, +49 (89) 30 90 46 64, +49 (162) 165 0044 Schleißheimer Straße 26/MG, 80333 München Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263 Vorstand: Patrick Ben Koetter, Marc Schiffbauer Aufsichtsratsvorsitzender: Florian Kirstein

1 0

string manipulation
by Willy Offermans 06 Sep '16

06 Sep '16

Dear freeradius friends, I have the following in the accounting section of my sites-enabled/default file: <snip> if ( request:Asterisk-Unique-ID ) { update request { Acct-Session-Time := &Asterisk-Bill-Sec Called-Station-Id := &Asterisk-Last-Data Calling-Station-Id := &Asterisk-Src Connect-Info := &Asterisk-Disposition # NAS-Port-Type := "Asterisk CDR" } } </snip> The data in Asterisk-Last-Data is something like SIP/7874338439@SIPprovider. I would like to save only the 7874338439 data in Called-Station-Id. So I need something like a sed or awk command to strip out the right data. Something equivalent as `echo 'SIP/7874338439@SIPProv' | sed 's/[a-Z/@]//g'` How can this be achieved within freeradius? -- Met vriendelijke groeten, With kind regards, Mit freundlichen Gruessen, De jrus wah, Will ************************************* W.K. Offermans Powered by .... (__) \\\'',) \/ \ ^ .\._/_) www.FreeBSD.org

