- Freeradius-Users - lists.freeradius.org

Segfault on FR 3.0.4 when MySQL server goes away
by Jonathan Gazeley 24 Nov '15

24 Nov '15

I'm currently running a mixed estate of RADIUS 2 and 3 on CentOS 6 and 7 (halfway through a migration project). The older servers are running a home-built FR 2.2.9 and the newer ones are running stock FR 3.0.4, as supplied with CentOS 7. I've noticed the FR 3 boxes segfault from time to time and I think I've pinned it down to odd behaviour when the MySQL server is temporarily unavailable. We have clustered SQL behind an F5 load balancer but there is a small delay during failover when one of the SQL nodes goes away or when the F5 decides to switch to a different node for some other reason. The FR2 boxes cope fine with this transition but the FR3 boxes segfault in about 50% of cases. I understand 3.0.4 is not the latest and I'm happy to build 3.1.x if this will fix the problem but initially I'm trying to work out if this is a bug in the server, or a misconfiguration on my part (although I'd hope a misconfiguration wouldn't cause a crash). Backtrace included below, although this was not built with --enable-developer since it is a busy production system. I tried to replicate this on a dev system but the much lower load makes it hard to cause the crash. Thanks, Jonathan ... rlm_sql (uobsql-write): Reserved connection (4) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (4) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (3) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (3) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (2) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (2) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (1) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (1) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Reserved connection (0) rlm_sql (uobsql-write): Executing query: 'select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'' rlm_sql_mysql: MYSQL check_error: 2006, returning RLM_SQL_RECONNECT rlm_sql (uobsql-write): Reconnecting (0) rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Couldn't connect socket to MySQL server radiusd@db-write.nomadic-core.bris.ac.uk:radius rlm_sql_mysql: Mysql error 'Lost connection to MySQL server at 'reading initial communication packet', system error: 104' rlm_sql (uobsql-write): Failed to reconnect (0), no free connections are available Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7ffff1a5f700 (LWP 23087)] sql_error (handle=0x0, config=0x555555b58b70) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:479 479 rlm_sql_mysql_conn_t *conn = handle->conn; (gdb) bt #0 sql_error (handle=0x0, config=0x555555b58b70) at src/modules/rlm_sql/drivers/rlm_sql_mysql/rlm_sql_mysql.c:479 #1 0x00007ffff298558b in sql_xlat (instance=0x555555b58b70, request=0x555555ca2c90, query=0x7fffd4035970 "select count(*) from localprod.all_users_table where suspended is not null and common_username='it000543'", out=0x7fffd4017980 "", freespace=1024) at src/modules/rlm_sql/rlm_sql.c:185 #2 0x00007ffff7bcc606 in xlat_aprint (ctx=ctx@entry=0x555555ca2c90, request=0x555555ca2c90, node=0x555555c62b30, escape=escape@entry=0x0, escape_ctx=0x0, lvl=0) at src/main/xlat.c:2025 #3 0x00007ffff7bcd1bd in xlat_process (out=0x7ffff1a5df60, request=0x555555ca2c90, head=0x555555c62b30, escape=0x0, escape_ctx=0x0) at src/main/xlat.c:2103 #4 0x00007ffff7bcd210 in xlat_expand_struct (out=0x7ffff1a5e000, outlen=0, request=<optimized out>, node=<optimized out>, escape=<optimized out>, escape_ctx=<optimized out>) at src/main/xlat.c:2175 #5 0x00007ffff7bc105e in radius_expand_tmpl (out=out@entry=0x7ffff1a5e000, request=request@entry=0x555555ca2c90, vpt=0x555555aa28b0) at src/main/evaluate.c:135 #6 0x00007ffff7bc15ca in radius_evaluate_map (request=request@entry=0x555555ca2c90, modreturn=modreturn@entry=10, depth=depth@entry=0, c=c@entry=0x555555aa2620) at src/main/evaluate.c:807 #7 0x00007ffff7bc1be0 in radius_evaluate_cond (request=request@entry=0x555555ca2c90, modreturn=10, depth=depth@entry=0, c=0x555555aa2620) at src/main/evaluate.c:913 #8 0x0000555555577dd8 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=3, entry=entry@entry=0x7ffff1a5e9d8) at src/main/modcall.c:489 #9 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e9c0, c=<optimized out>, result=0x7ffff1a5e3e4) at src/main/modcall.c:420 #10 0x0000555555577c67 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=2, entry=entry@entry=0x7ffff1a5e9c0) at src/main/modcall.c:798 #11 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e9a8, c=<optimized out>, result=0x7ffff1a5e5f4) at src/main/modcall.c:420 #12 0x0000555555577c67 in modcall_recurse (request=0x555555ca2c90, component=RLM_COMPONENT_POST_AUTH, depth=1, entry=entry@entry=0x7ffff1a5e9a8) at src/main/modcall.c:798 #13 0x0000555555577a70 in modcall_child (request=<optimized out>, component=<optimized out>, depth=<optimized out>, entry=0x7ffff1a5e990, c=<optimized out>, result=0x7ffff1a5e804) at src/main/modcall.c:420 #14 0x0000555555577c67 in modcall_recurse (request=request@entry=0x555555ca2c90, component=component@entry=RLM_COMPONENT_POST_AUTH, depth=depth@entry=0, entry=entry@entry=0x7ffff1a5e990) at src/main/modcall.c:798 #15 0x0000555555578e90 in modcall (component=component@entry=RLM_COMPONENT_POST_AUTH, c=c@entry=0x555555c33170, request=request@entry=0x555555ca2c90) at src/main/modcall.c:1138 #16 0x00005555555762bf in indexed_modcall (comp=comp@entry=RLM_COMPONENT_POST_AUTH, idx=idx@entry=0, request=request@entry=0x555555ca2c90) at src/main/modules.c:909 #17 0x0000555555576eef in process_post_auth (postauth_type=postauth_type@entry=0, request=request@entry=0x555555ca2c90) at src/main/modules.c:1930 #18 0x000055555556724e in rad_postauth (request=request@entry=0x555555ca2c90) at src/main/auth.c:305 #19 0x000055555558185c in request_finish (request=request@entry=0x555555ca2c90, action=action@entry=1) at src/main/process.c:1346 #20 0x00005555555866cf in request_running (request=0x555555ca2c90, action=<optimized out>) at src/main/process.c:1535 #21 0x0000555555580617 in request_handler_thread (arg=0x555555c5f250) at src/main/threads.c:678 #22 0x00007ffff625ddf5 in start_thread (arg=0x7ffff1a5f700) at pthread_create.c:308 #23 0x00007ffff5b0e1ad in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

2 1

Serious problems with buffered accounting
by Jorge Pereira 24 Nov '15

24 Nov '15

Hi, Nowadays, I have tons of Accounting packets as stats below. # radsniff -i eth0 -f "port 1813" -W10 ######### Stats Iteration 2 ######### Interface capture rate: eth0 : 42.700/s Accounting-Request counters: Total : 21.400/s Linked : 21.200/s Unlinked : 0.000/s Accounting-Request latency: High : 113.875ms Low : 7.446ms Average : 31.365ms MA : 31.365ms Accounting-Request retransmits & loss: RT (0) : 24.600/s Accounting-Response counters: Total : 21.200/s Linked : 21.200/s Unlinked : 0.000/s Accounting-Response latency: High : 113.875ms Low : 7.446ms Average : 31.365ms MA : 31.365ms # And my approach was to use the buffered accounting as example below. # Simple accounting server server default_accounting { listen { ipaddr = * port = 0 type = acct } accounting { detail-buffered } } # written by detail detail-buffered { filename = ${radacctdir}/buffered/detail-%Y%m%d-%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}} escape_filenames = no permissions = 0600 header = "%t" log_packet_header = yes suppress { User-Password } } # consumed by server buffered-accounting { listen { type = detail filename = "${radacctdir}/buffered/detail-*" load_factor = 30 retry_interval = 5 # poll_interval = 15 # track = yes } preacct { preprocess acct_unique } accounting { -sql_accounting if (!ok) { linelog-fail-sql ok } } } My problem is: The process that receive and write the packets is completely fast them who consume (buffered-accounting). This causes a big queue of files in /var/log/freeradius/buffered/ resulting in a giant delay. I have thinking about some issue related to race-condition or dead-lock. I really appreciate some tips and suggestions. -- Jorge Pereira

