- Freeradius-Users - lists.freeradius.org

Issue with dynamic home server and duplicate server ipaddr on 3.2.8
by James Wood 17 Mar '26

17 Mar '26

I've come across an issue with dynamic home_servers for supporting OpenRoaming connections. In `authorize`, we use the following code to check if it's our home domain, if the 'home_server' already exists, or if we need to dynamically query which radsec server to proxy to: -------------------------------- openroaming_lookup { if (&control:Proxy-To-Realm || &control:Home-Server-Name) { return } if (&User-Name && &User-Name =~ /home.domain/) { return } elsif (&User-Name && &User-Name =~ /(a)(.*)$/) { switch "%{home_server_dynamic:%{1}}" { case "1" { # Proxy to this one particular home server update control { &Home-Server-Name := "%{1}" } } case "0" { # Proxy with home server pool, failover, etc. update control { &Proxy-To-Realm := "%{1}" } } case { # no home server exists, ask DNS update control { &Temp-Home-Server-String := `%{config:confdir}/mods-config/realm/freeradius-naptr-to-home-server.sh -d %{config:confdir} %{1} aaa+auth:radius> } if (&control:Temp-Home-Server-String == "" ) { reject } else { update control { &Home-Server-Name := "%{1}" } } } } } } -------------------------------- This generally works well. For a new (unknown home server), we call the below mods-config/realm/freeradius-naptr-to-home-server.sh script to perform the dynamic discovery: -------------------------------- #!/bin/sh usage() { echo "Usage: ${0} [OPTIONS] <realm> <optional NAPTR tag>" echo " -d RADIUS_DIR Set radius directory" echo " -t test (skip running radmin)" exit 1 } test -n "${1}" || usage RADDB=/usr/local/etc/raddb RADMIN=y while [ `echo "$1" | cut -c 1` = "-" ] do case "$1" in -d) RADDB=$2 shift;shift ;; -t) RADMIN= shift ;; *) usage ;; esac done test -n "${2}" && NAPTRTAG="${2}" || NAPTRTAG="x-eduroam:radius.tls" DIGCMD=$(command -v dig) HOSTCMD=$(command -v host) PRINTCMD=$(command -v printf) validate_host() { echo ${@} | tr -d '\n\t\r' | grep -E '^[_0-9a-zA-Z][-._0-9a-zA-Z]*$' } validate_port() { echo ${@} | tr -d '\n\t\r' | grep -E '^[0-9]+$' } dig_it_srv() { ${DIGCMD} +short srv $SRV_HOST | sort -n -k1 | while read line; do set $line PORT=$(validate_port $3) HOST=$(validate_host $4) if [ -n "${HOST}" ] && [ -n "${PORT}" ]; then $PRINTCMD "\tipaddr = ${HOST%.}\n\tport = ${PORT}\n" fi done } dig_it_naptr() { ${DIGCMD} +short naptr "${REALM}" | grep $NAPTRTAG | sort -n -k1 | while read line; do set $line TYPE=$3 HOST=$(validate_host $6) if ( [ "$TYPE" = "\"s\"" ] || [ "$TYPE" = "\"S\"" ] ) && [ -n "${HOST}" ]; then SRV_HOST=${HOST%.} dig_it_srv fi done } host_it_srv() { ${HOSTCMD} -t srv $SRV_HOST | sort -n -k5 | while read line; do set $line PORT=$(validate_port $7) HOST=$(validate_host $8) if [ -n "${HOST}" ] && [ -n "${PORT}" ]; then $PRINTCMD "\tipaddr ${HOST%.}:${PORT}\n" fi done } host_it_naptr() { ${HOSTCMD} -t naptr "${REALM}" | grep $NAPTRTAG | sort -n -k5 | while read line; do set $line TYPE=$7 HOST=$(validate_host ${10}) if ( [ "$TYPE" = "\"s\"" ] || [ "$TYPE" = "\"S\"" ] ) && [ -n "${HOST}" ]; then SRV_HOST=${HOST%.} host_it_srv fi done } REALM=$(validate_host ${1}) if [ -z "${REALM}" ]; then echo "realm \"${1}\" failed validation" >&2 usage fi if [ -x "${DIGCMD}" ]; then SERVERS=$(dig_it_naptr) elif [ -x "${HOSTCMD}" ]; then SERVERS=$(host_it_naptr) else echo "${0} requires either \"dig\" or \"host\" command." >&2 exit 1 fi if [ ! -n "${SERVERS}" ]; then echo "No servers found" >&2 exit 1 fi if [ -z "${RADMIN}" ]; then $PRINTCMD "home_server ${REALM} {\n${SERVERS}\n\t\$INCLUDE tls.conf\n}\n" exit 0 fi HOME_SERVER_FILE="$RADDB/home_servers/$1" if [ -f "$HOME_SERVER_FILE" ]; then echo "Home server file $HOME_SERVER_FILE already exists. Skipping creation and radmin command." >&2 else echo "Creating new home server file $HOME_SERVER_FILE." >&2 $PRINTCMD "home_server ${REALM} {\n${SERVERS}\n\t\$INCLUDE tls.conf\n}\n" > "$HOME_SERVER_FILE" /usr/local/sbin/radmin -e "add home_server file $HOME_SERVER_FILE" fi echo $1 -------------------------------- Again, this works well. It creates a new file in the home_servers folder, and radmin adds it to the server to use immediately. The problem arises if we have an authentication request from a new realm but the "server" is one that we already have a reference to, from a previously added dynamic home server definition. For example, an authentication request comes in with a realm of davidlloyd.openroaming.net and the script generates the following home server config: # cat home_servers/davidlloyd.openroaming.net home_server davidlloyd.openroaming.net { ipaddr = idpeu.openroaming.net port = 2083 $INCLUDE tls.conf } This new home server was then added via radmin, and everything was ok. The request is proxied to that new server. So far, so good. Later, another authentication request comes in with a realm of eu-sdk.openroaming.net, and the script generates the following home server config: # cat home_servers/eu-sdk.openroaming.net home_server eu-sdk.openroaming.net { ipaddr = idpeu.openroaming.net port = 2083 $INCLUDE tls.conf } However, this failed to add via radmin, because the "ipaddr" is the same as a previously defined dynamic home server, and the authentication fails as it doesn't proxy the request. ipaddr = idpeu.openroaming.net <<<< this The error thrown by radmin is: # radmin -e "add home_server file /usr/local/etc/raddb/home_servers/ davidlloyd.openroaming.net" ERROR: Unable to add home server - Failed adding home_server to the internal data structures This doesn't just happen for "openroaming" hosted realms either. Take cityroam in Japan for example. They have multiple realms too, but the same servers: # cat home_servers/*city* home_servers/jwa.bemap.cityroam.jp: home_server jwa.bemap.cityroam.jp { ipaddr = jpgw4.cityroam.jp port = 2083 ipaddr = jpgw.cityroam.jp port = 2083 $INCLUDE tls.conf } home_servers/w-jp1.wi2.cityroam.jp: home_server w-jp1.wi2.cityroam.jp { ipaddr = jpgw4.cityroam.jp port = 2083 ipaddr = jpgw.cityroam.jp port = 2083 $INCLUDE tls.conf } It's like we need a way to set servers and then map multiple realms to the same server (as traditionally done in proxy.conf)? How can we best solve this issue? Is there another method for doing this besides the one above? We can't statically define these servers (as the whole point of openroaming is to dynamic proxy to the resolved servers, which may change), and we'll never know what user realm may hit us next will be, and they will probably share servers. Thanks, James -- Visit purple.ai <https://purple.ai/> Purple on LinkedIn <https://uk.linkedin.com/company/purple-wifi> Email disclaimer <http://www.purple.ai/email-disclaimer/>

