- Freeradius-Users - lists.freeradius.org

FR setup with AD | TLS issue
by Vishesh kumar 27 Aug '15

27 Aug '15

Hi Members, I am trying to setup FR with Windows Active Directory. I guess my setup is working as I am able to do mschap authentication using radtest command, but getting below logs with unsuccessful login when trying to authenticate via peapv0 via Windows 7 machine. I am using AD CA signed certificate for TLS, but seems that some certificate problem is appearing in TLS connection. Please let me know if I am missing anything here, +++++++++++++++++++++++++++++++++++++++++ rad_recv: Access-Request packet from host 192.168.32.99 port 20001, id=68, length=170 NAS-Port-Id = "AP12/2" Calling-Station-Id = "xxxxxxxxxxx" Called-Station-Id = "xxxxxxxxxxxx" Service-Type = Framed-User User-Name = "test\\user1" NAS-Port = 62279 State = 0xe13e110ce53808ac11ae5d07bbfe47cd EAP-Message = 0x020600061900 NAS-Port-Type = Wireless-802.11 NAS-IP-Address = 192.168.32.99 NAS-Identifier = "Juniper" Message-Authenticator = 0x118db9c6453dc9c952b65157e6d1a70b # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test\user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 68 to 192.168.32.99 port 20001 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe13e110ce43908ac11ae5d07bbfe47cd Finished request 29. Going to the next request Waking up in 4.9 seconds. Cleaning up request 24 ID 63 with timestamp +153 Cleaning up request 25 ID 64 with timestamp +153 Cleaning up request 26 ID 65 with timestamp +153 Cleaning up request 27 ID 66 with timestamp +153 Cleaning up request 28 ID 67 with timestamp +153 Cleaning up request 29 ID 68 with timestamp +153 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xe13e110ce43908ac did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. ++++++++++++++++++++++++++++++++++++++++++++++++++++ -- Regards, Vishesh Kumar

2 1

Problem with FreeRadius-3.0.9 - Volume Counter
by akash＠arrownet.com.np 27 Aug '15

27 Aug '15

Dear All, I'm seeing following errors when I start radius server. Counter not working! ------------------------------------------------------------------------------------------------------------------------ radiusd -X Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/share/freeradius/dictionary including dictionary file /usr/local/share/freeradius/dictionary.dhcp including dictionary file /usr/local/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/sql including configuration file /etc/raddb/mods-config/sql/main/mysql/queries.conf including configuration file /etc/raddb/mods-enabled/sqlcounter including configuration file /etc/raddb/mods-config/sql/counter/mysql/dailycounter.conf including configuration file /etc/raddb/mods-config/sql/counter/mysql/monthlycounter.conf including configuration file /etc/raddb/mods-config/sql/counter/mysql/noresetcounter.conf including configuration file /etc/raddb/mods-config/sql/counter/mysql/expire_on_login.conf including configuration file /etc/raddb/mods-config/sql/counter/mysql/volumecounter.conf including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/abfab-tr including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/operator-name including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { allow_core_dumps = no } name = "radiusd" prefix = "/usr/local" localstatedir = "/var" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/var" sbindir = "/usr/local/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes allow_vulnerable_openssl = "CVE-2014-0160" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 103.58.144.252 { ipaddr = 103.58.144.252 require_message_authenticator = no secret = <<< secret >>> shortname = "Local" nas_type = "other" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = digest radiusd: #### Instantiating modules #### # Loaded module rlm_always # Loading module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_detail # Loading module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_dhcp # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_pap # Loading module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_realm # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_replicate # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_soh # Loading module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_sql # Loading module "sql" from file /etc/raddb/mods-enabled/sql sql { driver = "rlm_sql_mysql" server = "localhost" port = 3306 login = "radius" password = <<< secret >>> radius_db = "radius" read_groups = yes read_profiles = yes read_clients = no delete_stale_sessions = yes sql_user_name = "%{User-Name}" default_user_profile = "" client_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" accounting { reference = "%{tolower:type.%{Acct-Status-Type}.query}" type { accounting-on { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } accounting-off { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = '%{integer:Event-Timestamp}' - UNIX_TIMESTAMP(acctstarttime), acctterminatecause = '%{%{Acct-Terminate-Cause}:-NAS-Reboot}' WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= FROM_UNIXTIME(%{integer:Event-Timestamp})" } start { query = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctupdatetime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{%{NAS-Port-ID}:-%{NAS-Port}}', '%{NAS-Port-Type}', FROM_UNIXTIME(%{integer:Event-Timestamp}), FROM_UNIXTIME(%{integer:Event-Timestamp}), NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}')" } interim-update { query = "UPDATE radacct SET acctupdatetime = (@acctupdatetime_old:=acctupdatetime), acctupdatetime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctinterval = %{integer:Event-Timestamp} - UNIX_TIMESTAMP(@acctupdatetime_old), framedipaddress = '%{Framed-IP-Address}', acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } stop { query = "UPDATE radacct SET acctstoptime = FROM_UNIXTIME(%{integer:Event-Timestamp}), acctsessiontime = %{%{Acct-Session-Time}:-NULL}, acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', connectinfo_stop = '%{Connect-Info}' WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}'" } } } post-auth { reference = ".query" query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" } } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Creating attribute SQL-Group # Loaded module rlm_sqlcounter # Loading module "dailycounter" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter dailycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "daily" counter_name = "Daily-Session-Time" check_name = "Max-Daily-Session" reply_name = "Session-Timeout" } # Loading module "monthlycounter" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter monthlycounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(acctsessiontime - GREATEST((%%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{User-Name}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%%b'" reset = "monthly" counter_name = "Monthly-Session-Time" check_name = "Max-Monthly-Session" reply_name = "Session-Timeout" } # Loading module "noresetcounter" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter noresetcounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'" reset = "never" counter_name = "Max-All-Session-Time" check_name = "Max-All-Session" reply_name = "Session-Timeout" } # Loading module "expire_on_login" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter expire_on_login { sql_module_instance = "sql" key = "User-Name" query = "SELECT IFNULL( MAX(TIME_TO_SEC(TIMEDIFF(NOW(), acctstarttime))),0) FROM radacct WHERE UserName='%{User-Name}' ORDER BY acctstarttime LIMIT 1;" reset = "never" counter_name = "Expire-After-Initial-Login" check_name = "Expire-After" reply_name = "Session-Timeout" } # Loading module "volumecounter" from file /etc/raddb/mods-enabled/sqlcounter sqlcounter volumecounter { sql_module_instance = "sql" key = "User-Name" query = "SELECT SUM(AcctInputOctets)/(1024*1024) + SUM(AcctOutputOctets)/(1024*1024) FROM radacct WHERE UserName='%{User-Name}'" reset = "never" counter_name = "Mikrotik-Total-Limit" check_name = "Mikrotik-Total-Limit" reply_name = "Session-Timeout" } /etc/raddb/mods-enabled/sqlcounter[97]: Failed registering counter attribute Mikrotik-Total-Limit: Attribute 'Mikrotik-Total-Limit' already exists. /etc/raddb/mods-enabled/sqlcounter[97]: Instantiation failed for module "volumecounter" ------------------------------------------------------------------------------------------------------------------------ Thanks, Akash