2 2

Re: FreeRadius 3.0.4
by oscar 23 Nov '15

23 Nov '15

Sorry, I reinstalled all again and still the same problem. What i should do? Unlink sql? Thanks. -------- Mensaje original -------- De: A.L.M.Buxey(a)lboro.ac.uk Fecha: 22/11/2015 21:23 (GMT+01:00) Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Asunto: Re: FreeRadius 3.0.4 Hi, > including configuration file /etc/raddb/sites-enabled/inner-tunnel > /etc/raddb/mods-config/sql/main/mysql/queries.conf[145]: Reference "${group_attribute}" not found > Errors reading or parsing /etc/raddb/radiusd.conf file read at wrong time > First time I modified some parameters on radiusd.conf, and run ln -s ../mods-available/sql ./, and configure sql parametres. yes, dont do that. SQL is , like LDAP, now a module that understands if it can be run. if you are doing any linking at all it would be to link mods-available/sql to mods-enabled/sql ${group_attribute} is actually defined in the sql config file alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 3

advaice on how to create certificates and setup an EAP-TLS from freeradius
by Achuthan Paramanathan 23 Nov '15

23 Nov '15

I need to create an EAP-TLS authentication using a freeradius. Currently I am a working EAP-PEAP setup, it is working fine. However, I now needs to move to an EAP-TLS. For this I need to create some certificates (I am thinking of openSSL for that?). But I was not able to find useful information (a step-by step guide) on the wide net that could help me so I am trying my luck here. The wiki page from Freeraius site is not working: http://www.missl.cs.umd.edu/wireless/eaptls/ About my system: * AP: A TP-Link n750 * Radius Server: Ubuntu Server 14.04.3 LTS, running FreeRADIUS 2.1.12 * Client: Another ubuntu desktop It would be great if someone knows a good and detailed (working) step-by-step guide to do this, and can give me some link information. Thanks in advance /Acp