2 2

iOS 18.6.2 device refuses to connect to Wi-Fi.
by Selahattin CILEK 13 Mar '26

13 Mar '26

I'm trying something new with FreeRADIUS. There are two virtual servers (staff, guest) which authenticate against two separate DB backends (MySQL and MSSQL, respectively). Accordingly, the clients are configured with the "virtual_server" directive. What I'm trying to achieve is to make FreeRADIUS work on two separate subnets, on which separate devices communicate with separate virtual servers, which authenticate against two separate DBs. iOS devices refuse to authenticate from the *staff* virtual server while Android devices do. And when I remove the *guest* virtual server, iOS devices start connecting too. [2.7.2-RELEASE][root(a)router.scilek.com]/root: radiusd -X FreeRADIUS Version 3.2.3 Copyright (C) 1999-2022 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/totp including configuration file /usr/local/etc/raddb/mods-enabled/date including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/mysql including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/googleauth including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/sql_office including configuration file /usr/local/etc/raddb/mods-config/sql/main/mysql/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/datacounter_acct including configuration file /usr/local/etc/raddb/mods-enabled/sql_guest including configuration file /usr/local/etc/raddb/mods-config/sql/main/mssql/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/unpack including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/motp including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/mssql including configuration file /usr/local/etc/raddb/mods-config/sql/main/mssql/queries.conf including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/linelog including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/canonicalization including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/debug including configuration file /usr/local/etc/raddb/policy.d/pfs_custom_policies including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/abfab-tr including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/rfc7542 including configuration file /usr/local/etc/raddb/policy.d/moonshot-targeted-ids including configuration file /usr/local/etc/raddb/policy.d/dhcp including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls including configuration file /usr/local/etc/raddb/sites-enabled/staff including configuration file /usr/local/etc/raddb/sites-enabled/guest main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log" run_dir = "/var/run" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log" run_dir = "/var/run" libdir = "/usr/local/lib/freeradius-3.2.3" radacctdir = "/var/log/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 postauth_client_lost = no pidfile = "/var/run/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no msg_badpass = "" msg_goodpass = "" colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = no } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client CP_GUEST { ipaddr = 192.168.255.12 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" virtual_server = "guest" proto = "udp" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client CP_OFFICE { ipaddr = 192.168.1.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" virtual_server = "staff" proto = "udp" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client DENEME { ipaddr = 192.168.1.11 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" virtual_server = "staff" proto = "udp" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = MS-CHAP # Creating Autz-Type = Status-Server # Creating Auth-Type = mschap radiusd: #### Instantiating modules #### modules { # Loaded module rlm_passwd # Loading module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_expr # Loading module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôSùûüa ÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔRÙÛÜx" } # Loaded module rlm_totp # Loading module "totp" from file /usr/local/etc/raddb/mods-enabled/totp # Loaded module rlm_date # Loading module "date" from file /usr/local/etc/raddb/mods-enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /usr/local/etc/raddb/mods-enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_chap # Loading module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_sql # Loading module "mysql" from file /usr/local/etc/raddb/mods-enabled/mysql sql mysql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "raduser" password = <<< secret >>> radius_db = "raddb" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/sqltrace.sql" default_user_profile = "" client_query = "CALL load_clients()" authorize_check_query = "CALL authorize_check('%{SQL-User-Name}')" authorize_reply_query = "CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}')" authorize_group_check_query = "CALL authorize_group_check('%{mysql-SQL-Group}')" authorize_group_reply_query = "CALL authorize_group_reply('%{mysql-SQL-Group}')" group_membership_query = "CALL group_membership('%{SQL-User-Name}')" simul_count_query = "CALL simul_count('%{SQL-User-Name}')" safe_characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#+%&?*-_@." auto_escape = no accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "CALL accounting_on('%{Called-Station-Id}','%{Acct-Terminate-Cause}','%{NAS-Identifier}','%{NAS-IP-Address}','%{Event-Timestamp}')" } accounting-off { query = "CALL accounting_off('%{Called-Station-Id}','%{Acct-Terminate-Cause}','%{NAS-Identifier}','%{NAS-IP-Address}','%{Event-Timestamp}')" } start { query = "CALL accounting_start('%{Acct-Session-Id}','%{SQL-User-Name}','%{Class}','%{NAS-IP-Address}','%{Called-Station-Id}','%{Calling-Station- Id}','%{Framed-IP-Address}','%{NAS-Identifier}','%{NAS-Port}','%{NAS-Port-Type}','%{Connect-Info}','%{Event-Timestamp}')" } interim-update { query = "CALL accounting_update ('%{Acct-Session-Id}','%{Called-Station-Id}','%{Calling-Station-Id}','%{Acct-Session-Time}','%{Acct-Input-Octets }','%{Acct-Input-Gigawords}','%{Acct-Output-Octets}','%{Acct-Output-Gigawords}','%{User-Name}','%{Class}','%{Framed-IP-Address}','%{NAS-Identifier}','%{ NAS-Port}','%{NAS-Port-Type}','%{Connect-Info}','%{NAS-IP-Address}','%{Event-Timestamp}')" } stop { query = "CALL accounting_stop ('%{Acct-Session-Id}','%{SQL-User-Name}','%{Called-Station-Id}','%{Calling-Station-Id}','%{Acct-Session-Time}','%{ Acct-Input-Octets}','%{Acct-Input-Gigawords}','%{Acct-Output-Octets}','%{Acct-Output-Gigawords}','%{Acct-Terminate-Cause}','%{Framed-IP-Address}','%{NAS -Identifier}','%{NAS-Port}','%{NAS-Port-Type}','%{Connect-Info}','%{Event-Timestamp}')" } } } post-auth { reference = ".query" } } rlm_sql (mysql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute mysql-SQL-Group # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.coa { filename = "/usr/local/etc/raddb/mods-config/attr_filter/coa" key = "%{User-Name}" relaxed = no } # Loaded module rlm_replicate # Loading module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_exec # Loading module "googleauth" from file /usr/local/etc/raddb/mods-enabled/googleauth exec googleauth { wait = yes program = "/usr/local/etc/raddb/scripts/googleauth.py %{request:User-Name} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{request:User-Password}" shell_escape = yes } # Loaded module rlm_always # Loading module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /usr/local/etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /usr/local/etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loading module "sql_office" from file /usr/local/etc/raddb/mods-enabled/sql_office sql sql_office { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "raduser" password = <<< secret >>> radius_db = "raddb" read_groups = yes read_profiles = yes read_clients = yes delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/sqltrace.sql" default_user_profile = "" client_query = "CALL load_clients()" authorize_check_query = "CALL authorize_check('%{SQL-User-Name}')" authorize_reply_query = "CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}')" authorize_group_check_query = "CALL authorize_group_check('%{sql_office-SQL-Group}')" authorize_group_reply_query = "CALL authorize_group_reply('%{sql_office-SQL-Group}')" group_membership_query = "CALL group_membership('%{SQL-User-Name}')" simul_count_query = "CALL simul_count('%{SQL-User-Name}')" safe_characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#+%&?*-_@." auto_escape = no accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "CALL accounting_on('%{Called-Station-Id}','%{Acct-Terminate-Cause}','%{NAS-Identifier}','%{NAS-IP-Address}','%{Event-Timestamp}')" } accounting-off { query = "CALL accounting_off('%{Called-Station-Id}','%{Acct-Terminate-Cause}','%{NAS-Identifier}','%{NAS-IP-Address}','%{Event-Timestamp}')" } start { query = "CALL accounting_start('%{Acct-Session-Id}','%{SQL-User-Name}','%{Class}','%{NAS-IP-Address}','%{Called-Station-Id}','%{Calling-Station- Id}','%{Framed-IP-Address}','%{NAS-Identifier}','%{NAS-Port}','%{NAS-Port-Type}','%{Connect-Info}','%{Event-Timestamp}')" } interim-update { query = "CALL accounting_update ('%{Acct-Session-Id}','%{Called-Station-Id}','%{Calling-Station-Id}','%{Acct-Session-Time}','%{Acct-Input-Octets }','%{Acct-Input-Gigawords}','%{Acct-Output-Octets}','%{Acct-Output-Gigawords}','%{User-Name}','%{Class}','%{Framed-IP-Address}','%{NAS-Identifier}','%{ NAS-Port}','%{NAS-Port-Type}','%{Connect-Info}','%{NAS-IP-Address}','%{Event-Timestamp}')" } stop { query = "CALL accounting_stop ('%{Acct-Session-Id}','%{SQL-User-Name}','%{Called-Station-Id}','%{Calling-Station-Id}','%{Acct-Session-Time}','%{ Acct-Input-Octets}','%{Acct-Input-Gigawords}','%{Acct-Output-Octets}','%{Acct-Output-Gigawords}','%{Acct-Terminate-Cause}','%{Framed-IP-Address}','%{NAS -Identifier}','%{NAS-Port}','%{NAS-Port-Type}','%{Connect-Info}','%{Event-Timestamp}')" } } } post-auth { reference = ".query" } } rlm_sql (sql_office): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute sql_office-SQL-Group # Loaded module rlm_eap # Loading module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 4096 } # Loaded module rlm_radutmp # Loading module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_pap # Loading module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_logintime # Loading module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loading module "check_quota" from file /usr/local/etc/raddb/mods-enabled/datacounter_acct exec check_quota { wait = no program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_acct.sh %{request:User-Name} %{request:Calling-Station-Id} %{request:NAS -IP-Address} %{request:Class} %{request:Acct-Status-Type} %{request:Called-Station-Id} %{request:Framed-IP-Address} %{request:Acct-Session-ID} %{request :NAS-Identifier} " shell_escape = yes } # Loading module "sql_guest" from file /usr/local/etc/raddb/mods-enabled/sql_guest sql sql_guest { driver = "rlm_sql_unixodbc" server = "mssqlserver" port = 1433 login = "sa" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/sqltrace.sql" default_user_profile = "" client_query = "EXECUTE LoadClients()" authorize_check_query = "EXECUTE AuthorizeCheck N'%{SQL-User-Name}'" authorize_reply_query = "EXECUTE AuthorizeReply N'%{SQL-User-Name}', N'%{Calling-Station-Id}'" authorize_group_check_query = "EXECUTE AuthorizeGroupCheck N'%{sql_guest-SQL-Group}'" authorize_group_reply_query = "EXECUTE AuthorizeGroupReply N'%{sql_guest-SQL-Group}'" group_membership_query = "EXECUTE GroupMembership N'%{SQL-User-Name}'" simul_count_query = "EXECUTE SimulCount N'%{SQL-User-Name}'" safe_characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#+%&?*-_@." auto_escape = no accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "EXECUTE AccountingOn N'%{Called-Station-Id}', N'%{Acct-Terminate-Cause}', N'%{NAS-Identifier}', N'%{NAS-IP-Address}', N'%{Event-Timesta mp}'" } accounting-off { query = "EXECUTE AccountingOff N'%{Called-Station-Id}', N'%{Acct-Terminate-Cause}', N'%{NAS-Identifier}', N'%{NAS-IP-Address}', N'%{Event-Timest amp}'" } start { query = "EXECUTE AccountingStart N'%{Acct-Session-Id}', N'%{SQL-User-Name}', N'%{Class}', N'%{NAS-IP-Address}', N'%{Called-Station-Id}', N'%{Cal ling-Station-Id}', N'%{Framed-IP-Address}', N'%{NAS-Identifier}', N'%{NAS-Port}', N'%{NAS-Port-Type}', N'%{Connect-Info}', N'%{Event-Timestamp}'" } interim-update { query = "EXECUTE AccountingUpdate N'%{Acct-Session-Id}', N'%{Called-Station-Id}', N'%{Calling-Station-Id}', N'%{Acct-Session-Time}', N'%{Acct-In put-Octets}', N'%{Acct-Input-Gigawords}', N'%{Acct-Output-Octets}', N'%{Acct-Output-Gigawords}', N'%{User-Name}', N'%{Class}', N'%{Framed-IP-Address}', N'%{NAS-Identifier}', N'%{NAS-Port}', N'%{NAS-Port-Type}', N'%{Connect-Info}', N'%{NAS-IP-Address}', N'%{Event-Timestamp}'" } stop { query = "EXECUTE AccountingStop N'%{Acct-Session-Id}', N'%{SQL-User-Name}', N'%{Called-Station-Id}', N'%{Calling-Station-Id}', N'%{Acct-Session- Time}', N'%{Acct-Input-Octets}', N'%{Acct-Input-Gigawords}', N'%{Acct-Output-Octets}', N'%{Acct-Output-Gigawords}', N'%{Acct-Terminate-Cause}', N'%{Fram ed-IP-Address}', N'%{NAS-Identifier}', N'%{NAS-Port}', N'%{NAS-Port-Type}', N'%{Connect-Info}', N'%{Event-Timestamp}'" } } } post-auth { reference = ".query" } } rlm_sql (sql_guest): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked Creating attribute sql_guest-SQL-Group # Loaded module rlm_unix # Loading module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radwtmp" } Creating attribute Unix-Group # Loading module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_unpack # Loading module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack # Loading module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_files # Loading module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" } # Loaded module rlm_expiration # Loading module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_realm # Loading module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = yes } # Loading module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = yes } # Loading module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = yes } # Loading module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = yes } # Loading module "motp" from file /usr/local/etc/raddb/mods-enabled/motp exec motp { wait = yes program = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/otpverify.sh %{request:User-Name} %{request:User-Password} %{reply:MOTP-Init-Secret} %{reply:MOTP-PIN} %{reply:MOTP-Offset}" shell_escape = yes } # Loaded module rlm_preprocess # Loading module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_digest # Loading module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_mschap # Loading module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_soh # Loading module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_detail # Loading module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loading module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail_%Y_%m_%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "mssql" from file /usr/local/etc/raddb/mods-enabled/mssql sql mssql { driver = "rlm_sql_unixodbc" server = "mssqlserver" port = 1433 login = "sa" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" logfile = "/var/log/sqltrace.sql" default_user_profile = "" client_query = "EXECUTE LoadClients()" authorize_check_query = "EXECUTE AuthorizeCheck N'%{SQL-User-Name}'" authorize_reply_query = "EXECUTE AuthorizeReply N'%{SQL-User-Name}', N'%{Calling-Station-Id}'" authorize_group_check_query = "EXECUTE AuthorizeGroupCheck N'%{mssql-SQL-Group}'" authorize_group_reply_query = "EXECUTE AuthorizeGroupReply N'%{mssql-SQL-Group}'" group_membership_query = "EXECUTE GroupMembership N'%{SQL-User-Name}'" simul_count_query = "EXECUTE SimulCount N'%{SQL-User-Name}'" safe_characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#+%&?