3 2

EAP through proxy not working
by Scott McLane Gardner 06 Sep '16

06 Sep '16

I am trying to proxy eap requests from my wireless users (Cisco 5500 controller) but I'm getting error messages. When I point the controller directly at the radius server and not the proxy, it works fine. Here's the debug from the back-end radius server, I can give the proxy debug too, if necessary. I'm sure the answer I'm missing is somewhere in this section: <snip> (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { rlm_eap (EAP): No EAP session matching state 0x8acdf80a8acffcab (8) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (8) eap : Failed in handler (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect: [sgardne] (from client radproxy01.uark.edu port 4 cli 88:63:df:a5:2a:c7) </snip> Full debug here: Received Access-Request Id 19 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020900080319152b State = 0xad99bf40ad90bb81ebfc470b102b754e Message-Authenticator = 0x6951ea386bc9c4de5deb4c75ad04312e Event-Timestamp = 'Sep 6 2016 09:10:46 CDT' Proxy-State = 0x313234 (5) Received Access-Request packet from host 10.7.0.28 port 32775, id=19, length=315 (5) User-Name = 'myUsername' (5) Chargeable-User-Identity = 0x00 (5) Location-Capable = Civix-Location (5) Calling-Station-Id = '22:44:66:88:00:11' (5) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (5) NAS-Port = 4 (5) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (5) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (5) Cisco-AVPair = 'mDNS=true' (5) NAS-IP-Address = 10.0.0.19 (5) NAS-Identifier = 'Red 8510' (5) Airespace-Wlan-Id = 8 (5) Service-Type = Framed-User (5) Framed-MTU = 1300 (5) NAS-Port-Type = Wireless-802.11 (5) Tunnel-Type:0 = VLAN (5) Tunnel-Medium-Type:0 = IEEE-802 (5) Tunnel-Private-Group-Id:0 = '477' (5) EAP-Message = 0x020900080319152b (5) State = 0xad99bf40ad90bb81ebfc470b102b754e (5) Message-Authenticator = 0x6951ea386bc9c4de5deb4c75ad04312e (5) Event-Timestamp = 'Sep 6 2016 09:10:46 CDT' (5) Proxy-State = 0x313234 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) if (!&User-Name) (5) if (!&User-Name) -> FALSE (5) if (&User-Name =~ / /) (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@.*@/ ) (5) if (&User-Name =~ /@.*@/ ) -> FALSE (5) if (&User-Name =~ /\\.\\./ ) (5) if (&User-Name =~ /\\.\\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\\.$/) (5) if (&User-Name =~ /\\.$/) -> FALSE (5) if (&User-Name =~ /(a)\\./) (5) if (&User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (5) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (5) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (5) auth_log : EXPAND %t (5) auth_log : --> Tue Sep 6 09:10:46 2016 (5) [auth_log] = ok (5) [mschap] = noop (5) suffix : Checking for suffix after "@" (5) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : Peer sent code Response (2) ID 9 length 8 (5) eap : No EAP Start, assuming it's an on-going EAP conversation (5) [eap] = updated rlm_ldap (ldap): Reserved connection (8) (5) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (5) ldap : --> (sAMAccountName=myUsername) (5) ldap : EXPAND dc=mySite,dc=org (5) ldap : --> dc=mySite,dc=org (5) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (5) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (5) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (5) ldap : Processing user attributes (5) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (5) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (8) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (9) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (5) [ldap] = ok (5) [expiration] = noop (5) [logintime] = noop (5) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (5) WARNING: pap : Authentication will fail unless a "known good" password is available (5) [pap] = noop (5) } # authorize = updated (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { rlm_eap (EAP): No EAP session matching state 0xad99bf40ad90bb81 (5) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (5) eap : Failed in handler (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/raddb/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject : EXPAND %{User-Name} (5) attr_filter.access_reject : --> myUsername (5) attr_filter.access_reject : Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0xad99bf40ad90bb81 (5) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (5) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (5) [eap] = noop (5) remove_reply_message_if_eap remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else else { (5) [noop] = noop (5) } # else else = noop (5) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1 seconds Waking up in 0.9 seconds. Received Access-Request Id 19 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 (5) Discarding duplicate request from client radproxy01.mySite.org port 32775 - ID: 19 due to delayed response (5) Sending delayed response (5) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=19, length=0 (5) Proxy-State = 0x313234 Sending Access-Reject Id 19 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313234 Waking up in 3.9 seconds. Received Access-Request Id 242 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020f00080319152b State = 0xbc6406acbc6b02b16e73611e9c1c8af8 Message-Authenticator = 0x88428ea4082430ec78f14d881ffae5c9 Event-Timestamp = 'Sep 6 2016 