5 9

Help with EAP-TTLS and PAP
by Hans Hering 23 Nov '15

23 Nov '15

Hey,I know this gets asked a lot and I spent quite a while searching for my use case, but I couldn't find anything that helped me.First a little bit about my setup:We have a Sun DS with salted SHA1 passwords, freeradius 3.0.10, Aruba IAP-225 access points and Windows and OS X clients.My goal is having the users log on to the WPA2 Enterprise wifi with their LDAP credentials and no client configuration whatsoever. This means I don't want to install network profiles on the Macs and no EAP-GTC plugins on the Windows machines.From what I've read, this should be possible with EAP-TTLS and inner PAP, as PAP can work with salted SHA1 passwords. However, in all the setup guides I looked at, it said the eap module should use default_eap_type = ttls in the outer section and default_eap_type = md5 in the ttls section and then PAP should be used. I verified PAP is working and if I use EAP-TTLS with inner EAP-GTC my Macs can logon just fine.So my question is now: what am I doing wrong? Is inner EAP-MD5 correct? Is what I'm trying to do even possible?Any help is greatly appreciated!Below the debug output of EAP-TTLS with inner EAP-MD5:Copyright (C) 1999-2015 The FreeRADIUS server project and contributorsThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR APARTICULAR PURPOSEYou may redistribute copies of FreeRADIUS under the terms of theGNU General Public LicenseFor more information about these matters, see the file named COPYRIGHTStarting - reading configuration files ...including dictionary file /usr/share/freeradius/dictionaryincluding dictionary file /usr/share/freeradius/dictionary.dhcpincluding dictionary file /usr/share/freeradius/dictionary.vqpincluding dictionary file /etc/freeradius/dictionaryincluding configuration file /etc/freeradius/radiusd.confincluding configuration file /etc/freeradius/proxy.confincluding configuration file /etc/freeradius/clients.confincluding files in directory /etc/freeradius/mods-enabled/including configuration file /etc/freeradius/mods-enabled/expirationincluding configuration file /etc/freeradius/mods-enabled/dynamic_clientsincluding configuration file /etc/freeradius/mods-enabled/digestincluding configuration file /etc/freeradius/mods-enabled/attr_filterincluding configuration file /etc/freeradius/mods-enabled/utf8including configuration file /etc/freeradius/mods-enabled/preprocessincluding configuration file /etc/freeradius/mods-enabled/linelogincluding configuration file /etc/freeradius/mods-enabled/alwaysincluding configuration file /etc/freeradius/mods-enabled/eapincluding configuration file /etc/freeradius/mods-enabled/mschapincluding configuration file /etc/freeradius/mods-enabled/unpackincluding configuration file /etc/freeradius/mods-enabled/ntlm_authincluding configuration file /etc/freeradius/mods-enabled/radutmpincluding configuration file /etc/freeradius/mods-enabled/detail.logincluding configuration file /etc/freeradius/mods-enabled/sohincluding configuration file /etc/freeradius/mods-enabled/detailincluding configuration file /etc/freeradius/mods-enabled/unixincluding configuration file /etc/freeradius/mods-enabled/papincluding configuration file /etc/freeradius/mods-enabled/chapincluding configuration file /etc/freeradius/mods-enabled/logintimeincluding configuration file /etc/freeradius/mods-enabled/realmincluding configuration file /etc/freeradius/mods-enabled/sradutmpincluding configuration file /etc/freeradius/mods-enabled/filesincluding configuration file /etc/freeradius/mods-enabled/ldapincluding configuration file /etc/freeradius/mods-enabled/echoincluding configuration file /etc/freeradius/mods-enabled/cache_eapincluding configuration file /etc/freeradius/mods-enabled/exprincluding configuration file /etc/freeradius/mods-enabled/execincluding configuration file /etc/freeradius/mods-enabled/replicateincluding configuration file /etc/freeradius/mods-enabled/passwdincluding files in directory /etc/freeradius/policy.d/including configuration file /etc/freeradius/policy.d/abfab-trincluding configuration file /etc/freeradius/policy.d/eapincluding configuration file /etc/freeradius/policy.d/operator-nameincluding configuration file /etc/freeradius/policy.d/controlincluding configuration file /etc/freeradius/policy.d/canonicalizationincluding configuration file /etc/freeradius/policy.d/filterincluding configuration file /etc/freeradius/policy.d/debugincluding configuration file /etc/freeradius/policy.d/cuiincluding configuration file /etc/freeradius/policy.d/dhcpincluding configuration file /etc/freeradius/policy.d/accountingincluding files in directory /etc/freeradius/sites-enabled/including configuration file /etc/freeradius/sites-enabled/inner-tunnelincluding configuration file /etc/freeradius/sites-enabled/defaultmain { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius"}main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes }}radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { }radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client <ip> { require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } }No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client <ip>. Please fix your configurationSupport for old-style clients will be removed in a future releaseDebugger not attached # Creating Auth-Type = digestradiusd: #### Instantiating modules #### # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_exec # Loading module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_detail # Loading module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loading module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" }Creating attribute Unix-Group # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } # Loading module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" } # Loaded module rlm_ldap # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap ldap { server = "ldaps://<url>" port = 636 identity = "uid=xxx,ou=xxx,dc=xxx,dc=xxx" password = <<< secret >>> sasl { } user { scope = "sub" access_positive = yes sasl { } } group { filter = "(objectClass=posixGroup)" scope = "sub" name_attribute = "cn" membership_attribute = "isMemberOf" cacheable_name = no cacheable_dn = no } client { filter = "(objectClass=radiusClient)" scope = "sub" base_dn = "dc=xxx,dc=xxx" } profile { } options { ldap_debug = 40 chase_referrals = yes rebind = yes net_timeout = 1 res_timeout = 10 srv_timelimit = 3 idle = 60 probes = 3 interval = 3 } tls { start_tls = no require_cert = "never" } }Creating attribute LDAP-Group # Loading module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loading module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/mods-enabled/replicate # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } instantiate { } modules { # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject[/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". [/etc/freeradius/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filterreading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocessreading pairlist file /etc/freeradius/mods-config/preprocess/huntgroupsreading pairlist file /etc/freeradius/mods-config/preprocess/hints # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no }tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschaprlm_mschap (mschap): using internal authentication # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.logrlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm # Instantiating module "files" from file /etc/freeradius/mods-enabled/filesreading pairlist file /etc/freeradius/mods-config/files/authorizereading pairlist file /etc/freeradius/mods-config/files/accountingreading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Instantiating module "ldap" from file /etc/freeradius/mods-enabled/ldaprlm_ldap: libldap vendor: OpenLDAP, version: 20431 accounting { reference = "%{tolower:type.%{Acct-Status-Type}}" } post-auth { reference = "." }rlm_ldap (ldap): Initialising connection pool pool { start = 5 min = 3 max = 32 spare = 10 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 60 retry_delay = 30 spread = no }rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successfulrlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eaprlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwdrlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no } # modulesradiusd: #### Loading Virtual Servers ####server { # from file /etc/freeradius/radiusd.conf} # serverserver inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...}Ignoring "sql" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...}} # server inner-tunnelserver default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...}} # server defaultradiusd: #### Opening IP addresses and Ports ####listen { type = "auth" ipaddr = 127.0.0.1 port = 18120}listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 }}Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnelListening on auth address * port 1812 bound to server defaultListening on acct address * port 1813 bound to server defaultListening on auth address :: port 1812 bound to server defaultListening on acct address :: port 1813 bound to server defaultListening on proxy address * port 53683Listening on proxy address :: port 41662Ready to process requests(0) Received Access-Request Id 67 from <ip>:59898 to <ip>:1812 length 201(0) User-Name = "hans.hering"(0) NAS-IP-Address = <ip>(0) NAS-Port = 0(0) NAS-Identifier = "<ip>"(0) NAS-Port-Type = Wireless-802.11(0) Calling-Station-Id = "4400100e904c"(0) Called-Station-Id = "186472cd167a"(0) Service-Type = Login-User(0) Framed-MTU = 1100(0) EAP-Message = 0x020100100168616e732e686572696e67(0) Aruba-Essid-Name = "<ssid>"(0) Aruba-Location-Id = "<apname>"(0) Aruba-AP-Group = "<apname>"(0) Message-Authenticator = 0x4cb828b841364e2b93bf7cd49d37cd93(0) # Executing section authorize from file /etc/freeradius/sites-enabled/default(0) authorize {(0) policy filter_username {(0) if (!