*-_@." auto_escape = no accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "EXECUTE AccountingOn N'%{Called-Station-Id}', N'%{Acct-Terminate-Cause}', N'%{NAS-Identifier}', N'%{NAS-IP-Address}', N'%{Event-Timesta mp}'" } accounting-off { query = "EXECUTE AccountingOff N'%{Called-Station-Id}', N'%{Acct-Terminate-Cause}', N'%{NAS-Identifier}', N'%{NAS-IP-Address}', N'%{Event-Timest amp}'" } start { query = "EXECUTE AccountingStart N'%{Acct-Session-Id}', N'%{SQL-User-Name}', N'%{Class}', N'%{NAS-IP-Address}', N'%{Called-Station-Id}', N'%{Cal ling-Station-Id}', N'%{Framed-IP-Address}', N'%{NAS-Identifier}', N'%{NAS-Port}', N'%{NAS-Port-Type}', N'%{Connect-Info}', N'%{Event-Timestamp}'" } interim-update { query = "EXECUTE AccountingUpdate N'%{Acct-Session-Id}', N'%{Called-Station-Id}', N'%{Calling-Station-Id}', N'%{Acct-Session-Time}', N'%{Acct-In put-Octets}', N'%{Acct-Input-Gigawords}', N'%{Acct-Output-Octets}', N'%{Acct-Output-Gigawords}', N'%{User-Name}', N'%{Class}', N'%{Framed-IP-Address}', N'%{NAS-Identifier}', N'%{NAS-Port}', N'%{NAS-Port-Type}', N'%{Connect-Info}', N'%{NAS-IP-Address}', N'%{Event-Timestamp}'" } stop { query = "EXECUTE AccountingStop N'%{Acct-Session-Id}', N'%{SQL-User-Name}', N'%{Called-Station-Id}', N'%{Calling-Station-Id}', N'%{Acct-Session- Time}', N'%{Acct-Input-Octets}', N'%{Acct-Input-Gigawords}', N'%{Acct-Output-Octets}', N'%{Acct-Output-Gigawords}', N'%{Acct-Terminate-Cause}', N'%{Fram ed-IP-Address}', N'%{NAS-Identifier}', N'%{NAS-Port}', N'%{NAS-Port-Type}', N'%{Connect-Info}', N'%{Event-Timestamp}'" } } } post-auth { reference = ".query" } } rlm_sql (mssql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked Creating attribute mssql-SQL-Group # Loading module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_linelog # Loading module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } instantiate { # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime # Instantiating module "mssql" from file /usr/local/etc/raddb/mods-enabled/mssql rlm_sql (mssql): Attempting to connect to database "radius" rlm_sql (mssql): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 max_retries = 5 spread = no } rlm_sql (mssql): Opening additional connection (0), 1 of 10 pending slots used rlm_sql (mssql): Opening additional connection (1), 1 of 9 pending slots used rlm_sql (mssql): Opening additional connection (2), 1 of 8 pending slots used rlm_sql (mssql): Opening additional connection (3), 1 of 7 pending slots used rlm_sql (mssql): Opening additional connection (4), 1 of 6 pending slots used # Instantiating module "mysql" from file /usr/local/etc/raddb/mods-enabled/mysql rlm_sql_mysql: libmysql version: 8.0.39 mysql { tls { tls_required = no check_cert = no check_cert_cn = no } warnings = "auto" } rlm_sql (mysql): Attempting to connect to database "raddb" rlm_sql (mysql): Initialising connection pool pool { start = 5 min = 3 max = 5 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 60 max_retries = 5 spread = no } Ignoring "spare = 10", forcing to "spare = 2" rlm_sql (mysql): Opening additional connection (0), 1 of 5 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (mysql): Opening additional connection (1), 1 of 4 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (mysql): Opening additional connection (2), 1 of 3 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (mysql): Opening additional connection (3), 1 of 2 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (mysql): Opening additional connection (4), 1 of 1 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 } # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Instantiating module "attr_filter.coa" from file /usr/local/etc/raddb/mods-enabled/attr_filter reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/coa # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always # Instantiating module "sql_office" from file /usr/local/etc/raddb/mods-enabled/sql_office mysql { tls { tls_required = no check_cert = no check_cert_cn = no } warnings = "auto" } rlm_sql (sql_office): Attempting to connect to database "raddb" rlm_sql (sql_office): Initialising connection pool pool { start = 5 min = 3 max = 8 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 max_retries = 5 spread = no } Ignoring "spare = 10", forcing to "spare = 5" rlm_sql (sql_office): Opening additional connection (0), 1 of 8 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (sql_office): Opening additional connection (1), 1 of 7 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (sql_office): Opening additional connection (2), 1 of 6 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (sql_office): Opening additional connection (3), 1 of 5 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (sql_office): Opening additional connection (4), 1 of 4 pending slots used rlm_sql_mysql: Starting connect to MySQL server WARNING: MYSQL_OPT_RECONNECT is deprecated and will be removed in a future version. rlm_sql_mysql: Connected to database 'raddb' on Localhost via UNIX socket, server version 8.0.35, protocol version 10 rlm_sql (sql_office): Processing generate_sql_clients rlm_sql (sql_office) in generate_sql_clients: query is CALL load_clients() rlm_sql (sql_office): Reserved connection (0) rlm_sql (sql_office): Executing select query: CALL load_clients() rlm_sql (sql_office): Adding client 192.168.0.21 (RESEPSIYON) to global clients list rlm_sql (192.168.0.21): Client "RESEPSIYON" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.22 (RESTORAN) to global clients list rlm_sql (192.168.0.22): Client "RESTORAN" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.23 (KAT4-1) to global clients list rlm_sql (192.168.0.23): Client "KAT4-1" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.24 (KAT4-2) to global clients list rlm_sql (192.168.0.24): Client "KAT4-2" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.25 (KAT5-1) to global clients list rlm_sql (192.168.0.25): Client "KAT5-1" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.26 (KAT5-2) to global clients list rlm_sql (192.168.0.26): Client "KAT5-2" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.27 (KAT6-1) to global clients list rlm_sql (192.168.0.27): Client "KAT6-1" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.28 (KAT6-2) to global clients list rlm_sql (192.168.0.28): Client "KAT6-2" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.29 (KAT7-1) to global clients list rlm_sql (192.168.0.29): Client "KAT7-1" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.30 (KAT7-2) to global clients list rlm_sql (192.168.0.30): Client "KAT7-2" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.31 (KAT8-1) to global clients list rlm_sql (192.168.0.31): Client "KAT8-1" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.32 (KATT) to global clients list rlm_sql (192.168.0.32): Client "KATT" (sql_office) added rlm_sql (sql_office): Adding client 192.168.0.5 (UNIFI) to global clients list rlm_sql (192.168.0.5): Client "UNIFI" (sql_office) added rlm_sql (sql_office): Released connection (0) # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server_key.pem" certificate_file = "/usr/local/etc/raddb/certs/server_cert.pem" ca_file = "/usr/local/etc/raddb/certs/ca_cert.pem" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no check_cert_issuer = "/CN=scs-ca/C=TR/ST=KONYA/L=Konya/O=SCS Kurumsal Bilisim Hizmetleri Ltd" reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" tls_min_version = "1.0" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } tls: In order to use TLS 1.0 and/or TLS 1.1, you likely need to set: cipher_list = "DEFAULT@SECLEVEL=0" tls: Setting DH parameters from /usr/local/etc/raddb/certs/dh - this is no longer necessary. tls: You should comment out the 'dh_file' configuration item. # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "tls" copy_request_to_tunnel = yes use_tunneled_reply = no virtual_server = "inner-tunnel-ttls" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "tls" copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel-peap" soh = yes require_client_cert = no soh_virtual_server = "soh-server" } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap # Instantiating module "sql_guest" from file /usr/local/etc/raddb/mods-enabled/sql_guest rlm_sql (sql_guest): Attempting to connect to database "radius" rlm_sql (sql_guest): Initialising connection pool pool { start = 5 min = 5 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 1 max_retries = 5 spread = no } rlm_sql (sql_guest): Opening additional connection (0), 1 of 10 pending slots used rlm_sql (sql_guest): Opening additional connection (1), 1 of 9 pending slots used rlm_sql (sql_guest): Opening additional connection (2), 1 of 8 pending slots used rlm_sql (sql_guest): Opening additional connection (3), 1 of 7 pending slots used rlm_sql (sql_guest): Opening additional connection (4), 1 of 6 pending slots used # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap rlm_mschap (mschap): using internal authentication # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel-peap { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-peap # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel-peap server inner-tunnel-ttls { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls # Loading authenticate {...} Compiling Auth-Type PAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} Compiling Post-Auth-Type REJECT for attr Post-Auth-Type } # server inner-tunnel-ttls server staff { # from file /usr/local/etc/raddb/sites-enabled/staff # Loading authenticate {...} Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Compiling Autz-Type Status-Server for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server staff server guest { # from file /usr/local/etc/raddb/sites-enabled/guest # Loading authenticate {...} Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} Compiling Autz-Type Status-Server for attr Autz-Type # Loading preacct {...} # Loading accounting {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server guest radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18128 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18127 } listen { type = "auth" ipaddr = 192.168.1.1 port = 1812 } listen { type = "acct" ipaddr = 192.168.1.1 port = 1813 } listen { type = "auth" ipaddr = 192.168.255.12 port = 1812 } listen { type = "acct" ipaddr = 192.168.255.12 port = 1813 } Listening on auth address 127.0.0.1 port 18128 bound to server inner-tunnel-peap Listening on auth address 127.0.0.1 port 18127 bound to server inner-tunnel-ttls Listening on auth address 192.168.1.1 port 1812 bound to server staff Listening on acct address 192.168.1.1 port 1813 bound to server staff Listening on auth address 192.168.255.12 port 1812 bound to server guest Listening on acct address 192.168.255.12 port 1813 bound to server guest Ready to process requests (0) Received Access-Request Id 46 from 192.168.1.11:38756 to 192.168.1.1:1812 length 219 (0) User-Name = "scilek" (0) NAS-IP-Address = 192.168.1.11 (0) NAS-Identifier = "DENEME" (0) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) Calling-Station-Id = "7C-24-99-BB-95-97" (0) Connect-Info = "CONNECT 0Mbps 802.11b" (0) Acct-Session-Id = "2BF296A0F9146E3B" (0) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (0) Mobility-Domain-Id = 47287 (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027075 (0) Framed-MTU = 1400 (0) EAP-Message = 0x02c9000b017363696c656b (0) Message-Authenticator = 0x54953d21791aca8302aa1d112e7e9e1e (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (0) authorize { (0) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (0) EXPAND %{User-Name} (0) --> scilek (0) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (0) EXPAND /var/log/sqltrace.sql (0) --> /var/log/sqltrace.sql (0) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (0) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (0) --> 1 (0) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (0) [preprocess] = ok (0) mysql: EXPAND %{User-Name} (0) mysql: --> scilek (0) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (4) (0) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (0) mysql: --> CALL authorize_check('scilek') (0) mysql: Executing select query: CALL authorize_check('scilek') (0) mysql: User found in radcheck table (0) mysql: Conditional check items matched, merging assignment check items (0) mysql: Cleartext-Password := "aaaa" (0) mysql: Simultaneous-Use := 3 (0) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (0) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (0) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (0) mysql: User found in radreply table, merging reply items (0) mysql: Class := 0x7363696c656b (0) mysql: Idle-Timeout := 120 (0) mysql: Acct-Interim-Interval := 600 (0) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (0) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (0) mysql: --> CALL group_membership('scilek') (0) mysql: Executing select query: CALL group_membership('scilek') (0) mysql: User not found in any groups rlm_sql (mysql): Released connection (4) (0) [mysql] = ok (0) pap: No User-Password attribute in the request. Cannot do PAP (0) [pap] = noop (0) eap: Peer sent EAP Response (code 2) ID 201 length 11 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_ttls to process data (0) eap_ttls: (TLS) Initiating new session (0) eap: Sending EAP Request (code 1) ID 202 length 6 (0) eap: EAP session adding &reply:State = 0xb050be94b09aab4e (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (0) session-state: Saving cached attributes (0) Framed-MTU = 994 (0) Sent Access-Challenge Id 46 from 192.168.1.1:1812 to 192.168.1.11:38756 length 84 (0) Class = 0x7363696c656b (0) Idle-Timeout = 120 (0) Acct-Interim-Interval = 600 (0) EAP-Message = 0x01ca00061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xb050be94b09aab4e7b2311cb3d254004 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 47 from 192.168.1.11:38756 to 192.168.1.1:1812 length 387 (1) User-Name = "scilek" (1) NAS-IP-Address = 192.168.1.11 (1) NAS-Identifier = "DENEME" (1) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) Calling-Station-Id = "7C-24-99-BB-95-97" (1) Connect-Info = "CONNECT 0Mbps 802.11b" (1) Acct-Session-Id = "2BF296A0F9146E3B" (1) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (1) Mobility-Domain-Id = 47287 (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027075 (1) Framed-MTU = 1400 (1) EAP-Message = 0x02ca00a115800000009716030100920100008e030369b31db69281dcfdd217c58574cb0b61b6d7b2f6814e9296c03a7b33e233023b00002c00ffc02cc02bc024c0 23c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00020100000d0012001004010201050106010403020305 0306030005000501000000000012000000170000 (1) State = 0xb050be94b09aab4e7b2311cb3d254004 (1) Message-Authenticator = 0xd2b41f59f236bb533b0f7935b345bb41 (1) Restoring &session-state (1) &session-state:Framed-MTU = 994 (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (1) authorize { (1) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (1) EXPAND %{User-Name} (1) --> scilek (1) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (1) EXPAND /var/log/sqltrace.sql (1) --> /var/log/sqltrace.sql (1) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (1) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (1) --> 1 (1) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (1) [preprocess] = ok (1) mysql: EXPAND %{User-Name} (1) mysql: --> scilek (1) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (4) (1) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (1) mysql: --> CALL authorize_check('scilek') (1) mysql: Executing select query: CALL authorize_check('scilek') (1) mysql: User found in radcheck table (1) mysql: Conditional check items matched, merging assignment check items (1) mysql: Cleartext-Password := "aaaa" (1) mysql: Simultaneous-Use := 3 (1) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (1) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (1) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (1) mysql: User found in radreply table, merging reply items (1) mysql: Class := 0x7363696c656b (1) mysql: Idle-Timeout := 120 (1) mysql: Acct-Interim-Interval := 600 (1) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (1) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (1) mysql: --> CALL group_membership('scilek') (1) mysql: Executing select query: CALL group_membership('scilek') (1) mysql: User not found in any groups rlm_sql (mysql): Released connection (4) (1) [mysql] = ok (1) pap: No User-Password attribute in the request. Cannot do PAP (1) [pap] = noop (1) eap: Peer sent EAP Response (code 2) ID 202 length 161 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (1) authenticate { (1) eap: Expiring EAP session with state 0xb050be94b09aab4e (1) eap: Finished EAP session with state 0xb050be94b09aab4e (1) eap: Previous EAP request found for state 0xb050be94b09aab4e, released from the list (1) eap: Peer sent packet with method EAP TTLS (21) (1) eap: Calling submodule eap_ttls to process data (1) eap_ttls: Authenticate (1) eap_ttls: (TLS) EAP Peer says that the final record size will be 151 bytes (1) eap_ttls: (TLS) EAP Got all data (151 bytes) (1) eap_ttls: (TLS) Handshake state - before SSL initialization (1) eap_ttls: (TLS) Handshake state - Server before SSL initialization (1) eap_ttls: (TLS) Handshake state - Server before SSL initialization (1) eap_ttls: (TLS) recv TLS 1.3 Handshake, ClientHello (1) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS read client hello (1) eap_ttls: (TLS) send TLS 1.2 Handshake, ServerHello (1) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write server hello (1) eap_ttls: (TLS) send TLS 1.2 Handshake, Certificate (1) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write certificate (1) eap_ttls: (TLS) send TLS 1.2 Handshake, ServerKeyExchange (1) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write key exchange (1) eap_ttls: (TLS) send TLS 1.2 Handshake, ServerHelloDone (1) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write server done (1) eap_ttls: (TLS) Server : Need to read more data: SSLv3/TLS write server done (1) eap_ttls: (TLS) In Handshake Phase (1) eap: Sending EAP Request (code 1) ID 203 length 1004 (1) eap: EAP session adding &reply:State = 0xb050be94b19bab4e (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (1) session-state: Saving cached attributes (1) Framed-MTU = 994 (1) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (1) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (1) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (1) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (1) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (1) Sent Access-Challenge Id 47 from 192.168.1.1:1812 to 192.168.1.11:38756 length 1088 (1) Class = 0x7363696c656b (1) Idle-Timeout = 120 (1) Acct-Interim-Interval = 600 (1) EAP-Message = 0x01cb03ec15c000000aa7160303003d020000390303b5dc43036a219d4b0b1a20615f2b1b0d78bd4c00e33aa6d4476f9e2fcf3e376100c030000011ff0100010000 0b0004030001020017000016030309050b0009010008fe0004ba308204b63082039ea003020102020105300d06092a864886f70d01010b0500306c310f300d060355040313067363732d6361 310b3009060355040613025452310e300c060355040813054b4f4e5941310e300c060355040713054b6f6e7961312c302a060355040a1323534353204b7572756d73616c2042696c6973696d 2048697a6d65746c657269204c74643020170d3236303331323230303032315a180f32303539303131383230303032315a306c310f300d06035504031306726164697573310b300906035504 0613025452310e300c060355040813054b4f4e5941310e300c060355040713054b6f6e7961312c302a060355040a1323534353204b7572756d73616c2042696c6973696d2048697a6d65746c 657269204c74 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xb050be94b19bab4e7b2311cb3d254004 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 48 from 192.168.1.11:38756 to 192.168.1.1:1812 length 232 (2) User-Name = "scilek" (2) NAS-IP-Address = 192.168.1.11 (2) NAS-Identifier = "DENEME" (2) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) Calling-Station-Id = "7C-24-99-BB-95-97" (2) Connect-Info = "CONNECT 0Mbps 802.11b" (2) Acct-Session-Id = "2BF296A0F9146E3B" (2) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (2) Mobility-Domain-Id = 47287 (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027076 (2) WLAN-AKM-Suite = 1027075 (2) Framed-MTU = 1400 (2) EAP-Message = 0x02cb00061500 (2) State = 0xb050be94b19bab4e7b2311cb3d254004 (2) Message-Authenticator = 0xa703b43f285bef20dc8ff90db0ef0d7d (2) Restoring &session-state (2) &session-state:Framed-MTU = 994 (2) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (2) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (2) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (2) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (2) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (2) authorize { (2) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (2) EXPAND %{User-Name} (2) --> scilek (2) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (2) EXPAND /var/log/sqltrace.sql (2) --> /var/log/sqltrace.sql (2) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (2) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (2) --> 1 (2) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (2) [preprocess] = ok (2) mysql: EXPAND %{User-Name} (2) mysql: --> scilek (2) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (4) (2) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (2) mysql: --> CALL authorize_check('scilek') (2) mysql: Executing select query: CALL authorize_check('scilek') (2) mysql: User found in radcheck table (2) mysql: Conditional check items matched, merging assignment check items (2) mysql: Cleartext-Password := "aaaa" (2) mysql: Simultaneous-Use := 3 (2) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (2) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (2) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (2) mysql: User found in radreply table, merging reply items (2) mysql: Class := 0x7363696c656b (2) mysql: Idle-Timeout := 120 (2) mysql: Acct-Interim-Interval := 600 (2) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (2) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (2) mysql: --> CALL group_membership('scilek') (2) mysql: Executing select query: CALL group_membership('scilek') (2) mysql: User not found in any groups rlm_sql (mysql): Released connection (4) (2) [mysql] = ok (2) pap: No User-Password attribute in the request. Cannot do PAP (2) [pap] = noop (2) eap: Peer sent EAP Response (code 2) ID 203 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (2) authenticate { (2) eap: Expiring EAP session with state 0xb050be94b19bab4e (2) eap: Finished EAP session with state 0xb050be94b19bab4e (2) eap: Previous EAP request found for state 0xb050be94b19bab4e, released from the list (2) eap: Peer sent packet with method EAP TTLS (21) (2) eap: Calling submodule eap_ttls to process data (2) eap_ttls: Authenticate (2) eap_ttls: (TLS) Peer ACKed our handshake fragment (2) eap: Sending EAP Request (code 1) ID 204 length 1004 (2) eap: EAP session adding &reply:State = 0xb050be94b29cab4e (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (2) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (2) Sent Access-Challenge Id 48 from 192.168.1.1:1812 to 192.168.1.11:38756 length 1088 (2) Class = 0x7363696c656b (2) Idle-Timeout = 120 (2) Acct-Interim-Interval = 600 (2) EAP-Message = 0x01cc03ec15c000000aa7020230110603551d11040a30088206726164697573300d06092a864886f70d01010b050003820101003d658b1913031f266a933b8dce03 077c97910312dba9a3bca29462e20d4597dc8cc2c4701ccc79a03dfea5d8b72218888f8f9ac1a9591466b5dcde5f321b3853f9c23a6e5013922eae218a3fdf833b1ba07725bb59b955644c73 c54db7f84c6df5055bbd0ee9a78d50bc97b6eba75c47ab59f4e7b8ec4dc4fc45d0fe38afacd3b97ce21a7a920afcc35e39a8cd39251f326932c21c1fd8f65eb91d716fd89a9edc8ff9775c2c d0d41c2c3ac12aba8bbe3dc98cd7aec0fa666fe1515939ff6587d81b0d763b1f0df5df4af9491a7c51949ff38b90556c6ffb3f6bb8a9eccdab1f45d6f00bf327a27dfb08b7dc7dbc8bab5e80 32089f270de9df5c3ccbca93909400043e3082043a30820322a003020102020866d39f0cf0ffff0e300d06092a864886f70d01010b0500306c310f300d060355040313067363732d6361310b 300906035504 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xb050be94b29cab4e7b2311cb3d254004 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 49 from 192.168.1.11:38756 to 192.168.1.1:1812 length 232 (3) User-Name = "scilek" (3) NAS-IP-Address = 192.168.1.11 (3) NAS-Identifier = "DENEME" (3) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) Calling-Station-Id = "7C-24-99-BB-95-97" (3) Connect-Info = "CONNECT 0Mbps 802.11b" (3) Acct-Session-Id = "2BF296A0F9146E3B" (3) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (3) Mobility-Domain-Id = 47287 (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027076 (3) WLAN-AKM-Suite = 1027075 (3) Framed-MTU = 1400 (3) EAP-Message = 0x02cc00061500 (3) State = 0xb050be94b29cab4e7b2311cb3d254004 (3) Message-Authenticator = 0x7b4285293304be6c8f0f84d0f5b9bda4 (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (3) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (3) authorize { (3) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (3) EXPAND %{User-Name} (3) --> scilek (3) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (3) EXPAND /var/log/sqltrace.sql (3) --> /var/log/sqltrace.sql (3) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (3) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (3) --> 1 (3) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (3) [preprocess] = ok (3) mysql: EXPAND %{User-Name} (3) mysql: --> scilek (3) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (4) (3) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (3) mysql: --> CALL authorize_check('scilek') (3) mysql: Executing select query: CALL authorize_check('scilek') (3) mysql: User found in radcheck table (3) mysql: Conditional check items matched, merging assignment check items (3) mysql: Cleartext-Password := "aaaa" (3) mysql: Simultaneous-Use := 3 (3) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (3) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (3) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (3) mysql: User found in radreply table, merging reply items (3) mysql: Class := 0x7363696c656b (3) mysql: Idle-Timeout := 120 (3) mysql: Acct-Interim-Interval := 600 (3) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (3) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (3) mysql: --> CALL group_membership('scilek') (3) mysql: Executing select query: CALL group_membership('scilek') (3) mysql: User not found in any groups rlm_sql (mysql): Released connection (4) (3) [mysql] = ok (3) pap: No User-Password attribute in the request. Cannot do PAP (3) [pap] = noop (3) eap: Peer sent EAP Response (code 2) ID 204 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (3) authenticate { (3) eap: Expiring EAP session with state 0xb050be94b29cab4e (3) eap: Finished EAP session with state 0xb050be94b29cab4e (3) eap: Previous EAP request found for state 0xb050be94b29cab4e, released from the list (3) eap: Peer sent packet with method EAP TTLS (21) (3) eap: Calling submodule eap_ttls to process data (3) eap_ttls: Authenticate (3) eap_ttls: (TLS) Peer ACKed our handshake fragment (3) eap: Sending EAP Request (code 1) ID 205 length 749 (3) eap: EAP session adding &reply:State = 0xb050be94b39dab4e (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (3) session-state: Saving cached attributes (3) Framed-MTU = 994 (3) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (3) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (3) Sent Access-Challenge Id 49 from 192.168.1.1:1812 to 192.168.1.11:38756 length 831 (3) Class = 0x7363696c656b (3) Idle-Timeout = 120 (3) Acct-Interim-Interval = 600 (3) EAP-Message = 0x01cd02ed158000000aa752310e300c060355040813054b4f4e5941310e300c060355040713054b6f6e7961312c302a060355040a1323534353204b7572756d7361 6c2042696c6973696d2048697a6d65746c657269204c7464820866d39f0cf0ffff0e300c0603551d13040530030101ff300b0603551d0f040403020106300d06092a864886f70d01010b0500 0382010100b5b35e2e36b89c388b93481bb63001ddbb88f7964c6df60966edfe1bee6c34ec27c1839cc4ac042cb5e7d18a27ad99786226cf4534e3fb16363d7f12efd0f4a641dbc6c7f579a2 c05d3683b2dbf88e2d148b6a6735579985e933f49f010dcd649432499ab384a4c248727f0792ab781a49e2236ae9e81ba2ef8a35ada252554ecf8f897fa887ad973d216234aef7c8b3457b50 47ba45aeba831c53bbe83f189e667c4bb8b6dc693aebcfb40b912483a4bafa94174eebff4f7e1eab56d8fe346301504f8ea00bbfb50ac1cf671fa5fada5d9581a894e5dc7255d85ad1b2a2f3 26966d39a431 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xb050be94b39dab4e7b2311cb3d254004 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 50 from 192.168.1.11:38756 to 192.168.1.1:1812 length 362 (4) User-Name = "scilek" (4) NAS-IP-Address = 192.168.1.11 (4) NAS-Identifier = "DENEME" (4) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) Calling-Station-Id = "7C-24-99-BB-95-97" (4) Connect-Info = "CONNECT 0Mbps 802.11b" (4) Acct-Session-Id = "2BF296A0F9146E3B" (4) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (4) Mobility-Domain-Id = 47287 (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027076 (4) WLAN-AKM-Suite = 1027075 (4) Framed-MTU = 1400 (4) EAP-Message = 0x02cd008815800000007e1603030046100000424104212ccaa22da9308f54b96e2c098e75a6ac78e8e529e6af5aafafc4a00f188d46c48ad3b7460e4f2d60e0b67f 