09:10:50 CDT' Proxy-State = 0x313238 (6) Received Access-Request packet from host 10.7.0.28 port 32775, id=242, length=315 (6) User-Name = 'myUsername' (6) Chargeable-User-Identity = 0x00 (6) Location-Capable = Civix-Location (6) Calling-Station-Id = '22:44:66:88:00:11' (6) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (6) NAS-Port = 4 (6) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (6) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (6) Cisco-AVPair = 'mDNS=true' (6) NAS-IP-Address = 10.0.0.19 (6) NAS-Identifier = 'Red 8510' (6) Airespace-Wlan-Id = 8 (6) Service-Type = Framed-User (6) Framed-MTU = 1300 (6) NAS-Port-Type = Wireless-802.11 (6) Tunnel-Type:0 = VLAN (6) Tunnel-Medium-Type:0 = IEEE-802 (6) Tunnel-Private-Group-Id:0 = '477' (6) EAP-Message = 0x020f00080319152b (6) State = 0xbc6406acbc6b02b16e73611e9c1c8af8 (6) Message-Authenticator = 0x88428ea4082430ec78f14d881ffae5c9 (6) Event-Timestamp = 'Sep 6 2016 09:10:50 CDT' (6) Proxy-State = 0x313238 (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (!&User-Name) (6) if (!&User-Name) -> FALSE (6) if (&User-Name =~ / /) (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@.*@/ ) (6) if (&User-Name =~ /@.*@/ ) -> FALSE (6) if (&User-Name =~ /\\.\\./ ) (6) if (&User-Name =~ /\\.\\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\\.$/) (6) if (&User-Name =~ /\\.$/) -> FALSE (6) if (&User-Name =~ /(a)\\./) (6) if (&User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (6) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (6) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (6) auth_log : EXPAND %t (6) auth_log : --> Tue Sep 6 09:10:50 2016 (6) [auth_log] = ok (6) [mschap] = noop (6) suffix : Checking for suffix after "@" (6) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : Peer sent code Response (2) ID 15 length 8 (6) eap : No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated rlm_ldap (ldap): Reserved connection (9) (6) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (6) ldap : --> (sAMAccountName=myUsername) (6) ldap : EXPAND dc=mySite,dc=org (6) ldap : --> dc=mySite,dc=org (6) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (6) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (6) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (6) ldap : Processing user attributes (6) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (6) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (9) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (10) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (6) [ldap] = ok (6) [expiration] = noop (6) [logintime] = noop (6) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (6) WARNING: pap : Authentication will fail unless a "known good" password is available (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { rlm_eap (EAP): No EAP session matching state 0xbc6406acbc6b02b1 (6) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (6) eap : Failed in handler (6) [eap] = invalid (6) } # authenticate = invalid (6) Failed to authenticate the user (6) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (6) Using Post-Auth-Type Reject (6) # Executing group from file /etc/raddb/sites-enabled/default (6) Post-Auth-Type REJECT { (6) attr_filter.access_reject : EXPAND %{User-Name} (6) attr_filter.access_reject : --> myUsername (6) attr_filter.access_reject : Matched entry DEFAULT at line 11 (6) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0xbc6406acbc6b02b1 (6) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (6) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (6) [eap] = noop (6) remove_reply_message_if_eap remove_reply_message_if_eap { (6) if (&reply:EAP-Message && &reply:Reply-Message) (6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (6) else else { (6) [noop] = noop (6) } # else else = noop (6) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (6) } # Post-Auth-Type REJECT = updated (6) Delaying response for 1 seconds Received Access-Request Id 6 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020c00080319152b State = 0x023da4930231a0622bbcbfb8ac594c59 Message-Authenticator = 0x20a6424d738dd104865b66aa51f1af3e Event-Timestamp = 'Sep 6 2016 09:10:51 CDT' Proxy-State = 0x313236 (7) Received Access-Request packet from host 10.7.0.28 port 32775, id=6, length=315 (7) User-Name = 'myUsername' (7) Chargeable-User-Identity = 0x00 (7) Location-Capable = Civix-Location (7) Calling-Station-Id = '22:44:66:88:00:11' (7) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (7) NAS-Port = 4 (7) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (7) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (7) Cisco-AVPair = 'mDNS=true' (7) NAS-IP-Address = 10.0.0.19 (7) NAS-Identifier = 'Red 8510' (7) Airespace-Wlan-Id = 8 (7) Service-Type = Framed-User (7) Framed-MTU = 1300 (7) NAS-Port-Type = Wireless-802.11 (7) Tunnel-Type:0 = VLAN (7) Tunnel-Medium-Type:0 = IEEE-802 (7) Tunnel-Private-Group-Id:0 = '477' (7) EAP-Message = 0x020c00080319152b (7) State = 0x023da4930231a0622bbcbfb8ac594c59 (7) Message-Authenticator = 0x20a6424d738dd104865b66aa51f1af3e (7) Event-Timestamp = 'Sep 6 2016 09:10:51 CDT' (7) Proxy-State = 0x313236 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (!&User-Name) (7) if (!&User-Name) -> FALSE (7) if (&User-Name =~ / /) (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@.*@/ ) (7) if (&User-Name =~ /@.