&User-Name) {(0) if (!&User-Name) -> FALSE(0) if (&User-Name =~ / /) {(0) if (&User-Name =~ / /) -> FALSE(0) if (&User-Name =~ /@.*@/ ) {(0) if (&User-Name =~ /@.*@/ ) -> FALSE(0) if (&User-Name =~ /\.\./ ) {(0) if (&User-Name =~ /\.\./ ) -> FALSE(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(0) if (&User-Name =~ /\.$/) {(0) if (&User-Name =~ /\.$/) -> FALSE(0) if (&User-Name =~ /(a)\./) {(0) if (&User-Name =~ /(a)\./) -> FALSE(0) } # policy filter_username = notfound(0) [preprocess] = ok(0) [chap] = noop(0) [mschap] = noop(0) [digest] = noop(0) suffix: Checking for suffix after "@"(0) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(0) suffix: No such realm "NULL"(0) [suffix] = noop(0) eap: Peer sent EAP Response (code 2) ID 1 length 16(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize(0) [eap] = ok(0) } # authorize = ok(0) Found Auth-Type = EAP(0) # Executing group from file /etc/freeradius/sites-enabled/default(0) authenticate {(0) eap: Peer sent packet with method EAP Identity (1)(0) eap: Calling submodule eap_ttls to process data(0) eap_ttls: Initiating new EAP-TLS session(0) eap_ttls: Flushing SSL sessions (of #0)(0) eap_ttls: [eaptls start] = request(0) eap: Sending EAP Request (code 1) ID 2 length 6(0) eap: EAP session adding &reply:State = 0x8aa7dbf48aa5ce2f(0) [eap] = handled(0) } # authenticate = handled(0) Using Post-Auth-Type Challenge(0) Post-Auth-Type sub-section not found. Ignoring.(0) # Executing group from file /etc/freeradius/sites-enabled/default(0) Sent Access-Challenge Id 67 from <ip>:1812 to <ip>:59898 length 0(0) EAP-Message = 0x010200061520(0) Message-Authenticator = 0x00000000000000000000000000000000(0) State = 0x8aa7dbf48aa5ce2f8993e0490c51278d(0) Finished requestWaking up in 4.9 seconds.(1) Received Access-Request Id 68 from <ip>:59898 to <ip>:1812 length 346(1) User-Name = "hans.hering"(1) NAS-IP-Address = <ip>(1) NAS-Port = 0(1) NAS-Identifier = "<ip>"(1) NAS-Port-Type = Wireless-802.11(1) Calling-Station-Id = "4400100e904c"(1) Called-Station-Id = "186472cd167a"(1) Service-Type = Login-User(1) Framed-MTU = 1100(1) EAP-Message = 0x0202008f15800000008516030100800100007c03015652d246ab03a55f379e0aba7bb683d2d8dbcc4d28270098815788bf8fbde73b00003400ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000ac007c011000500040100001f000a0008000600(1) State = 0x8aa7dbf48aa5ce2f8993e0490c51278d(1) Aruba-Essid-Name = "<ssid>"(1) Aruba-Location-Id = "<apname>"(1) Aruba-AP-Group = "<apname>"(1) Message-Authenticator = 0xa5b6bb20d994d289ff9bb012b9f6de16(1) session-state: No cached attributes(1) # Executing section authorize from file /etc/freeradius/sites-enabled/default(1) authorize {(1) policy filter_username {(1) if (!&User-Name) {(1) if (!&User-Name) -> FALSE(1) if (&User-Name =~ / /) {(1) if (&User-Name =~ / /) -> FALSE(1) if (&User-Name =~ /@.*@/ ) {(1) if (&User-Name =~ /@.*@/ ) -> FALSE(1) if (&User-Name =~ /\.\./ ) {(1) if (&User-Name =~ /\.\./ ) -> FALSE(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(1) if (&User-Name =~ /\.$/) {(1) if (&User-Name =~ /\.$/) -> FALSE(1) if (&User-Name =~ /(a)\./) {(1) if (&User-Name =~ /(a)\./) -> FALSE(1) } # policy filter_username = notfound(1) [preprocess] = ok(1) [chap] = noop(1) [mschap] = noop(1) [digest] = noop(1) suffix: Checking for suffix after "@"(1) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(1) suffix: No such realm "NULL"(1) [suffix] = noop(1) eap: Peer sent EAP Response (code 2) ID 2 length 143(1) eap: Continuing tunnel setup(1) [eap] = ok(1) } # authorize = ok(1) Found Auth-Type = EAP(1) # Executing group from file /etc/freeradius/sites-enabled/default(1) authenticate {(1) eap: Expiring EAP session with state 0x8aa7dbf48aa5ce2f(1) eap: Finished EAP session with state 0x8aa7dbf48aa5ce2f(1) eap: Previous EAP request found for state 0x8aa7dbf48aa5ce2f, released from the list(1) eap: Peer sent packet with method EAP TTLS (21)(1) eap: Calling submodule eap_ttls to process data(1) eap_ttls: Authenticate(1) eap_ttls: Continuing EAP-TLS(1) eap_ttls: Peer indicated complete TLS record size will be 133 bytes(1) eap_ttls: Got complete TLS record (133 bytes)(1) eap_ttls: [eaptls verify] = length included(1) eap_ttls: (other): before/accept initialization(1) eap_ttls: TLS_accept: before/accept initialization(1) eap_ttls: <<< TLS 1.0 Handshake [length 0080], ClientHello (1) eap_ttls: TLS_accept: SSLv3 read client hello A(1) eap_ttls: >>> TLS 1.0 Handshake [length 0059], ServerHello (1) eap_ttls: TLS_accept: SSLv3 write server hello A(1) eap_ttls: >>> TLS 1.0 Handshake [length 08d3], Certificate (1) eap_ttls: TLS_accept: SSLv3 write certificate A(1) eap_ttls: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (1) eap_ttls: TLS_accept: SSLv3 write key exchange A(1) eap_ttls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (1) eap_ttls: TLS_accept: SSLv3 write server done A(1) eap_ttls: TLS_accept: SSLv3 flush data(1) eap_ttls: TLS_accept: Need to read more data: SSLv3 read client certificate A(1) eap_ttls: TLS_accept: Need to read more data: SSLv3 read client certificate A(1) eap_ttls: In SSL Handshake Phase(1) eap_ttls: In SSL Accept mode(1) eap_ttls: [eaptls process] = handled(1) eap: Sending EAP Request (code 1) ID 3 length 1004(1) eap: EAP session adding &reply:State = 0x8aa7dbf48ba4ce2f(1) [eap] = handled(1) } # authenticate = handled(1) Using Post-Auth-Type Challenge(1) Post-Auth-Type sub-section not found. Ignoring.(1) # Executing group from file /etc/freeradius/sites-enabled/default(1) Sent Access-Challenge Id 68 from <ip>:1812 to <ip>:59898 length 0(1) EAP-Message = 0x010303ec15c000000a8f16030100590200005503011f5637fc9907abb382f150b602d77e2cac29c21821752b2155fc5cb32e35fbdb20fb97b440265d98e05f08c2cb560622317f8389869d8117036e6e371dcfbf81d5c01400000dff01000100000b00040300010216030108d30b0008cf0008cc0003de(1) Message-Authenticator = 0x00000000000000000000000000000000(1) State = 0x8aa7dbf48ba4ce2f8993e0490c51278d(1) Finished requestWaking up in 4.9 seconds.(2) Received Access-Request Id 69 from <ip>:59898 to <ip>:1812 length 209(2) User-Name = "hans.hering"(2) NAS-IP-Address = <ip>(2) NAS-Port = 0(2) NAS-Identifier = "<ip>"(2) NAS-Port-Type = Wireless-802.11(2) Calling-Station-Id = "4400100e904c"(2) Called-Station-Id = "186472cd167a"(2) Service-Type = Login-User(2) Framed-MTU = 1100(2) EAP-Message = 0x020300061500(2) State = 0x8aa7dbf48ba4ce2f8993e0490c51278d(2) Aruba-Essid-Name = "<ssid>"(2) Aruba-Location-Id = "<apname>"(2) Aruba-AP-Group = "<apname>"(2) Message-Authenticator = 0x4ae0edce92e6af687df75c1ec8123562(2) session-state: No cached attributes(2) # Executing section authorize from file /etc/freeradius/sites-enabled/default(2) authorize {(2) policy filter_username {(2) if (!&User-Name) {(2) if (!&User-Name) -> FALSE(2) if (&User-Name =~ / /) {(2) if (&User-Name =~ / /) -> FALSE(2) if (&User-Name =~ /@.*@/ ) {(2) if (&User-Name =~ /@.*@/ ) -> FALSE(2) if (&User-Name =~ /\.\./ ) {(2) if (&User-Name =~ /\.\./ ) -> FALSE(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(2) if (&User-Name =~ /\.$/) {(2) if (&User-Name =~ /\.$/) -> FALSE(2) if (&User-Name =~ /(a)\./) {(2) if (&User-Name =~ /(a)\./) -> FALSE(2) } # policy filter_username = notfound(2) [preprocess] = ok(2) [chap] = noop(2) [mschap] = noop(2) [digest] = noop(2) suffix: Checking for suffix after "@"(2) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(2) suffix: No such realm "NULL"(2) [suffix] = noop(2) eap: Peer sent EAP Response (code 2) ID 3 length 6(2) eap: Continuing tunnel setup(2) [eap] = ok(2) } # authorize = ok(2) Found Auth-Type = EAP(2) # Executing group from file /etc/freeradius/sites-enabled/default(2) authenticate {(2) eap: Expiring EAP session with state 0x8aa7dbf48ba4ce2f(2) eap: Finished EAP session with state 0x8aa7dbf48ba4ce2f(2) eap: Previous EAP request found for state 0x8aa7dbf48ba4ce2f, released from the list(2) eap: Peer sent packet with method EAP TTLS (21)(2) eap: Calling submodule eap_ttls to process data(2) eap_ttls: Authenticate(2) eap_ttls: Continuing EAP-TLS(2) eap_ttls: Peer ACKed our handshake fragment(2) eap_ttls: [eaptls verify] = request(2) eap_ttls: [eaptls process] = handled(2) eap: Sending EAP Request (code 1) ID 4 length 1004(2) eap: EAP session adding &reply:State = 0x8aa7dbf488a3ce2f(2) [eap] = handled(2) } # authenticate = handled(2) Using Post-Auth-Type Challenge(2) Post-Auth-Type sub-section not found. Ignoring.(2) # Executing group from file /etc/freeradius/sites-enabled/default(2) Sent Access-Challenge Id 69 from <ip>:1812 to <ip>:59898 length 0(2) EAP-Message = 0x010403ec15c000000a8fdd874ace35d935909eb41f076af54637807355b0c44328651be631d0fac4d2c6e81f9c4b8c711b5bb5dc1da68ec9f28dd8ebb18ee0bb6f63cff5d2b1c22fe1408af1ce00ae298e0c0151ac505915f8aaec5535d093ec63ad9ddc05e9ae8b8ba4442133a51318f8c3b90004e830(2) Message-Authenticator = 0x00000000000000000000000000000000(2) State = 0x8aa7dbf488a3ce2f8993e0490c51278d(2) Finished requestWaking up in 4.9 seconds.