9bbcddcf8ae006f12bf9835dddccb183e806d14e1403030001011603030028e5c9b201e818b89ca0c6e4cee2ca652ede7d62e443e367aab9259d13d9103888728d4fe754945a6a (4) State = 0xb050be94b39dab4e7b2311cb3d254004 (4) Message-Authenticator = 0xead07360b889c67ae378c3413274373f (4) Restoring &session-state (4) &session-state:Framed-MTU = 994 (4) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (4) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (4) authorize { (4) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (4) EXPAND %{User-Name} (4) --> scilek (4) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (4) EXPAND /var/log/sqltrace.sql (4) --> /var/log/sqltrace.sql (4) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (4) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (4) --> 1 (4) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (4) [preprocess] = ok (4) mysql: EXPAND %{User-Name} (4) mysql: --> scilek (4) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (4) (4) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (4) mysql: --> CALL authorize_check('scilek') (4) mysql: Executing select query: CALL authorize_check('scilek') (4) mysql: User found in radcheck table (4) mysql: Conditional check items matched, merging assignment check items (4) mysql: Cleartext-Password := "aaaa" (4) mysql: Simultaneous-Use := 3 (4) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (4) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (4) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (4) mysql: User found in radreply table, merging reply items (4) mysql: Class := 0x7363696c656b (4) mysql: Idle-Timeout := 120 (4) mysql: Acct-Interim-Interval := 600 (4) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (4) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (4) mysql: --> CALL group_membership('scilek') (4) mysql: Executing select query: CALL group_membership('scilek') (4) mysql: User not found in any groups rlm_sql (mysql): Released connection (4) (4) [mysql] = ok (4) pap: No User-Password attribute in the request. Cannot do PAP (4) [pap] = noop (4) eap: Peer sent EAP Response (code 2) ID 205 length 136 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (4) authenticate { (4) eap: Expiring EAP session with state 0xb050be94b39dab4e (4) eap: Finished EAP session with state 0xb050be94b39dab4e (4) eap: Previous EAP request found for state 0xb050be94b39dab4e, released from the list (4) eap: Peer sent packet with method EAP TTLS (21) (4) eap: Calling submodule eap_ttls to process data (4) eap_ttls: Authenticate (4) eap_ttls: (TLS) EAP Peer says that the final record size will be 126 bytes (4) eap_ttls: (TLS) EAP Got all data (126 bytes) (4) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write server done (4) eap_ttls: (TLS) recv TLS 1.2 Handshake, ClientKeyExchange (4) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS read client key exchange (4) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS read change cipher spec (4) eap_ttls: (TLS) recv TLS 1.2 Handshake, Finished (4) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS read finished (4) eap_ttls: (TLS) send TLS 1.2 ChangeCipherSpec (4) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write change cipher spec (4) eap_ttls: (TLS) send TLS 1.2 Handshake, Finished (4) eap_ttls: (TLS) Handshake state - Server SSLv3/TLS write finished (4) eap_ttls: (TLS) Handshake state - SSL negotiation finished successfully (4) eap_ttls: (TLS) Connection Established (4) eap_ttls: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (4) eap_ttls: TLS-Session-Version = "TLS 1.2" (4) eap: Sending EAP Request (code 1) ID 206 length 61 (4) eap: EAP session adding &reply:State = 0xb050be94b49eab4e (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (4) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (4) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (4) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (4) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (4) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (4) TLS-Session-Version = "TLS 1.2" (4) Sent Access-Challenge Id 50 from 192.168.1.1:1812 to 192.168.1.11:38756 length 139 (4) Class = 0x7363696c656b (4) Idle-Timeout = 120 (4) Acct-Interim-Interval = 600 (4) EAP-Message = 0x01ce003d1580000000331403030001011603030028a1bd9f4ebd2d8352f62849ada9ccff257bcf23bf1b41b2106e3ad06bc7812a2364f6b4868dd16e8e (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xb050be94b49eab4e7b2311cb3d254004 (4) Finished request Waking up in 4.8 seconds. (5) Received Access-Request Id 51 from 192.168.1.11:38756 to 192.168.1.1:1812 length 285 (5) User-Name = "scilek" (5) NAS-IP-Address = 192.168.1.11 (5) NAS-Identifier = "DENEME" (5) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Calling-Station-Id = "7C-24-99-BB-95-97" (5) Connect-Info = "CONNECT 0Mbps 802.11b" (5) Acct-Session-Id = "2BF296A0F9146E3B" (5) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (5) Mobility-Domain-Id = 47287 (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027076 (5) WLAN-AKM-Suite = 1027075 (5) Framed-MTU = 1400 (5) EAP-Message = 0x02ce003b158000000031170303002ce5c9b201e818b89d24f944cdd6d72ccde9dad8d6b4e335b0f2afabc76d21f170a932b2dec6d1b835763775d3 (5) State = 0xb050be94b49eab4e7b2311cb3d254004 (5) Message-Authenticator = 0x26ae96b7e6e731080aef161500bef21d (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) &session-state:TLS-Session-Version = "TLS 1.2" (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (5) authorize { (5) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (5) EXPAND %{User-Name} (5) --> scilek (5) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (5) EXPAND /var/log/sqltrace.sql (5) --> /var/log/sqltrace.sql (5) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (5) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (5) --> 1 (5) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (5) [preprocess] = ok (5) mysql: EXPAND %{User-Name} (5) mysql: --> scilek (5) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (4) (5) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (5) mysql: --> CALL authorize_check('scilek') (5) mysql: Executing select query: CALL authorize_check('scilek') (5) mysql: User found in radcheck table (5) mysql: Conditional check items matched, merging assignment check items (5) mysql: Cleartext-Password := "aaaa" (5) mysql: Simultaneous-Use := 3 (5) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (5) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (5) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (5) mysql: User found in radreply table, merging reply items (5) mysql: Class := 0x7363696c656b (5) mysql: Idle-Timeout := 120 (5) mysql: Acct-Interim-Interval := 600 (5) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (5) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (5) mysql: --> CALL group_membership('scilek') (5) mysql: Executing select query: CALL group_membership('scilek') (5) mysql: User not found in any groups rlm_sql (mysql): Released connection (4) (5) [mysql] = ok (5) pap: No User-Password attribute in the request. Cannot do PAP (5) [pap] = noop (5) eap: Peer sent EAP Response (code 2) ID 206 length 59 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (5) authenticate { (5) eap: Expiring EAP session with state 0xb050be94b49eab4e (5) eap: Finished EAP session with state 0xb050be94b49eab4e (5) eap: Previous EAP request found for state 0xb050be94b49eab4e, released from the list (5) eap: Peer sent packet with method EAP TTLS (21) (5) eap: Calling submodule eap_ttls to process data (5) eap_ttls: Authenticate (5) eap_ttls: (TLS) EAP Peer says that the final record size will be 49 bytes (5) eap_ttls: (TLS) EAP Got all data (49 bytes) (5) eap_ttls: Session established. Proceeding to decode tunneled attributes (5) eap_ttls: Got tunneled request (5) eap_ttls: EAP-Message = 0x0200000b017363696c656b (5) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (5) eap_ttls: Got tunneled identity of scilek (5) eap_ttls: Setting default EAP type for tunneled EAP session (5) eap_ttls: Sending tunneled request (5) Virtual server inner-tunnel-ttls received request (5) EAP-Message = 0x0200000b017363696c656b (5) FreeRADIUS-Proxied-To = 127.0.0.1 (5) User-Name = "scilek" (5) NAS-IP-Address = 192.168.1.11 (5) NAS-Identifier = "DENEME" (5) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) Calling-Station-Id = "7C-24-99-BB-95-97" (5) Connect-Info = "CONNECT 0Mbps 802.11b" (5) Acct-Session-Id = "2BF296A0F9146E3B" (5) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (5) Mobility-Domain-Id = 47287 (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027076 (5) WLAN-AKM-Suite = 1027075 (5) Framed-MTU = 1400 (5) Event-Timestamp = "Mar 12 2026 23:10:30 +03" (5) WARNING: Outer and inner identities are the same. User privacy is compromised. (5) server inner-tunnel-ttls { (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (5) authorize { (5) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) rlm_sql (mysql): Reserved connection (2) rlm_sql (mysql): Released connection (2) (5) EXPAND %{User-Name} (5) --> scilek (5) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (5) EXPAND /var/log/sqltrace.sql (5) --> /var/log/sqltrace.sql (5) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (3) (5) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (5) --> 1 (5) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (5) eap: Peer sent EAP Response (code 2) ID 0 length 11 (5) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (5) authenticate { (5) eap: Peer sent packet with method EAP Identity (1) (5) eap: Calling submodule eap_tls to process data (5) eap_tls: (TLS) Initiating new session (5) eap_tls: (TLS) Setting verify mode to require certificate from client (5) eap: Sending EAP Request (code 1) ID 1 length 6 (5) eap: EAP session adding &reply:State = 0x5892ccaa5893c184 (5) [eap] = handled (5) } # authenticate = handled (5) } # server inner-tunnel-ttls (5) Virtual server sending reply (5) EAP-Message = 0x010100060d20 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x5892ccaa5893c1845b13eb504fc5bcc6 (5) eap_ttls: Got tunneled Access-Challenge (5) eap: Sending EAP Request (code 1) ID 207 length 55 (5) eap: EAP session adding &reply:State = 0xb050be94b59fab4e (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (5) session-state: Saving cached attributes (5) Framed-MTU = 994 (5) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (5) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (5) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (5) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (5) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (5) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (5) TLS-Session-Version = "TLS 1.2" (5) Sent Access-Challenge Id 51 from 192.168.1.1:1812 to 192.168.1.11:38756 length 133 (5) Class = 0x7363696c656b (5) Idle-Timeout = 120 (5) Acct-Interim-Interval = 600 (5) EAP-Message = 0x01cf003715800000002d1703030028a1bd9f4ebd2d83532258cc6dc59b55571076fb3f1ba72b6ef10fb26e1f2ef0552abd71f657e3707f (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xb050be94b59fab4e7b2311cb3d254004 (5) Finished request Waking up in 4.8 seconds. (6) Received Access-Request Id 52 from 192.168.1.11:38756 to 192.168.1.1:1812 length 281 (6) User-Name = "scilek" (6) NAS-IP-Address = 192.168.1.11 (6) NAS-Identifier = "DENEME" (6) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) Calling-Station-Id = "7C-24-99-BB-95-97" (6) Connect-Info = "CONNECT 0Mbps 802.11b" (6) Acct-Session-Id = "2BF296A0F9146E3B" (6) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (6) Mobility-Domain-Id = 47287 (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027076 (6) WLAN-AKM-Suite = 1027075 (6) Framed-MTU = 1400 (6) EAP-Message = 0x02cf003715800000002d1703030028e5c9b201e818b89eccad391906fa2a9d73b4ca6f81fcca613455083803fdb15587f8d74816cb16bb (6) State = 0xb050be94b59fab4e7b2311cb3d254004 (6) Message-Authenticator = 0x57ab3d312c4a89b71a0ff58daa45105b (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (6) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (6) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) &session-state:TLS-Session-Version = "TLS 1.2" (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (6) authorize { (6) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (4) rlm_sql (mysql): Released connection (4) rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) (6) EXPAND %{User-Name} (6) --> scilek (6) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (2) (6) EXPAND /var/log/sqltrace.sql (6) --> /var/log/sqltrace.sql (6) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (2) (6) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (6) --> 1 (6) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (6) [preprocess] = ok (6) mysql: EXPAND %{User-Name} (6) mysql: --> scilek (6) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (6) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (6) mysql: --> CALL authorize_check('scilek') (6) mysql: Executing select query: CALL authorize_check('scilek') (6) mysql: User found in radcheck table (6) mysql: Conditional check items matched, merging assignment check items (6) mysql: Cleartext-Password := "aaaa" (6) mysql: Simultaneous-Use := 3 (6) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (6) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (6) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (6) mysql: User found in radreply table, merging reply items (6) mysql: Class := 0x7363696c656b (6) mysql: Idle-Timeout := 120 (6) mysql: Acct-Interim-Interval := 600 (6) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (6) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (6) mysql: --> CALL group_membership('scilek') (6) mysql: Executing select query: CALL group_membership('scilek') (6) mysql: User not found in any groups rlm_sql (mysql): Released connection (3) (6) [mysql] = ok (6) pap: No User-Password attribute in the request. Cannot do PAP (6) [pap] = noop (6) eap: Peer sent EAP Response (code 2) ID 207 length 55 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (6) authenticate { (6) eap: Expiring EAP session with state 0x5892ccaa5893c184 (6) eap: Finished EAP session with state 0xb050be94b59fab4e (6) eap: Previous EAP request found for state 0xb050be94b59fab4e, released from the list (6) eap: Peer sent packet with method EAP TTLS (21) (6) eap: Calling submodule eap_ttls to process data (6) eap_ttls: Authenticate (6) eap_ttls: (TLS) EAP Peer says that the final record size will be 45 bytes (6) eap_ttls: (TLS) EAP Got all data (45 bytes) (6) eap_ttls: Session established. Proceeding to decode tunneled attributes (6) eap_ttls: Got tunneled request (6) eap_ttls: EAP-Message = 0x02010006031a (6) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_ttls: Sending tunneled request (6) Virtual server inner-tunnel-ttls received request (6) EAP-Message = 0x02010006031a (6) FreeRADIUS-Proxied-To = 127.0.0.1 (6) User-Name = "scilek" (6) State = 