*@/ ) -> FALSE (7) if (&User-Name =~ /\\.\\./ ) (7) if (&User-Name =~ /\\.\\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\\.$/) (7) if (&User-Name =~ /\\.$/) -> FALSE (7) if (&User-Name =~ /(a)\\./) (7) if (&User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [preprocess] = ok (7) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (7) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (7) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (7) auth_log : EXPAND %t (7) auth_log : --> Tue Sep 6 09:10:51 2016 (7) [auth_log] = ok (7) [mschap] = noop (7) suffix : Checking for suffix after "@" (7) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : Peer sent code Response (2) ID 12 length 8 (7) eap : No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated rlm_ldap (ldap): Reserved connection (10) (7) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap : --> (sAMAccountName=myUsername) (7) ldap : EXPAND dc=mySite,dc=org (7) ldap : --> dc=mySite,dc=org (7) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (7) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (7) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (7) ldap : Processing user attributes (7) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (7) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (10) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (11) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (7) [ldap] = ok (7) [expiration] = noop (7) [logintime] = noop (7) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (7) WARNING: pap : Authentication will fail unless a "known good" password is available (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { rlm_eap (EAP): No EAP session matching state 0x023da4930231a062 (7) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (7) eap : Failed in handler (7) [eap] = invalid (7) } # authenticate = invalid (7) Failed to authenticate the user (7) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (7) Using Post-Auth-Type Reject (7) # Executing group from file /etc/raddb/sites-enabled/default (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject : EXPAND %{User-Name} (7) attr_filter.access_reject : --> myUsername (7) attr_filter.access_reject : Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0x023da4930231a062 (7) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (7) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (7) [eap] = noop (7) remove_reply_message_if_eap remove_reply_message_if_eap { (7) if (&reply:EAP-Message && &reply:Reply-Message) (7) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (7) else else { (7) [noop] = noop (7) } # else else = noop (7) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (7) } # Post-Auth-Type REJECT = updated (7) Delaying response for 1 seconds (6) Sending delayed response (6) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=242, length=0 (6) Proxy-State = 0x313238 Sending Access-Reject Id 242 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313238 (5) Cleaning up request packet ID 19 with timestamp +359 Received Access-Request Id 242 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 Sending Access-Reject Id 242 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313238 Waking up in 0.9 seconds. Received Access-Request Id 6 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 (7) Discarding duplicate request from client radproxy01.mySite.org port 32775 - ID: 6 due to delayed response Waking up in 0.1 seconds. (7) Sending delayed response (7) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=6, length=0 (7) Proxy-State = 0x313236 Sending Access-Reject Id 6 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313236 Waking up in 3.9 seconds. (7) Cleaning up request packet ID 6 with timestamp +364 Waking up in 1999658.5 seconds. Received Access-Request Id 110 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 User-Name = 'myUsername' Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '22:44:66:88:00:11' Called-Station-Id = '00:22:11:44:33:66:mySite Test' NAS-Port = 4 Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' Cisco-AVPair = 'mDNS=true' NAS-IP-Address = 10.0.0.19 NAS-Identifier = 'Red 8510' Airespace-Wlan-Id = 8 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = '477' EAP-Message = 0x020200080319152b State = 0x8acdf80a8acffcabc84459d3446a7597 Message-Authenticator = 0xcbc7ca966e6720ceb5bb735d7c76d697 Event-Timestamp = 'Sep 6 2016 09:11:00 CDT' Proxy-State = 0x313330 (8) Received Access-Request packet from host 10.7.0.28 port 32775, id=110, length=315 (8) User-Name = 'myUsername' (8) Chargeable-User-Identity = 0x00 (8) Location-Capable = Civix-Location (8) Calling-Station-Id = '22:44:66:88:00:11' (8) Called-Station-Id = '00:22:11:44:33:66:mySite Test' (8) NAS-Port = 4 (8) Cisco-AVPair = 'audit-session-id=1300fa0a011b7b5a57cece57' (8) Acct-Session-Id = '57cece57/22:44:66:88:00:11/12055956' (8) Cisco-AVPair = 'mDNS=true' (8) NAS-IP-Address = 10.0.0.19 (8) NAS-Identifier = 'Red 8510' (8) Airespace-Wlan-Id = 8 (8) Service-Type = Framed-User (8) Framed-MTU = 1300 (8) NAS-Port-Type = Wireless-802.11 (8) Tunnel-Type:0 = VLAN (8) Tunnel-Medium-Type:0 = IEEE-802 (8) Tunnel-Private-Group-Id:0 = '477' (8) EAP-Message = 0x020200080319152b (8) State = 0x8acdf80a8acffcabc84459d3446a7597 (8) Message-Authenticator = 0xcbc7ca966e6720ceb5bb735d7c76d697 (8) Event-Timestamp = 'Sep 6 2016 09:11:00 CDT' (8) Proxy-State = 0x313330 (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) filter_username filter_username { (8) if (!