(3) Received Access-Request Id 70 from <ip>:59898 to <ip>:1812 length 209(3) User-Name = "hans.hering"(3) NAS-IP-Address = <ip>(3) NAS-Port = 0(3) NAS-Identifier = "<ip>"(3) NAS-Port-Type = Wireless-802.11(3) Calling-Station-Id = "4400100e904c"(3) Called-Station-Id = "186472cd167a"(3) Service-Type = Login-User(3) Framed-MTU = 1100(3) EAP-Message = 0x020400061500(3) State = 0x8aa7dbf488a3ce2f8993e0490c51278d(3) Aruba-Essid-Name = "<ssid>"(3) Aruba-Location-Id = "<apname>"(3) Aruba-AP-Group = "<apname>"(3) Message-Authenticator = 0xac0e164f6b96849c48af9d3908b63255(3) session-state: No cached attributes(3) # Executing section authorize from file /etc/freeradius/sites-enabled/default(3) authorize {(3) policy filter_username {(3) if (!&User-Name) {(3) if (!&User-Name) -> FALSE(3) if (&User-Name =~ / /) {(3) if (&User-Name =~ / /) -> FALSE(3) if (&User-Name =~ /@.*@/ ) {(3) if (&User-Name =~ /@.*@/ ) -> FALSE(3) if (&User-Name =~ /\.\./ ) {(3) if (&User-Name =~ /\.\./ ) -> FALSE(3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(3) if (&User-Name =~ /\.$/) {(3) if (&User-Name =~ /\.$/) -> FALSE(3) if (&User-Name =~ /(a)\./) {(3) if (&User-Name =~ /(a)\./) -> FALSE(3) } # policy filter_username = notfound(3) [preprocess] = ok(3) [chap] = noop(3) [mschap] = noop(3) [digest] = noop(3) suffix: Checking for suffix after "@"(3) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(3) suffix: No such realm "NULL"(3) [suffix] = noop(3) eap: Peer sent EAP Response (code 2) ID 4 length 6(3) eap: Continuing tunnel setup(3) [eap] = ok(3) } # authorize = ok(3) Found Auth-Type = EAP(3) # Executing group from file /etc/freeradius/sites-enabled/default(3) authenticate {(3) eap: Expiring EAP session with state 0x8aa7dbf488a3ce2f(3) eap: Finished EAP session with state 0x8aa7dbf488a3ce2f(3) eap: Previous EAP request found for state 0x8aa7dbf488a3ce2f, released from the list(3) eap: Peer sent packet with method EAP TTLS (21)(3) eap: Calling submodule eap_ttls to process data(3) eap_ttls: Authenticate(3) eap_ttls: Continuing EAP-TLS(3) eap_ttls: Peer ACKed our handshake fragment(3) eap_ttls: [eaptls verify] = request(3) eap_ttls: [eaptls process] = handled(3) eap: Sending EAP Request (code 1) ID 5 length 725(3) eap: EAP session adding &reply:State = 0x8aa7dbf489a2ce2f(3) [eap] = handled(3) } # authenticate = handled(3) Using Post-Auth-Type Challenge(3) Post-Auth-Type sub-section not found. Ignoring.(3) # Executing group from file /etc/freeradius/sites-enabled/default(3) Sent Access-Challenge Id 70 from <ip>:1812 to <ip>:59898 length 0(3) EAP-Message = 0x010502d5158000000a8f20417574686f72697479820900da1ed77d3b2c8ff1300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b0500(3) Message-Authenticator = 0x00000000000000000000000000000000(3) State = 0x8aa7dbf489a2ce2f8993e0490c51278d(3) Finished requestWaking up in 4.8 seconds.(4) Received Access-Request Id 71 from <ip>:59898 to <ip>:1812 length 347(4) User-Name = "hans.hering"(4) NAS-IP-Address = <ip>(4) NAS-Port = 0(4) NAS-Identifier = "<ip>"(4) NAS-Port-Type = Wireless-802.11(4) Calling-Station-Id = "4400100e904c"(4) Called-Station-Id = "186472cd167a"(4) Service-Type = Login-User(4) Framed-MTU = 1100(4) EAP-Message = 0x0205009015800000008616030100461000004241043d059fc34d75c809e28246cbef26b5353671cc04f909f887bcda2bfb46e9c5c3c7c5739285ff557b4dc0124534d952022cf360cbb002e29b8e6010ef9eeff15b1403010001011603010030954522307e8512ca2a646e52885316cf319a305831139d(4) State = 0x8aa7dbf489a2ce2f8993e0490c51278d(4) Aruba-Essid-Name = "<ssid>"(4) Aruba-Location-Id = "<apname>"(4) Aruba-AP-Group = "<apname>"(4) Message-Authenticator = 0xefbaccdfebd1d3f906dffd267d63b3d4(4) session-state: No cached attributes(4) # Executing section authorize from file /etc/freeradius/sites-enabled/default(4) authorize {(4) policy filter_username {(4) if (!&User-Name) {(4) if (!&User-Name) -> FALSE(4) if (&User-Name =~ / /) {(4) if (&User-Name =~ / /) -> FALSE(4) if (&User-Name =~ /@.*@/ ) {(4) if (&User-Name =~ /@.*@/ ) -> FALSE(4) if (&User-Name =~ /\.\./ ) {(4) if (&User-Name =~ /\.\./ ) -> FALSE(4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(4) if (&User-Name =~ /\.$/) {(4) if (&User-Name =~ /\.$/) -> FALSE(4) if (&User-Name =~ /(a)\./) {(4) if (&User-Name =~ /(a)\./) -> FALSE(4) } # policy filter_username = notfound(4) [preprocess] = ok(4) [chap] = noop(4) [mschap] = noop(4) [digest] = noop(4) suffix: Checking for suffix after "@"(4) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(4) suffix: No such realm "NULL"(4) [suffix] = noop(4) eap: Peer sent EAP Response (code 2) ID 5 length 144(4) eap: Continuing tunnel setup(4) [eap] = ok(4) } # authorize = ok(4) Found Auth-Type = EAP(4) # Executing group from file /etc/freeradius/sites-enabled/default(4) authenticate {(4) eap: Expiring EAP session with state 0x8aa7dbf489a2ce2f(4) eap: Finished EAP session with state 0x8aa7dbf489a2ce2f(4) eap: Previous EAP request found for state 0x8aa7dbf489a2ce2f, released from the list(4) eap: Peer sent packet with method EAP TTLS (21)(4) eap: Calling submodule eap_ttls to process data(4) eap_ttls: Authenticate(4) eap_ttls: Continuing EAP-TLS(4) eap_ttls: Peer indicated complete TLS record size will be 134 bytes(4) eap_ttls: Got complete TLS record (134 bytes)(4) eap_ttls: [eaptls verify] = length included(4) eap_ttls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (4) eap_ttls: TLS_accept: SSLv3 read client key exchange A(4) eap_ttls: <<< TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_ttls: <<< TLS 1.0 Handshake [length 0010], Finished (4) eap_ttls: TLS_accept: SSLv3 read finished A(4) eap_ttls: >>> TLS 1.0 ChangeCipherSpec [length 0001] (4) eap_ttls: TLS_accept: SSLv3 write change cipher spec A(4) eap_ttls: >>> TLS 1.0 Handshake [length 0010], Finished (4) eap_ttls: TLS_accept: SSLv3 write finished A(4) eap_ttls: TLS_accept: SSLv3 flush data(4) eap_ttls: (other): SSL negotiation finished successfully(4) eap_ttls: SSL Connection Established(4) eap_ttls: [eaptls process] = handled(4) eap: Sending EAP Request (code 1) ID 6 length 69(4) eap: EAP session adding &reply:State = 0x8aa7dbf48ea1ce2f(4) [eap] = handled(4) } # authenticate = handled(4) Using Post-Auth-Type Challenge(4) Post-Auth-Type sub-section not found. Ignoring.(4) # Executing group from file /etc/freeradius/sites-enabled/default(4) Sent Access-Challenge Id 71 from <ip>:1812 to <ip>:59898 length 0(4) EAP-Message = 0x0106004515800000003b14030100010116030100303df00af3f5b715f6f8a2e59efbbcd7cf2e70d4d3391ec7706b0e96ace65e108dab33d36f365c0040c5b627503d501828(4) Message-Authenticator = 0x00000000000000000000000000000000(4) State = 0x8aa7dbf48ea1ce2f8993e0490c51278d(4) Finished requestWaking up in 4.8 seconds.(5) Received Access-Request Id 72 from <ip>:59898 to <ip>:1812 length 266(5) User-Name = "hans.hering"(5) NAS-IP-Address = <ip>(5) NAS-Port = 0(5) NAS-Identifier = "<ip>"(5) NAS-Port-Type = Wireless-802.11(5) Calling-Station-Id = "4400100e904c"(5) Called-Station-Id = "186472cd167a"(5) Service-Type = Login-User(5) Framed-MTU = 1100(5) EAP-Message = 0x0206003f1580000000351703010030c39c440ecadb79d70661f5c2457440ae369e59eb3b10505f97b78b5d96cc87fb563fb5cb5edc6057e18560f1b7fafcfd(5) State = 0x8aa7dbf48ea1ce2f8993e0490c51278d(5) Aruba-Essid-Name = "<ssid>"(5) Aruba-Location-Id = "<apname>"(5) Aruba-AP-Group = "<apname>"(5) Message-Authenticator = 0x63c04f4574a68ea285f031dc5bda5089(5) session-state: No cached attributes(5) # Executing section authorize from file /etc/freeradius/sites-enabled/default(5) authorize {(5) policy filter_username {(5) if (!&User-Name) {(5) if (!&User-Name) -> FALSE(5) if (&User-Name =~ / /) {(5) if (&User-Name =~ / /) -> FALSE(5) if (&User-Name =~ /@.*@/ ) {(5) if (&User-Name =~ /@.*@/ ) -> FALSE(5) if (&User-Name =~ /\.\./ ) {(5) if (&User-Name =~ /\.\./ ) -> FALSE(5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(5) if (&User-Name =~ /\.$/) {(5) if (&User-Name =~ /\.$/) -> FALSE(5) if (&User-Name =~ /(a)\./) {(5) if (&User-Name =~ /(a)\./) -> FALSE(5) } # policy filter_username = notfound(5) [preprocess] = ok(5) [chap] = noop(5) [mschap] = noop(5) [digest] = noop(5) suffix: Checking for suffix after "@"(5) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(5) suffix: No such realm "NULL"(5) [suffix] = noop(5) eap: Peer sent EAP Response (code 2) ID 6 length 63(5) eap: Continuing tunnel setup(5) [eap] = ok(5) } # authorize = ok(5) Found Auth-Type = EAP(5) # Executing group from file /etc/freeradius/sites-enabled/default(5) authenticate {(5) eap: Expiring EAP session with state 0x8aa7dbf48ea1ce2f(5) eap: Finished EAP session with state 0x8aa7dbf48ea1ce2f(5) eap: Previous EAP request found for state 0x8aa7dbf48ea1ce2f, released from the list(5) eap: Peer sent packet with method EAP TTLS (21)(5) eap: Calling submodule eap_ttls to process data(5) eap_ttls: Authenticate(5) eap_ttls: Continuing EAP-TLS(5) eap_ttls: Peer indicated complete TLS record size will be 53 bytes(5) eap_ttls: Got complete TLS record (53 bytes)(5) eap_ttls: [eaptls verify] = length included(5) eap_ttls: [eaptls process] = ok(5) eap_ttls: Session established. Proceeding to decode tunneled attributes(5) eap_ttls: Got tunneled request(5) eap_ttls: EAP-Message = 0x020000100168616e732e686572696e67(5) eap_ttls: Got tunneled identity of hans.hering(5) eap_ttls: Setting default EAP type for tunneled EAP session(5) eap_ttls: Sending tunneled request(5) Virtual server inner-tunnel received request(5) EAP-Message = 0x020000100168616e732e686572696e67(5) User-Name = "hans.hering"(5) server inner-tunnel {(5) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel(5) authorize {(5) [chap] = noop(5) [mschap] = noop(5) suffix: Checking for suffix after "@"(5) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(5) suffix: No such realm "NULL"(5) [suffix] = noop(5) update control {(5) &Proxy-To-Realm := LOCAL(5) } # update control = noop(5) eap: Peer sent EAP Response (code 2) ID 0 length 16(5) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize(5) [eap] = ok(5) } # authorize = ok(5) Found Auth-Type = EAP(5) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel(5) authenticate {(5) eap: Peer sent packet with method EAP Identity (1)(5) eap: Calling submodule eap_md5 to process data(5) eap_md5: Issuing MD5 Challenge(5) eap: Sending EAP Request (code 1) ID 1 length 22(5) eap: EAP session adding &reply:State = 0x47026ba347036f9f(5) [eap] = handled(5) } # authenticate = handled(5) } # server inner-tunnel(5) Virtual server sending reply(5) EAP-Message = 0x01010016041081dfab5920bbad29c708489ae35dc75f(5) Message-Authenticator = 0x00000000000000000000000000000000(5) State = 0x47026ba347036f9fb85e0642fabc31d4(5) eap_ttls: Got tunneled Access-Challenge(5) eap: Sending EAP Request (code 1) ID 7 length 79(5) eap: EAP session adding &reply:State = 0x8aa7dbf48fa0ce2f(5) [eap] = handled(5) } # authenticate = handled(5) Using Post-Auth-Type Challenge(5) Post-Auth-Type sub-section not found. Ignoring.