0x5892ccaa5893c1845b13eb504fc5bcc6 (6) NAS-IP-Address = 192.168.1.11 (6) NAS-Identifier = "DENEME" (6) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) Calling-Station-Id = "7C-24-99-BB-95-97" (6) Connect-Info = "CONNECT 0Mbps 802.11b" (6) Acct-Session-Id = "2BF296A0F9146E3B" (6) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (6) Mobility-Domain-Id = 47287 (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027076 (6) WLAN-AKM-Suite = 1027075 (6) Framed-MTU = 1400 (6) Event-Timestamp = "Mar 12 2026 23:10:30 +03" (6) WARNING: Outer and inner identities are the same. User privacy is compromised. (6) server inner-tunnel-ttls { (6) session-state: No cached attributes (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (6) authorize { (6) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (4) rlm_sql (mysql): Released connection (4) rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) (6) EXPAND %{User-Name} (6) --> scilek (6) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (2) (6) EXPAND /var/log/sqltrace.sql (6) --> /var/log/sqltrace.sql (6) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (2) (6) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (6) --> 1 (6) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (6) eap: Peer sent EAP Response (code 2) ID 1 length 6 (6) eap: No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated (6) mysql: EXPAND %{User-Name} (6) mysql: --> scilek (6) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (6) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (6) mysql: --> CALL authorize_check('scilek') (6) mysql: Executing select query: CALL authorize_check('scilek') (6) mysql: User found in radcheck table (6) mysql: Conditional check items matched, merging assignment check items (6) mysql: Cleartext-Password := "aaaa" (6) mysql: Simultaneous-Use := 3 (6) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (6) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (6) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (6) mysql: User found in radreply table, merging reply items (6) mysql: Class := 0x7363696c656b (6) mysql: Idle-Timeout := 120 (6) mysql: Acct-Interim-Interval := 600 (6) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (6) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (6) mysql: --> CALL group_membership('scilek') (6) mysql: Executing select query: CALL group_membership('scilek') (6) mysql: User not found in any groups rlm_sql (mysql): Released connection (3) (6) [mysql] = ok (6) [expiration] = noop (6) [logintime] = noop (6) pap: WARNING: Auth-Type already set. Not setting to PAP (6) [pap] = noop (6) [mschap] = noop (6) } # authorize = updated (6) Found Auth-Type = eap (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (6) authenticate { (6) eap: Expiring EAP session with state 0x5892ccaa5893c184 (6) eap: Finished EAP session with state 0x5892ccaa5893c184 (6) eap: Previous EAP request found for state 0x5892ccaa5893c184, released from the list (6) eap: Peer sent packet with method EAP NAK (3) (6) eap: Found mutually acceptable type MSCHAPv2 (26) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: Issuing Challenge (6) eap: Sending EAP Request (code 1) ID 2 length 42 (6) eap: EAP session adding &reply:State = 0x5892ccaa5990d684 (6) [eap] = handled (6) } # authenticate = handled (6) } # server inner-tunnel-ttls (6) Virtual server sending reply (6) Class = 0x7363696c656b (6) Idle-Timeout = 120 (6) Acct-Interim-Interval = 600 (6) Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (6) EAP-Message = 0x0102002a1a0102002510bffd3059303277ba6bb6e4df54c20bc6667265657261646975732d332e322e33 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x5892ccaa5990d6845b13eb504fc5bcc6 (6) eap_ttls: Got tunneled Access-Challenge (6) eap: Sending EAP Request (code 1) ID 208 length 91 (6) eap: EAP session adding &reply:State = 0xb050be94b680ab4e (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (6) session-state: Saving cached attributes (6) Framed-MTU = 994 (6) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (6) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (6) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (6) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (6) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (6) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 52 from 192.168.1.1:1812 to 192.168.1.11:38756 length 169 (6) Class = 0x7363696c656b (6) Idle-Timeout = 120 (6) Acct-Interim-Interval = 600 (6) EAP-Message = 0x01d0005b158000000051170303004ca1bd9f4ebd2d8354e48f566537644f05d4fce9e7f724e77cfd24c307a57fd0b7abb2f2e48738c514363fec1ad495ac430a55 bbb608bb1e14441a6607cd40af34a82051e6306845f41c837a67 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xb050be94b680ab4e7b2311cb3d254004 (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 53 from 192.168.1.11:38756 to 192.168.1.1:1812 length 341 (7) User-Name = "scilek" (7) NAS-IP-Address = 192.168.1.11 (7) NAS-Identifier = "DENEME" (7) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) Calling-Station-Id = "7C-24-99-BB-95-97" (7) Connect-Info = "CONNECT 0Mbps 802.11b" (7) Acct-Session-Id = "2BF296A0F9146E3B" (7) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (7) Mobility-Domain-Id = 47287 (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027076 (7) WLAN-AKM-Suite = 1027075 (7) Framed-MTU = 1400 (7) EAP-Message = 0x02d000731580000000691703030064e5c9b201e818b89fe3f2082479bf1e2ac27cdc57ff2f5458bc9a824f789ffa65e847b6f5e0f8cf231a12618ad24e6e96a86b 5491fe8b36644763d37aa26e2b44ed6bd3ceebbe65a2d5c2f800f705685f6cdc8842705c07a7c3344f6dd7c596288158c50d (7) State = 0xb050be94b680ab4e7b2311cb3d254004 (7) Message-Authenticator = 0xe526bc0a8a29ccd71bc17ef6c0b7269e (7) Restoring &session-state (7) &session-state:Framed-MTU = 994 (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone" (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec" (7) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/staff (7) authorize { (7) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (4) rlm_sql (mysql): Released connection (4) rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) (7) EXPAND %{User-Name} (7) --> scilek (7) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (2) (7) EXPAND /var/log/sqltrace.sql (7) --> /var/log/sqltrace.sql (7) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (2) (7) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (7) --> 1 (7) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (7) [preprocess] = ok (7) mysql: EXPAND %{User-Name} (7) mysql: --> scilek (7) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (7) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (7) mysql: --> CALL authorize_check('scilek') (7) mysql: Executing select query: CALL authorize_check('scilek') (7) mysql: User found in radcheck table (7) mysql: Conditional check items matched, merging assignment check items (7) mysql: Cleartext-Password := "aaaa" (7) mysql: Simultaneous-Use := 3 (7) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (7) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (7) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (7) mysql: User found in radreply table, merging reply items (7) mysql: Class := 0x7363696c656b (7) mysql: Idle-Timeout := 120 (7) mysql: Acct-Interim-Interval := 600 (7) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (7) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (7) mysql: --> CALL group_membership('scilek') (7) mysql: Executing select query: CALL group_membership('scilek') (7) mysql: User not found in any groups rlm_sql (mysql): Released connection (3) (7) [mysql] = ok (7) pap: No User-Password attribute in the request. Cannot do PAP (7) [pap] = noop (7) eap: Peer sent EAP Response (code 2) ID 208 length 115 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (7) authenticate { (7) eap: Expiring EAP session with state 0x5892ccaa5990d684 (7) eap: Finished EAP session with state 0xb050be94b680ab4e (7) eap: Previous EAP request found for state 0xb050be94b680ab4e, released from the list (7) eap: Peer sent packet with method EAP TTLS (21) (7) eap: Calling submodule eap_ttls to process data (7) eap_ttls: Authenticate (7) eap_ttls: (TLS) EAP Peer says that the final record size will be 105 bytes (7) eap_ttls: (TLS) EAP Got all data (105 bytes) (7) eap_ttls: Session established. Proceeding to decode tunneled attributes (7) eap_ttls: Got tunneled request (7) eap_ttls: EAP-Message = 0x020200411a0202003c314cbe2e0a115563f9b5b00473c2c5746e0000000000000000149db57b3a134c0e80e803dfdc6efecef067534c43bf728d0073 63696c656b (7) eap_ttls: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_ttls: Sending tunneled request (7) Virtual server inner-tunnel-ttls received request (7) EAP-Message = 0x020200411a0202003c314cbe2e0a115563f9b5b00473c2c5746e0000000000000000149db57b3a134c0e80e803dfdc6efecef067534c43bf728d007363696c656b (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "scilek" (7) State = 0x5892ccaa5990d6845b13eb504fc5bcc6 (7) NAS-IP-Address = 192.168.1.11 (7) NAS-Identifier = "DENEME" (7) Called-Station-Id = "FE-EC-DA-07-12-00:DENEME" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) Calling-Station-Id = "7C-24-99-BB-95-97" (7) Connect-Info = "CONNECT 0Mbps 802.11b" (7) Acct-Session-Id = "2BF296A0F9146E3B" (7) Acct-Multi-Session-Id = "8D20F9078F5A89BD" (7) Mobility-Domain-Id = 47287 (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027076 (7) WLAN-AKM-Suite = 1027075 (7) Framed-MTU = 1400 (7) Event-Timestamp = "Mar 12 2026 23:10:30 +03" (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel-ttls { (7) session-state: No cached attributes (7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (7) authorize { (7) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) { rlm_sql (mysql): Reserved connection (4) rlm_sql (mysql): Released connection (4) rlm_sql (mysql): Reserved connection (0) rlm_sql (mysql): Released connection (0) rlm_sql (mysql): Reserved connection (1) rlm_sql (mysql): Released connection (1) (7) EXPAND %{User-Name} (7) --> scilek (7) SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (2) (7) EXPAND /var/log/sqltrace.sql (7) --> /var/log/sqltrace.sql (7) Executing select query: CALL is_login_allowed('scilek', '7C-24-99-BB-95-97', 'FE-EC-DA-07-12-00=3ADENEME') rlm_sql (mysql): Released connection (2) (7) EXPAND %{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')} (7) --> 1 (7) if ("%{mysql: CALL is_login_allowed('%{User-Name}', '%{Calling-Station-Id}', '%{Called-Station-Id}')}" == "0" ) -> FALSE (7) eap: Peer sent EAP Response (code 2) ID 2 length 65 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) mysql: EXPAND %{User-Name} (7) mysql: --> scilek (7) mysql: SQL-User-Name set to 'scilek' rlm_sql (mysql): Reserved connection (3) (7) mysql: EXPAND CALL authorize_check('%{SQL-User-Name}') (7) mysql: --> CALL authorize_check('scilek') (7) mysql: Executing select query: CALL authorize_check('scilek') (7) mysql: User found in radcheck table (7) mysql: Conditional check items matched, merging assignment check items (7) mysql: Cleartext-Password := "aaaa" (7) mysql: Simultaneous-Use := 3 (7) mysql: EXPAND CALL authorize_reply('%{SQL-User-Name}','%{Calling-Station-Id}') (7) mysql: --> CALL authorize_reply('scilek','7C-24-99-BB-95-97') (7) mysql: Executing select query: CALL authorize_reply('scilek','7C-24-99-BB-95-97') (7) mysql: User found in radreply table, merging reply items (7) mysql: Class := 0x7363696c656b (7) mysql: Idle-Timeout := 120 (7) mysql: Acct-Interim-Interval := 600 (7) mysql: Exec-Program-Wait = "/usr/local/bin/bash /usr/local/etc/raddb/scripts/datacounter_auth.sh scilek" (7) mysql: EXPAND CALL group_membership('%{SQL-User-Name}') (7) mysql: --> CALL group_membership('scilek') (7) mysql: Executing select query: CALL group_membership('scilek') (7) mysql: User not found in any groups rlm_sql (mysql): Released connection (3) (7) [mysql] = ok (7) [expiration] = noop (7) [logintime] = noop (7) pap: WARNING: Auth-Type already set. Not setting to PAP (7) [pap] = noop (7) [mschap] = noop (7) } # authorize = updated (7) Found Auth-Type = eap (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (7) authenticate { (7) eap: Expiring EAP session with state 0x5892ccaa5990d684 (7) eap: Finished EAP session with state 0x5892ccaa5990d684 (7) eap: Previous EAP request found for state 0x5892ccaa5990d684, released from the list (7) eap: Peer sent packet with method EAP MSCHAPv2 (26) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: Auth-Type sub-section not found. Ignoring. (7) eap_mschapv2: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (7) eap: Sending EAP Failure (code 4) ID 2 length 4 (7) eap: Freeing handler (7) [eap] = reject (7) } # authenticate = reject (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel-ttls (7) Post-Auth-Type REJECT { (7) attr_filter.access_reject: EXPAND %{User-Name} (7) attr_filter.access_reject: --> scilek (7) attr_filter.access_reject: Matched entry DEFAULT at line 11 (7) [attr_filter.access_reject] = updated (7) update outer.session-state { (7) No attributes updated for RHS &request:Module-Failure-Message (7) } # update outer.session-state = noop (7) } # Post-Auth-Type REJECT = updated (7) Login incorrect: [scilek] (from client DENEME port 0 cli 7C-24-99-BB-95-97 via TLS tunnel) (7) } # server inner-tunnel-ttls (7) Virtual server sending reply (7) EAP-Message = 0x04020004 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_ttls: Got tunneled Access-Reject (7) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (7) eap: Sending EAP Failure (code 4) ID 208 length 4 (7) eap: Failed in EAP select (7) [eap] = invalid (7) } # authenticate = invalid (7) Failed to authenticate the user (7) Using Post-Auth-Type Reject (7) Post-Auth-Type sub-section not found. Ignoring. (7) # Executing group from file /usr/local/etc/raddb/sites-enabled/staff (7) Login incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [scilek] (from client DENEME port 0 cli 7C-24-99-BB-95-97) (7) Delaying response for 1.000000 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (7) Sending delayed response (7) Sent Access-Reject Id 53 from 192.168.1.1:1812 to 192.168.1.11:38756 length 64 (7) Class = 0x7363696c656b (7) Idle-Timeout = 120 (7) Acct-Interim-Interval = 600 (7) EAP-Message = 0x04d00004 (7) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. (0) Cleaning up request packet ID 46 with timestamp +11 due to cleanup_delay was reached (1) Cleaning up request packet ID 47 with timestamp +11 due to cleanup_delay was reached (2) Cleaning up request packet ID 48 with timestamp +11 due to cleanup_delay was reached (3) Cleaning up request packet ID 49 with timestamp +11 due to cleanup_delay was reached (4) Cleaning up request packet ID 50 with timestamp +11 due to cleanup_delay was reached (5) Cleaning up request packet ID 51 with timestamp +11 due to cleanup_delay was reached (6) Cleaning up request packet ID 52 with timestamp +11 due to cleanup_delay was reached (7) Cleaning up request packet ID 53 with timestamp +11 due to cleanup_delay was reached Ready to process requests