2 2

confusion about radius.log entries
by Winders, Timothy A 26 Aug '15

26 Aug '15

We have had back to school this week and a lot of students are complaining about "unstable wifi". Not a lot of help… but after much digging, the general report is that they connect to the wireless network (Cisco 5508 controller advertising WPA2 Enterprise / PEAP / MSCHAPv2 network authenticating against FreeRadius 3.0.7 with Active Directory) but then they will lose their connection and may not be able to get connected again for 30 minutes to several hours later. We didn’t have problems at all this summer with light traffic, but now with heavy traffic, it’s quite overwhelming. I plan to upgrade to FR 3.0.9 tomorrow. I will also open a case with Cisco in the morning. My question here is related to the activity I’m seeing in the radius.log on the FR servers. I see login OK messages for the same user repeatedly at intervals from a few seconds to a few minutes apart. I thought it might have something to do with a user moving between access points, but even when they are in a fixed location, multiple entries show in the log. I’m not familiar with the radius protocol, but this seems… excessive. My first thought is a misconfiguration of the WLAN on the Cisco controller, but, before opening a case with Cisco, are there thoughts from the FR community? Here is a sample of log messages for me from a period today: Tue Aug 25 14:15:08 2015 : Auth: (24739) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:15:14 2015 : Auth: (25069) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:15:44 2015 : Auth: (26647) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:19:42 2015 : Auth: (37222) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:19:58 2015 : Auth: (38197) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:21:11 2015 : Auth: (41519) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:23:00 2015 : Auth: (46534) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) Tue Aug 25 14:23:38 2015 : Auth: (48018) Login OK: [twinders(a)southplainscollege.edu] (from client lev-wireless1 port 13 cli 04-f1-3e-bc-44-05 via TLS tunnel) I can post additional logs or configuration information if that would be helpful. I’m not sure exactly what would be helpful, so I’ll hold off including anything more for now. Thank you. -- Tim Winders Associate Dean of Information Technology South Plains College (806) 716-2369

3 4

query.conf/mysql, UNHEX help
by Miha 26 Aug '15

26 Aug '15

Hi, I would need a little help with UNHEX thing for file query.conf which is for mysql. Here is one part that is bothering me from query.conf. I posted it on pastebin:http://pastebin.com/JXwuc3ST In accounting request I get like this: CALLEDSTATIONID_WITH_PREFIX = '88#' but in mysql insert radius is inserting like this '88=23' value ''88#' which is HEX. OK how to write this part so that I will be inserted like '88#'? '%{CALLEDSTATIONID_WITH_PREFIX}' tnx miha