(5) # Executing group from file /etc/freeradius/sites-enabled/default(5) Sent Access-Challenge Id 72 from <ip>:1812 to <ip>:59898 length 0(5) EAP-Message = 0x0107004f1580000000451703010040c1a48501dcf5e2b5d4a72196219fa0f279498885465d123a4c95d6490ec55d1496b6503b8410ce0b7c568fc6e46440e90e4730eb8883c0e71a858916a1a66354(5) Message-Authenticator = 0x00000000000000000000000000000000(5) State = 0x8aa7dbf48fa0ce2f8993e0490c51278d(5) Finished requestWaking up in 4.7 seconds.(6) Received Access-Request Id 73 from <ip>:59898 to <ip>:1812 length 298(6) User-Name = "hans.hering"(6) NAS-IP-Address = <ip>(6) NAS-Port = 0(6) NAS-Identifier = "<ip>"(6) NAS-Port-Type = Wireless-802.11(6) Calling-Station-Id = "4400100e904c"(6) Called-Station-Id = "186472cd167a"(6) Service-Type = Login-User(6) Framed-MTU = 1100(6) EAP-Message = 0x0207005f1580000000551703010050e5017cf29ca351ffb06cf4226e56c7883502556146fae26cdf965b030636de8a2610906ac579874eddfd9f70e78328af1248d230f5341da8e86db06d17154a8da3f6531540e5a2d35d4bc51e942c9beb(6) State = 0x8aa7dbf48fa0ce2f8993e0490c51278d(6) Aruba-Essid-Name = "<ssid>"(6) Aruba-Location-Id = "<apname>"(6) Aruba-AP-Group = "<apname>"(6) Message-Authenticator = 0x68cac7c8d75f2ff01b8a0e0ab93beeb6(6) session-state: No cached attributes(6) # Executing section authorize from file /etc/freeradius/sites-enabled/default(6) authorize {(6) policy filter_username {(6) if (!&User-Name) {(6) if (!&User-Name) -> FALSE(6) if (&User-Name =~ / /) {(6) if (&User-Name =~ / /) -> FALSE(6) if (&User-Name =~ /@.*@/ ) {(6) if (&User-Name =~ /@.*@/ ) -> FALSE(6) if (&User-Name =~ /\.\./ ) {(6) if (&User-Name =~ /\.\./ ) -> FALSE(6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) {(6) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE(6) if (&User-Name =~ /\.$/) {(6) if (&User-Name =~ /\.$/) -> FALSE(6) if (&User-Name =~ /(a)\./) {(6) if (&User-Name =~ /(a)\./) -> FALSE(6) } # policy filter_username = notfound(6) [preprocess] = ok(6) [chap] = noop(6) [mschap] = noop(6) [digest] = noop(6) suffix: Checking for suffix after "@"(6) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(6) suffix: No such realm "NULL"(6) [suffix] = noop(6) eap: Peer sent EAP Response (code 2) ID 7 length 95(6) eap: Continuing tunnel setup(6) [eap] = ok(6) } # authorize = ok(6) Found Auth-Type = EAP(6) # Executing group from file /etc/freeradius/sites-enabled/default(6) authenticate {(6) eap: Expiring EAP session with state 0x47026ba347036f9f(6) eap: Finished EAP session with state 0x8aa7dbf48fa0ce2f(6) eap: Previous EAP request found for state 0x8aa7dbf48fa0ce2f, released from the list(6) eap: Peer sent packet with method EAP TTLS (21)(6) eap: Calling submodule eap_ttls to process data(6) eap_ttls: Authenticate(6) eap_ttls: Continuing EAP-TLS(6) eap_ttls: Peer indicated complete TLS record size will be 85 bytes(6) eap_ttls: Got complete TLS record (85 bytes)(6) eap_ttls: [eaptls verify] = length included(6) eap_ttls: [eaptls process] = ok(6) eap_ttls: Session established. Proceeding to decode tunneled attributes(6) eap_ttls: Got tunneled request(6) eap_ttls: EAP-Message = 0x020100210410a1caf80086694cc7efcdb9214433cb1f68616e732e686572696e67(6) eap_ttls: Sending tunneled request(6) Virtual server inner-tunnel received request(6) EAP-Message = 0x020100210410a1caf80086694cc7efcdb9214433cb1f68616e732e686572696e67(6) User-Name = "hans.hering"(6) State = 0x47026ba347036f9fb85e0642fabc31d4(6) server inner-tunnel {(6) session-state: No cached attributes(6) # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel(6) authorize {(6) [chap] = noop(6) [mschap] = noop(6) suffix: Checking for suffix after "@"(6) suffix: No '@' in User-Name = "hans.hering", looking up realm NULL(6) suffix: No such realm "NULL"(6) [suffix] = noop(6) update control {(6) &Proxy-To-Realm := LOCAL(6) } # update control = noop(6) eap: Peer sent EAP Response (code 2) ID 1 length 33(6) eap: No EAP Start, assuming it's an on-going EAP conversation(6) [eap] = updated(6) [files] = nooprlm_ldap (ldap): Reserved connection (0)(6) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})(6) ldap: --> (uid=hans.hering)(6) ldap: Performing search in "dc=xxx,dc=xxx" with filter "(uid=hans.hering)", scope "sub"(6) ldap: Waiting for search result...(6) ldap: User object found at DN "uid=hans.hering,ou=xxx,dc=xxx,dc=xxx"(6) ldap: Processing user attributes(6) ldap: control:Password-With-Header += '{SSHA}IiE+U9IKv4ttaILiThSWbftqrdBOSERS0nuCKQ=='rlm_ldap (ldap): Released connection (0)rlm_ldap (ldap): Need 5 more connections to reach 10 sparesrlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots usedrlm_ldap (ldap): Connecting to ldaps://<url>:636rlm_ldap (ldap): Waiting for bind result...rlm_ldap (ldap): Bind successful(6) [ldap] = updated(6) [expiration] = noop(6) [logintime] = noop(6) pap: Converted: Password-With-Header -> SSHA1-Password(6) pap: Removing &control:Password-With-Header(6) pap: Normalizing SSHA1-Password from base64 encoding, 40 bytes -> 28 bytes(6) pap: WARNING: Auth-Type already set. Not setting to PAP(6) [pap] = noop(6) } # authorize = updated(6) Found Auth-Type = EAP(6) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel(6) authenticate {(6) eap: Expiring EAP session with state 0x47026ba347036f9f(6) eap: Finished EAP session with state 0x47026ba347036f9f(6) eap: Previous EAP request found for state 0x47026ba347036f9f, released from the list(6) eap: Peer sent packet with method EAP MD5 (4)(6) eap: Calling submodule eap_md5 to process data(6) eap_md5: Cleartext-Password is required for EAP-MD5 authentication(6) eap: ERROR: Failed continuing EAP MD5 (4) session. EAP sub-module failed(6) eap: Sending EAP Failure (code 4) ID 1 length 4(6) eap: Failed in EAP select(6) [eap] = invalid(6) } # authenticate = invalid(6) Failed to authenticate the user(6) Using Post-Auth-Type Reject(6) # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel(6) Post-Auth-Type REJECT {(6) attr_filter.access_reject: EXPAND %{User-Name}(6) attr_filter.access_reject: --> hans.hering(6) attr_filter.access_reject: Matched entry DEFAULT at line 11(6) [attr_filter.access_reject] = updated(6) update outer.session-state {(6) &Module-Failure-Message := &request:Module-Failure-Message -> 'eap: Failed continuing EAP MD5 (4) session. EAP sub-module failed'(6) } # update outer.session-state = noop(6) } # Post-Auth-Type REJECT = updated(6) } # server inner-tunnel(6) Virtual server sending reply(6) EAP-Message = 0x04010004(6) Message-Authenticator = 0x00000000000000000000000000000000(6) eap_ttls: Got tunneled Access-Reject(6) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed(6) eap: Sending EAP Failure (code 4) ID 7 length 4(6) eap: Failed in EAP select(6) [eap] = invalid(6) } # authenticate = invalid(6) Failed to authenticate the user(6) Using Post-Auth-Type Reject(6) # Executing group from file /etc/freeradius/sites-enabled/default(6) Post-Auth-Type REJECT {(6) attr_filter.access_reject: EXPAND %{User-Name}(6) attr_filter.access_reject: --> hans.hering(6) attr_filter.access_reject: Matched entry DEFAULT at line 11(6) [attr_filter.access_reject] = updated(6) [eap] = noop(6) policy remove_reply_message_if_eap {(6) if (&reply:EAP-Message && &reply:Reply-Message) {(6) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE(6) else {(6) [noop] = noop(6) } # else = noop(6) } # policy remove_reply_message_if_eap = noop(6) } # Post-Auth-Type REJECT = updated(6) Delaying response for 1.000000 secondsWaking up in 0.2 seconds.Waking up in 0.7 seconds.(6) Sending delayed response(6) Sent Access-Reject Id 73 from <ip>:1812 to <ip>:59898 length 44(6) EAP-Message = 0x04070004(6) Message-Authenticator = 0x00000000000000000000000000000000Waking up in 3.6 seconds.(0) Cleaning up request packet ID 67 with timestamp +24(1) Cleaning up request packet ID 68 with timestamp +24(2) Cleaning up request packet ID 69 with timestamp +24(3) Cleaning up request packet ID 70 with timestamp +24(4) Cleaning up request packet ID 71 with timestamp +24(5) Cleaning up request packet ID 72 with timestamp +25(6) Cleaning up request packet ID 73 with timestamp +25Ready to process requests