5 6

Setting Framed-MTU in Freeradius
by Kat 13 Mar '26

13 Mar '26

Gday, Google Gemini is insisting quite strongly that, after changing fragment size in the /etc/raddb/mods-enabled/eap, I also need to put something in the post-auth part. The problem is that sometimes AI can be wrong and I cannot find alternate sources that back this claim up. My Google-fu may be weak. Google Gemini wants me to copy and paste this snippet: post-auth { update reply { Framed-MTU := 1024 } } into /etc/raddb/sites-enabled/default in the post-auth section. Gemini points to a comment block that says: "# Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for." is Google Gemini correct? Does this belong in the post-auth and is perfectly fine to do? In a previous email, https://lists.freeradius.org/pipermail/freeradius-users/2022-March/101630.h…, to this list, it sounds like it could be in sites-available/default Aren't they symlinks? I can't find anything specific to comment or uncomment, and I would have thought it would have been there, as an example. This makes me hesitant. The example is for a State attribute when I want to set a configuration. Even if the syntax is the same. So it would look like this: # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # # If you need to have a State attribute, you can # add it here. e.g. for later CoA-Request with # State, and Service-Type = Authorize-Only. # # if (!&reply:State) { # update reply { # State := "0x%{randstr:16h}" # } # } update reply { Framed-MTU := 1024 } Yay or Nay? Kat

3 2

Question about Clickhouse DB to Store Accounting
by Ibrahim Almahfooz 06 Mar '26

06 Mar '26

Pertaining the concern mentioned by Alan about clickhouse db updates queries, if you mean the update statements, well as option-1 what i'm trying to writing directly into the ClickHouse database. I was thinking to replace the update statements by insert for both Interim-Update and Stop to log all accounting triggers instead of updating in-place since what I want to track all accounting changes happening per session. Any concerns here for this approach? As option-2 approach, I thought of using the details module, perhaps with on hourly %H or minutes %G rotations and then use some thirdparty pipelines to parse those and write them in batches into a ClickHouse DB and track the files written. To help having an idea of current accounting rate per minute (peak hours): interims: 30k, starts: 500, stops: 1k

1 1

Question about Clickhouse DB to Store Accounting
by Ibrahim Almahfooz 06 Mar '26

06 Mar '26

Hello, We are working on a project to store every accounting start, update and stop for special reporting purposes and we are thinking of using ClickHouse DB due to its capability such as supporting fast analytical queries and great for reporting and BI dashboards. Are there any concerns or suggestions if we decide to use rlm_sql_unixodbc with it, concerns like compatibility or performance? Thanks