&User-Name) (8) if (!&User-Name) -> FALSE (8) if (&User-Name =~ / /) (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@.*@/ ) (8) if (&User-Name =~ /@.*@/ ) -> FALSE (8) if (&User-Name =~ /\\.\\./ ) (8) if (&User-Name =~ /\\.\\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) (8) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\\.$/) (8) if (&User-Name =~ /\\.$/) -> FALSE (8) if (&User-Name =~ /(a)\\./) (8) if (&User-Name =~ /(a)\\./) -> FALSE (8) } # filter_username filter_username = notfound (8) [preprocess] = ok (8) auth_log : EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d (8) auth_log : --> /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (8) auth_log : /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.7.0.28/auth-detail-20160906 (8) auth_log : EXPAND %t (8) auth_log : --> Tue Sep 6 09:10:59 2016 (8) [auth_log] = ok (8) [mschap] = noop (8) suffix : Checking for suffix after "@" (8) suffix : No '@' in User-Name = "myUsername", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : Peer sent code Response (2) ID 2 length 8 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated rlm_ldap (ldap): Reserved connection (11) (8) ldap : EXPAND (sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap : --> (sAMAccountName=myUsername) (8) ldap : EXPAND dc=mySite,dc=org (8) ldap : --> dc=mySite,dc=org (8) ldap : Performing search in 'dc=mySite,dc=org' with filter '(sAMAccountName=myUsername)', scope 'sub' (8) ldap : Waiting for search result... Unable to chase referral "ldaps://walton.mySite.org/DC=walton,DC=mySite,DC=org" (-1: Can't contact LDAP server) Unable to chase referral "ldaps://cast.mySite.org/DC=cast,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: error: connect - force handshake failure: errno 104 - moznss error -5961 TLS: can't connect: TLS error -5961:TCP connection reset by peer. Unable to chase referral "ldaps://ForestDnsZones.mySite.org/DC=ForestDnsZones,DC=mySite,DC=org" (-1: Can't contact LDAP server) TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://DomainDnsZones.mySite.org/DC=DomainDnsZones,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Rebinding to URL ldaps://mySite.org/CN=Configuration,DC=mySite,DC=org rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Bind successful (8) ldap : User object found at DN "CN=myUsername,OU=mySiteUsers,DC=mySite,DC=org" (8) ldap : Processing user attributes (8) WARNING: ldap : No "known good" password added. Ensure the admin user has permission to read the password attribute (8) WARNING: ldap : PAP authentication will *NOT* work with Active Directory (if that is what you were trying to configure) rlm_ldap (ldap): Deleting connection (11) rlm_ldap (ldap): 0 of 3 connections in use. Need more spares rlm_ldap (ldap): Opening additional connection (12) rlm_ldap (ldap): Connecting to adServer01.mySite.org:636 TLS: certificate [CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US] is not valid - error -8179:Peer's Certificate issuer is not recognized.. rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful (8) [ldap] = ok (8) [expiration] = noop (8) [logintime] = noop (8) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (8) WARNING: pap : Authentication will fail unless a "known good" password is available (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { rlm_eap (EAP): No EAP session matching state 0x8acdf80a8acffcab (8) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (8) eap : Failed in handler (8) [eap] = invalid (8) } # authenticate = invalid (8) Failed to authenticate the user (8) Login incorrect: [myUsername] (from client radproxy01.mySite.org port 4 cli 22:44:66:88:00:11) (8) Using Post-Auth-Type Reject (8) # Executing group from file /etc/raddb/sites-enabled/default (8) Post-Auth-Type REJECT { (8) attr_filter.access_reject : EXPAND %{User-Name} (8) attr_filter.access_reject : --> myUsername (8) attr_filter.access_reject : Matched entry DEFAULT at line 11 (8) [attr_filter.access_reject] = updated rlm_eap (EAP): No EAP session matching state 0x8acdf80a8acffcab (8) eap : Either EAP-request timed out OR EAP-response to an unknown EAP-request (8) eap : Failed to get handler, probably already removed, not inserting EAP-Failure (8) [eap] = noop (8) remove_reply_message_if_eap remove_reply_message_if_eap { (8) if (&reply:EAP-Message && &reply:Reply-Message) (8) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (8) else else { (8) [noop] = noop (8) } # else else = noop (8) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (8) } # Post-Auth-Type REJECT = updated (8) Delaying response for 1 seconds Waking up in 0.9 seconds. Received Access-Request Id 110 from 10.7.0.28:32775 to 10.7.0.29:1812 length 315 (8) Discarding duplicate request from client radproxy01.mySite.org port 32775 - ID: 110 due to delayed response (8) Sending delayed response (8) Sending Access-Reject packet to host 10.7.0.28 port 32775, id=110, length=0 (8) Proxy-State = 0x313330 Sending Access-Reject Id 110 from 10.7.0.29:1812 to 10.7.0.28:32775 Proxy-State = 0x313330 Waking up in 3.9 seconds. (8) Cleaning up request packet ID 110 with timestamp +372 Waking up in 1999650.2 seconds. https://directory.uark.edu/people/sgardne Senior Network Engineer University of Arkansas, ITS-NET