4 5

FreeRadius - Version porting
by srithar jeevadurai 23 Nov '15

23 Nov '15

Dear Friends, We have customized module (lib) written for freeRadius version freeradius-server-2.2.0. The same code can be reused for latest version of free Radius (say 3.0.9). Provided all basic message structures are remain same (in both versions of free Radius). One basic questions, We were having child hung issue at free Radius due to slow response from external module. once free Radius server (version 2.2.0) goes to child hung state then we have to restart the server (though the external module resumed after 1-2 minutes). Is there any throttling done at Free Radius server (latest version 3.0.9)? so that when external module response is slow, Radius server would not fill the queue with incoming messages (from NAS). i.e. taking messages into queue and run into child hung issue. It uses throttling to have control over pending request queue when there is a slowness in the external system and queue size increases (since NAS is flooding the radius server). Thanks a lot for your response in advance. -- Regards, Srithar Durairaj Alternate Mail I.D: srijeevadurai1(a)yahoo.co.in Mobile: +919886251852

8 33

3GPP-Location-Info
by Marc Beaumont 23 Nov '15

23 Nov '15

I've got accouinting data with the following attribute: 3GPP-Location-Info = 0x0032f4030921b8e8 Does anyone know how to decode this or what data is contained in this? Marc ______________________________________________________________________ Scanned by MailDefender Plus, powered by Symantec Email Security.cloud http://www.intycascade.com/products/symantec/ ______________________________________________________________________

2 2

FreeRadius 3.0.4
by Oscar Jofre 22 Nov '15

22 Nov '15

Hi, I'm using FreeRADIUS Version 3.0.4, for host x86_64-redhat-linux-gnu on Centos_7 I'm using server with 4GB RAM, 4xCPU, 50GB Disk and 100% FreeRadius dedicated The database MariaDB 10.x is running on a different server with more RAM and CPU. I've changed radiusd.conf with: max_requests = 2500000 max_servers = 256 max_spare_servers = 400 I have 10.000 test users connectes with PPoE with 5 minutes timeout and interim every 1 minute. I have this Errors on log: 1) Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'e35620bfd04391bc9c6f5afe3628449d' for key 'acctuniqueid'' Fri Nov 20 00:10:14 2015 : Error: rlm_sql (sql): Duplicate entry 'ab0c9cb893d6af4de3388749d7004c2b' for key 'acctuniqueid' Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: Cannot store result Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry 'ab0c9cb893d6af4de3388749d7004c2b' for key 'acctuniqueid'' Fri Nov 20 00:10:14 2015 : Error: rlm_sql (sql): Duplicate entry '8902d57334a046e00c6231ad91aad63e' for key 'acctuniqueid' Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: Cannot store result Fri Nov 20 00:10:14 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '8902d57334a046e00c6231ad91aad63e' for key 'acctuniqueid'' Fri Nov 20 00:10:23 2015 : Error: rlm_sql (sql): Duplicate entry '4b5b0717c9b3c5f2100ff001efa9f6b3' for key 'acctuniqueid' Fri Nov 20 00:10:23 2015 : Error: rlm_sql_mysql: Cannot store result Fri Nov 20 00:10:23 2015 : Error: rlm_sql_mysql: MySQL error 'Duplicate entry '4b5b0717c9b3c5f2100ff001efa9f6b3' for key 'acctuniqueid'' 2) Fri Nov 20 00:16:25 2015 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Fri Nov 20 00:16:25 2015 : Warning: rlm_sql (sql): 21 of 21 connections in use. You probably need to increase "spare" Fri Nov 20 00:16:25 2015 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress Fri Nov 20 00:16:25 2015 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Fri Nov 20 00:16:25 2015 : Info: rlm_sql (sql): Opening additional connection (543) Fri Nov 20 00:16:25 2015 : Warning: rlm_sql (sql): 22 of 22 connections in use. You probably need to increase "spare" Fri Nov 20 00:16:25 2015 : Error: rlm_sql (sql): Cannot open new connection, connection spawning already in progress 1) As Alan Dekok told this duplicate key error is because FreeRadius 3.0.4 . but I'm not able to compile and install newer version because is not on the Centos_7 repository .. Is there any PATCH or file I can modify to fix this error ? 2) I modify max_spare_server to 400 and still you probably need to increase spare . wich value do you think could be ok ? Do I need to modify any other value ? Thanks a lot !

3 5

use_tunneled_reply = yes didn't help.
by Frank Rizzo 22 Nov '15

22 Nov '15

Hello list, I'm using FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Aug 26 2015 at 14:47:03 on Ubuntu 14.04 LTS. I'm using hostapd v2.1 as the AP front end. I'm getting this: Nov 20 16:43:57 test-desktop hostapd: wlan0: STA 08:d4:2b:xx:xx:xx IEEE 802.1X: authentication server did not include required VLAN ID in Access-Accept Nov 20 16:43:57 test-desktop hostapd: wlan0: STA 08:d4:2b:xx:xx:xx IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) My eap.conf looks like this: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no use_tunneled_reply = yes md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = password private_key_file = /etc/certs/wpa2_priv.pem certificate_file = /etc/certs/wpa2_cert.pem CA_file = /etc/certs/wpa2_ca_cert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } peap { default_eap_type = mschapv2 use_tunneled_reply = yes } mschapv2 { } } My project was due to ship on TUESDAY. So, I'm in a bit of a panic. Can anyone help? THANK YOU! -Frank