3 2

EAP-TLS with Google Secure LDAP - iPhone authentication issue
by Helder Miolo 06 Mar '26

06 Mar '26

Hello, I am running FreeRADIUS 3.0 on Ubuntu 24.04. I am trying to authenticate users via WPA2-Enterprise using Google Secure LDAP as the backend.It turns out that Android phones are working perfectly, but iPhones are experiencing a similar error: 5) ldap: ERROR: Attribute "User-Password" is required for authentication (5) [ldap] = invalid (5) } # Auth-Type LDAP = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> 706130272(a)ucm.ac.mz (5) attr_filter.access_reject: Matched entry DEFAULT at line 11 (5) [attr_filter.access_reject] = updated (5) update outer.session-state { (5) &Module-Failure-Message := &request:Module-Failure-Message -> 'ldap: Attribute "User-Password" is required for authentication' (5) } # update outer.session-state = noop (5) } # Post-Auth-Type REJECT = updated (5) Login incorrect (ldap: Attribute "User-Password" is required for authentication): [706130272(a)ucm.ac.mz] (from client ap4 port 0 cli 7E-F4-29-39-B9-0F via TLS tunnel) (5) } # server inner-tunnel (5) Virtual server sending reply (5) eap_ttls: Got tunneled Access-Reject (5) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed Problem: - IPhone forces MSCHAPv2 even when EAP-TTLS/PAP is configured - radtest with PAP works successfully Current configuration: - eap.conf: default_eap_type = ttls, ttls { default_eap_type = pap } - inner-tunnel: Auth-Type PAP and LDAP configured - libldap is using GnuTLS while FreeRADIUS uses OpenSSL (Ubuntu 24.04 issue)

3 2

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

Freeradius Framed-MTU
by Kat 02 Mar '26

02 Mar '26

> 2. Re: Setting Framed-MTU in Freeradius (Nick Porter) > Gday, To start with, thank you so much Nick Porter for answering! That is amazing! Thank you :-) > > This is a case of AI being confidently wrong - but there is wrong > information out there which was probably part of the training set. Based on your email, I took another look and I found reference to Framed-MTU in the etc/raddb/users file, so I uncommented that in and tried to set it to 1024. I saved the changes and restarted the server in -x. And then reconnected to check the logs. A subset of logs are provided below the email. Framed-MTU is being set to 1002 or 994, not 1024. eg: (24) Framed-MTU += 994 (24) Framed-MTU = 1002 (24) &session-state:Framed-MTU = 994 Google Gemini tells me it is because of this line: (24) [files] = noop and that the default setting of Framed-MTU that I brought back in is being disregarded because the supplicant has an identity. So do I need to put that identity in the users file and set the Framed-MTU there specifically? > If you are running into issues with fragmentation on the packets from > client to server, then usually the key is getting path MTU discovery to > work correctly.? Failing that, it is a matter of ensuring that fragments > are not getting dropped by firewalls. I would like to set the Framed-MTU because I have been asked to do so. I don't know if it will help them or not but I want to do it because I have been asked to do so. Why they want to set Framed-MTU is because Freeradius is returning many debug lines that look like this: (458002) Cleaning up request packet ID 112 with timestamp +945036 due to cleanup_delay was reached They are hoping that setting the Framed-MTU will solve this. > Example logs: (24) Received Access-Request Id 193 from 172.17.0.1:52424 to 172.17.0.2:1812 length 243 (24) User-Name = "redacted" (24) NAS-IP-Address = redacted (24) NAS-Identifier = "redacted" (24) Called-Station-Id = "2A-70-4E-AB-FB-33:T-TEC Enterprise" (24) NAS-Port-Type = Wireless-802.11 (24) Service-Type = Framed-User (24) Calling-Station-Id = "redacted" (24) Connect-Info = "CONNECT 24Mbps 802.11a" (24) Acct-Session-Id = "1B70491FD72097B8" (24) Acct-Multi-Session-Id = "33F1B622305CBD65" (24) WLAN-Pairwise-Cipher = 1027076 (24) WLAN-Group-Cipher = 1027076 (24) WLAN-AKM-Suite = 1027073 (24) Framed-MTU = 1002 (24) EAP-Message = 0x02f500060d00 (24) State = 0xc08ccb62c779c6c0c349c973c80ddb37 (24) Chargeable-User-Identity = 0x00 (24) Message-Authenticator = 0x9151c9eca3140df6df7002b31dd0faa0 (24) Restoring &session-state (24) &session-state:Framed-MTU = 994 (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Certificate" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Finished" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 ChangeCipherSpec" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Finished" (24) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (24) &session-state:TLS-Session-Version = "TLS 1.2" (24) # Executing section authorize from file /etc/freeradius/sites-enabled/default (24) authorize { (24) policy filter_username { (24) if (&User-Name) { (24) if (&User-Name) -> TRUE (24) if (&User-Name) { (24) if (&User-Name =~ / /) { (24) if (&User-Name =~ / /) -> FALSE (24) if (&User-Name =~ /@[^@]*@/ ) { (24) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (24) if (&User-Name =~ /\.\./ ) { (24) if (&User-Name =~ /\.\./ ) -> FALSE (24) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (24) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (24) if (&User-Name =~ /\.$/) { (24) if (&User-Name =~ /\.$/) -> FALSE (24) if (&User-Name =~ /(a)\./) { (24) if (&User-Name =~ /(a)\./) -> FALSE (24) } # if (&User-Name) = notfound (24) } # policy filter_username = notfound (24) [preprocess] = ok (24) [digest] = noop (24) suffix: Checking for suffix after "@" (24) suffix: No '@' in User-Name = "redacted", looking up realm NULL (24) suffix: No such realm "NULL" (24) [suffix] = noop (24) eap: Peer sent EAP Response (code 2) ID 245 length 6 (24) eap: No EAP Start, assuming it's an on-going EAP conversation (24) [eap] = updated (24) [files] = noop (24) [expiration] = noop (24) [logintime] = noop (24) } # authorize = updated (24) Found Auth-Type = eap (24) # Executing group from file /etc/freeradius/sites-enabled/default (24) authenticate { (24) eap: Removing EAP session with state 0xc08ccb62c779c6c0 (24) eap: Previous EAP request found for state 0xc08ccb62c779c6c0, released from the list (24) eap: Peer sent packet with method EAP TLS (13) (24) eap: Calling submodule eap_tls to process data (24) eap_tls: (TLS) Peer ACKed our handshake fragment. handshake is finished (24) eap: Sending EAP Success (code 3) ID 245 length 4 (24) eap: Freeing handler (24) [eap] = ok (24) } # authenticate = ok (24) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (24) post-auth { (24) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (24) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (24) update { (24) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994 (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, ClientHello' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHello' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Certificate' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Certificate' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Finished' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 ChangeCipherSpec' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Finished' (24) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (24) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (24) } # update = noop (24) [exec] = noop (24) policy remove_reply_message_if_eap { (24) if (&reply:EAP-Message && &reply:Reply-Message) { (24) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (24) else { (24) [noop] = noop (24) } # else = noop (24) } # policy remove_reply_message_if_eap = noop (24) if (EAP-Key-Name && &reply:EAP-Session-Id) { (24) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (24) } # post-auth = noop (24) Sent Access-Accept Id 193 from 172.17.0.2:1812 to 172.17.0.1:52424 length 173 (24) MS-MPPE-Recv-Key = 0x9e7d6bc3e620c918df655f5b6f3df6354afb8a122a23d067e577eeceef5d41dd (24) MS-MPPE-Send-Key = 0x30c4a64e47a5fadfdbe66e814dda937c5a16d504439fdb0c7e21602acbc3664b (24) EAP-Message = 0x03f50004 (24) Message-Authenticator = 0x00000000000000000000000000000000 (24) User-Name = "redacted" (24) Framed-MTU += 994 (24) Finished request Waking up in 4.8 seconds.

2 1

include_length in mods-available/eap
by Stephen Mellor 27 Feb '26

27 Feb '26

FreeRADIUS 3.2.4 on OpenSUSE Leap 15.6 mods-available/eap tls-config tls-common { # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes I think I've just solved a long-standing problem for our EAP-TLS authentication for wired networks (NAS are Aruba 6200m and 3810m, supplicants are HP Windows 11). We'd see occasional problems where a laptop would start the authentication process, and freeradius would send-accept, but the laptop would never get the message. Eventually it would failover to wifi, then recognise that there was an ethernet connection, try ethernet again, same result, and repeat until the user pulled the ethernet cable out of the laptop or dock. This was quite a rare occurrence, and not consistently repeatable, so tricky to debug, though with several hundred users it seemed that there was always someone complaining (after the event!). We failed to find any pattern of hardware: although all laptops are recent HP we've a variety of USB docks. However, eventually I stumbled across this: https://community.cisco.com/t5/network-access-control/eap-tls-w-freeradius-… Sure enough, setting include_length to no does seem to have fixed our problem. It's early days yet so I'm not 100% certain, but there were a couple of laptops failing yesterday which stopped when I made the change, and I've seen none failing today. -------------------------------------------------------------------------------------------------------------------------------------------------------- This email is intended for the named recipient only. If you have received it by mistake, please (i) contact the sender by email reply; (ii) delete the email from your system; . and (iii) do not copy the email or disclose its contents to anyone. --------------------------------------------------------------------------------------------------------------------------------------------------------

2 1

Copy inner to outer identity via session-state
by Samuel LEFOL 11 Feb '26

11 Feb '26

Hello, I've configured a FreeRADIUS 3.2.7 system to run PEAP/MSCHAPv2. I would like to have Inner-Identity and Outer-Identity displayed in the logs. - in mods-enabled/eap, I have: tls-config tls-common { ... cache { enable=yes lifetime = 24 name = "EAP-EDU module" persist_dir = "${db_dir}/tlscache" } } peap { ... copy_request_to_tunnel = no } - in sites-enabled/inner-tunnel, I put: post-auth { update outer.session-state { Tmp-String-0 := &User-Name } ... } or this alternative configuration : post-auth { if (1) { update reply { Tmp-String-0 := &User-Name } update { &outer.session-state: += &reply: } } ... } as it says in the comments of the mods-enabled/eap file "If you need to send a reply attribute in the outer session, the ONLY safe way is to set "use_tunneled_reply = yes", and then update the inner-tunnel reply." - in sites-enabled/default post-auth { inner_outer } with inner_outer defined in mods-enabled/linelog file : linelog inner_outer { destination = files filename = ${logdir}/inner_outer.log format = "Packet-Type=%{%{reply:Packet-Type}:-default} Outer-User=%{User-Name} Inner-User=%{%{session-state:Tmp-String-0}:-unknown}" } The problem is that sometimes I get Packet-Type=Access-Accept Outer-User=anonymous(a)xxxx.fr Inner-User=unknown I don't understand why. Is it true that the session state may not be restored correctly to the last outer packet in certain cases such as: - TLS session resumption - specific fragmentation - specific timing - Windows fast reconnect Is this an architectural limitation in version 3.x? The only truly reliable method I've found is to log the inner identity in `inner-tunnel` and the outer identity in `default`, and to correlate via Calling-Station-Id + Event-Timestamp Is this the only method ? If possible, I would also like to be able to construct `reply.User-Name=sam(a)toto.fr` from `request.User-Name=anonymous(a)toto.fr` + `inner.User-Name=sam` Could you please help me? Best regards, -- Samuel

1 0