3 4

EAP-TTLS+PAP vs. Ubunt 15 / Windows 10
by Bogdan Rudas 06 Sep '16

06 Sep '16

Hi, I'm trying to connect my Ubuntu 15.10 laptop to WLAN with Cisco Aironet WLC and FreeRADIUS 3.0.11. First of all, I've checked if my RADIUS server works with *eapol_test* utility from wpa_supplicant 2.5 suite and modified eap-ttls-pap.conf confguration file. Then I go to Ubuntu laptop and create custom configuration using Network Manager: [wifi-security] group= key-mgmt=wpa-eap pairwise= proto= [802-1x] altsubject-matches= anonymous-identity=anonymous eap=ttls; identity=ttest password-flags=2 phase2-altsubject-matches= phase2-auth=pap Here is server debug output: (0) Received Access-Request Id 153 from 1.2.3.2:32768 to 1.2.3.4:1812 length 264 (0) User-Name = "anonymous" (0) Chargeable-User-Identity = 0x00 (0) Location-Capable = Civix-Location (0) Calling-Station-Id = "c4-8e-8f-f5-eb-4f" (0) Called-Station-Id = "54-7c-69-f2-1c-a0:New" (0) NAS-Port = 1 (0) Cisco-AVPair = "audit-session-id=c0a819020000044557ce6e9b" (0) Acct-Session-Id = "57ce6e9b/c4:8e:8f:f5:eb:4f/2735" (0) NAS-IP-Address = 1.2.3.2 (0) NAS-Identifier = "backup" (0) Airespace-Wlan-Id = 6 (0) Service-Type = Framed-User (0) Framed-MTU = 1300 (0) NAS-Port-Type = Wireless-802.11 (0) Tunnel-Type:0 = VLAN (0) Tunnel-Medium-Type:0 = IEEE-802 (0) Tunnel-Private-Group-Id:0 = "15" (0) EAP-Message = 0x0201000e01616e6f6e796d6f7573 (0) Message-Authenticator = 0xcf196523d6fc7d6179e7b3252525b1ed (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "anonymous", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 14 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: Initiating new EAP-TLS session (0) eap_ttls: Flushing SSL sessions (of #0) (0) eap_ttls: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 2 length 6 (0) eap: EAP session adding &reply:State = 0x53397887533b6d8a (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Sent Access-Challenge Id 153 from 1.2.3.4:1812 to 1.2.3.2:32768 length 0 (0) EAP-Message = 0x010200061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x53397887533b6d8a7ce5420be31fd0c8 (0) Finished request There are very similar output for Windows 10 with custom-made connection. I expect many Access-Request like in case with *eapol_test* authentification attempt. Please, help me distinguish: is it WiFi client, WLC or FreeRADIUS configuration issue? Thank you. -- Bogdan Rudas Head of Minsk IT Support Department Exadel Inc. http://www.exadel.com/ E-mail: brudas(a)exadel.com Skype ID: bogdan.rudas -- CONFIDENTIALITY NOTICE: This email and files attached to it are confidential. If you are not the intended recipient you are hereby notified that using, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error please notify the sender and delete this email.

2 4