2 7

Error setting up Freeradius
by Roger Kidd 22 Nov '15

22 Nov '15

I'm trying to get free radius to work with my ASUS RT-AC68U router. I get the below in my debug output. Any help would be much appreciated. FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Oct 15 2015 at 11:03:19 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = yes secret = "Shanna12" nastype = "other" } client 192.168.1.1/24 { require_message_authenticator = no secret = "Shanna12" shortname = "private-network-1" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /etc/freeradius/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "pa55word" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/freeradius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.1.134 port = 1812 } listen { type = "acct" ipaddr = 192.168.1.134 port = 1813 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 53488 Listening on authentication address 192.168.1.134 port 1812 Listening on accounting address 192.168.1.134 port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address 192.168.1.134 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=123 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000a01526f676572 Message-Authenticator = 0xacfd48611b5bf251509d7c87051f4ea6 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> Roger [sql] sql_set_user escaped user --> 'Roger' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Roger' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Roger' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'Roger' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x010100160410eec27c2d5ae0e5194e6ffad14031c95f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a32c7751d29f4e02a70d44a6 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=139 Cleaning up request 0 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a32c7751d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020100080319152b Message-Authenticator = 0x83f5a682e7a110e06e3c3907c891632a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> Roger [sql] sql_set_user escaped user --> 'Roger' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'Roger' ORDER BY id WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'Roger' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'Roger' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a22f6a51d29f4e02a70d44a6 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=274 Cleaning up request 1 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a22f6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202008f19800000008516030100800100007c0301564d2bfa7661f3983bdffd87d0ed07af3bf587102c4e8cd89799bcd8e1b935cb00003400ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000ac007c011000500040100001f000a00080006001700180019000b0002010000050005010000000000120000 Message-Authenticator = 0xe34fb29a3e55a09c5d24209a8a41853c # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 143 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 133 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 Handshake [length 0080], ClientHello [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 0039], ServerHello [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 02ca], Certificate [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] TLS_accept: Need to read more data: unknown state In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0103040019c00000046616030100390200003503011bac8077204837b3c17a315a5c6fcc7f6f820786d20aaca66e3caf6ca9aead1900c01400000dff01000100000b00040300010216030102ca0b0002c60002c30002c0308202bc308201a4a003020102020900ab18ec010a534348300d06092a864886f70d01010b050030163114301206035504030c0b726f6765723739302d5043301e170d3135313131313139323131325a170d3235313130383139323131325a30163114301206035504030c0b726f6765723739302d504330820122300d06092a864886f70d01010105000382010f003082010a0282010100de10c6b14996036d9805cfb545f7 EAP-Message = 0x2b0ea4bc389a025e8d8329809ecdb037c293223c02fb7cf535025ea1adff3a1bd27f51c7d33efc42aa07ae76ff8a4e754f3ce243999d81378418b67c9b9fd7db151937b3d2da687e813d0080ae3b1ae10854ba5eb7eb6d699b0b55e81f85ebf52a7b13ae4be74f99a67af5a540ed5a98d7b4bfaa24369f9aaefbf32b53069fab030133ce868f7409c0d37671c8f8a03111ad79becc9f59f70278ee6ef642d5e2140d2898959801356cdb9efec93a962fdf8438d7d91510c5cdbce8f0d45547b45776676c7ed5f10a2eeb6bc8b16b8b0840d082b7aecc74a82e09ebd17cad1dae87c193d8efe2105aa93ac0aaa98d052e356f0203010001a30d300b3009 EAP-Message = 0x0603551d1304023000300d06092a864886f70d01010b050003820101009e1c02d3ee395a20352bed2ecc9d1f14b61a8efa4b34f4470df6808f61875f0e205d4d962aaa170f85b757dfa205f84927d8f31d235d116578e94ce670c2517bfeb6e6809873fb8865ac2a06222efb6ef716246cde5d3ba102265412fdfcc3c1a525501de261642456b81809042df83dcbcc4d67db63b8b7a99643f8f3bbbe3491dc9f902f59f1635218b42f1e85f1bcc4865b26a57f7a9fffe00dc8e6b17091b9f9116c49404a0c5c3631c8070b7945625f65cb87fac77aded7795fcb7e8b4ae0f32e8edebda397665c5d2c7cca68b93a3dee2c28c1ae1881429f2c337a243d EAP-Message = 0xc6088f13fc380c7d27ddcfa896981e022fe66a7c7b462cfadbe13f5dfe5ecd4e160301014b0c00014703001741046573a309fbd2ffa1ad28c14f69ad09818d25908dd621cfe2251e4bd7eacbcdc9ed13f6ce8133a332eeacd7ee980343890ce6b707f2c03dbd046ca4f2f1312c6801005d799cf291313738b0cb27c592bcbeb766cd18cd01fa2dbd0423f844592f8ec5f092e2f51b9bc03cedb8bcd7362938e46abe505e4dcf1877f4e467cf1bba5437e6311d8815a1bdbaca9e6da9a1e0e507e8621054d9f93dbdb8e7a8341c164db28ac0128bfbecd2e35a3580143f1e34a35ace74074834b7640c92e5045bfd246454d7fa6358ac65455ac8f68351 EAP-Message = 0xb00f79ab95910999a2865fc1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a12e6a51d29f4e02a70d44a6 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=137 Cleaning up request 2 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a12e6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0x0250778ac6d982d856d34ae7373a717d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x010400761900137384072d800273752fa164043d3831297bc23b04310a9fef3833c1983a337b84343c113cae0a917f5541502062b7e4c8220b04dcce7452afc151e8f5c81842e91be3bf3b5eb571aba01c6c016ce08bd390ea8c1d269845906b09d08c8421a2242aaaa6f5f43416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a0296a51d29f4e02a70d44a6 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=275 Cleaning up request 3 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a0296a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204009019800000008616030100461000004241040f10c7fbfcfe339c630ab8c88276da3fba376780357b2d14e23f0e2db70069e14079e0b9860d84a708a6a9bef37ee88eebe260dd5d0e3a0fea977fe7fcd17b691403010001011603010030c6bdfa012c9fdefeb916132d4de9ff8c1a1a283f15441df6d8fc052629c748c4a44aff347500ca01dbece59fbc393856 Message-Authenticator = 0x57786aa1d5b675f65e684f0940291b62 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 134 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< Unknown TLS version [length 0005] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: unknown state [peap] >>> Unknown TLS version [length 0005] [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: unknown state [peap] TLS_accept: unknown state [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0105004119001403010001011603010030f61da070708c43f6dcbe41409fdf2e51cef8af0256ad4b8828349c69c10ed97fe1e82b69230f4405d2b0100e3e3ec20a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a7286a51d29f4e02a70d44a6 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=137 Cleaning up request 4 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a7286a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0xb6949019762097b54db555bcc6b9d8e3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED [peap] >>> Unknown TLS version [length 0005] ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0106002b1900170301002068c18a036c48de0eb66bdbbf81b8787ae912570a2aef56f40ddbc40c13c0b9da Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a62b6a51d29f4e02a70d44a6 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=174 Cleaning up request 5 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a62b6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0206002b190017030100204c3876f131f068fe79e951f813c5cb207e4016221643c7aea94152cb78abf875 Message-Authenticator = 0xbdfef7d06256d6eca1eb5496f1180756 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - Roger [peap] Got inner identity 'Roger' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0206000a01526f676572 server { [peap] Setting User-Name to Roger Sending tunneled request EAP-Message = 0x0206000a01526f676572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Roger" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 6 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0107001f1a0107001a100004ddc71e23923b2be4b11419c99909526f676572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8298ef44829ff58ff79b4166c44b0a5b [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0107001f1a0107001a100004ddc71e23923b2be4b11419c99909526f676572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8298ef44829ff58ff79b4166c44b0a5b [peap] Got tunneled Access-Challenge [peap] >>> Unknown TLS version [length 0005] ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0107003b190017030100307b70512e13ec9b5d3f78eab651ac96375f3978054c49bda43168cc53dc066b892ae61bed91033e6dcc2295be608ea5b6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a52a6a51d29f4e02a70d44a6 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=238 Cleaning up request 6 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a52a6a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207006b19001703010060f91730c057463659319d67a0cb0a0eaa899328ca1dcd043d97521f3fb09acc3c301ba9d5af3fe15a544aad005996d12bb9802b18b600a77fb0434e701b7fab642cfc6092e157dc279a7fa7d99499627db8f1bfe8d0f895ddc540cf79dbf99627 Message-Authenticator = 0x25fd8c0a7055dad08db9ad50c209d5f3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700401a0207003b31eabc7c85d8a95307b769e4ba2c0d887700000000000000009753306f44120327dcf92e9b8955f68a63442b9c007d6f7200526f676572 server { [peap] Setting User-Name to Roger Sending tunneled request EAP-Message = 0x020700401a0207003b31eabc7c85d8a95307b769e4ba2c0d887700000000000000009753306f44120327dcf92e9b8955f68a63442b9c007d6f7200526f676572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "Roger" State = 0x8298ef44829ff58ff79b4166c44b0a5b server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: Roger [mschap] Told to do MS-CHAPv2 for Roger with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE [peap] >>> Unknown TLS version [length 0005] ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x0108002b1900170301002024a54b33cd00c91f3bc96de1a6a5e649fd987111d6535d05627943f2ade90bbf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa32d7303a4256a51d29f4e02a70d44a6 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 36934, id=0, length=174 Cleaning up request 7 ID 0 with timestamp +33 User-Name = "Roger" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "7824af7b1a5c" Calling-Station-Id = "d4f46faaa693" NAS-Identifier = "7824af7b1a5c" NAS-Port = 31 Framed-MTU = 1400 State = 0xa32d7303a4256a51d29f4e02a70d44a6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208002b190017030100203f1b35d2fb7020ac9b9a174a085fdcdedc704e9385d24a06f68a55e15c5ff01d Message-Authenticator = 0x15ca385972b2294e5667e36abeb2162d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Roger", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] <<< Unknown TLS version [length 0005] [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv failure [peap] Received EAP-TLV response. [peap] The users session was previously rejected: returning reject (again.) [peap] *** This means you need to read the PREVIOUS messages in the debug output [peap] *** to find out the reason why the user was rejected. [peap] *** Look for "reject" or "fail". Those earlier messages will tell you. [peap] *** what went wrong, and how to fix the problem. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Roger attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 8 Sending Access-Reject of id 0 to 192.168.1.1 port 36934 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 8 ID 0 with timestamp +33 Ready to process requests.

3 4