2 2

help with configs for eap-md5
by Isaac Konikoff 26 Aug '15

26 Aug '15

Hi, I'm trying to authenticate a wifi client (wpa_supplicant) using eap-peap with phase2 autheap=md5. In debug output, eap-peap appears to finalize with mschapv2 but eap-ttls uses eap-md5. Can I force eap-peap to use eap-md5? radiusd output eap-peap/autheap=md5 [1mradiusd: FreeRADIUS Version 3.0.3, for host x86_64-redhat-linux-gnu, built on Jun 3 2014 at 12:39:33[0m [1mCopyright (C) 1999-2014 The FreeRADIUS server project and contributors[0m [1mThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A[0m [1mPARTICULAR PURPOSE[0m [1mYou may redistribute copies of FreeRADIUS under the terms of the[0m [1mGNU General Public License[0m [1mFor more information about these matters, see the file named COPYRIGHT[0m [1mStarting - reading configuration files ...[0m including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/detail.log including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/cui including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "CVE-2014-0160" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:2 Cistron compatibility checks for entry lanforge ... [/etc/raddb/mods-config/files/authorize]:6 Cistron compatibility checks for entry testuser ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:202 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:2 Cistron compatibility checks for entry lanforge ... [/etc/raddb/mods-config/files/authorize]:6 Cistron compatibility checks for entry testuser ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:202 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 60874 Ready to process requests. Received Access-Request Id 58 from 127.0.0.1:35433 to 127.0.0.1:1812 length 199 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02fc000d017465737475736572 Message-Authenticator = 0x67f928dcf08d49cee2254f7772c38dce (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") (0) EXPAND %{tolower:%{User-Name}} (0) --> testuser (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "testuser", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : EAP packet type response id 252 length 13 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent Identity (1) (0) eap : Calling eap_md5 to process EAP data (0) eap_md5 : Issuing MD5 Challenge (0) eap : New EAP session, adding 'State' attribute to reply 0xac337ffeacce7bb4 (0) [eap] = handled (0) } # authenticate = handled Sending Access-Challenge Id 58 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x01fd00160410b5170ee0cf757095a1c0ece75b55c2b2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffeacce7bb44296c44be3bc030a (0) Finished request Waking up in 0.3 seconds. Received Access-Request Id 59 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02fd00060319 State = 0xac337ffeacce7bb44296c44be3bc030a Message-Authenticator = 0x1994ae87ae4554d634fc95d88c8f6aed (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) if (User-Name != "%{tolower:%{User-Name}}") (1) EXPAND %{tolower:%{User-Name}} (1) --> testuser (1) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) if (User-Name =~ / /) (1) if (User-Name =~ / /) -> FALSE (1) if (User-Name =~ /@.*@/ ) (1) if (User-Name =~ /@.*@/ ) -> FALSE (1) if (User-Name =~ /\\.\\./ ) (1) if (User-Name =~ /\\.\\./ ) -> FALSE (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (1) if (User-Name =~ /\\.$/) (1) if (User-Name =~ /\\.$/) -> FALSE (1) if (User-Name =~ /(a)\\./) (1) if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "testuser", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : EAP packet type response id 253 length 6 (1) eap : No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files : users: Matched entry testuser at line 6 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) WARNING: pap : Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0xac337ffeacce7bb4 (1) eap : Finished EAP session with state 0xac337ffeacce7bb4 (1) eap : Previous EAP request found for state 0xac337ffeacce7bb4, released from the list (1) eap : Peer sent NAK (3) (1) eap : Found mutually acceptable type PEAP (25) (1) eap : Calling eap_peap to process EAP data (1) eap_peap : Flushing SSL sessions (of #0) (1) eap_peap : Initiate (1) eap_peap : Start returned 1 (1) eap : New EAP session, adding 'State' attribute to reply 0xac337ffeadcd66b4 (1) [eap] = handled (1) } # authenticate = handled Sending Access-Challenge Id 59 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x01fe00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffeadcd66b44296c44be3bc030a (1) Finished request Waking up in 0.3 seconds. Received Access-Request Id 60 from 127.0.0.1:35433 to 127.0.0.1:1812 length 461 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02fe00ff1980000000f516030100f0010000ec030355db9f2af5ebeda72d7d1e90334bed49da9dfee869c7d09b37d132c932fd925e000084c030c02cc028c024c014c00a00a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084c012c00800160013c00dc003000ac02fc02bc027c023c013c00900a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f009600410007c011c007c00cc0020005000400ff0100003f000b000403000102000a00080006001900180017000d002200200601060206030501050205030401040204030301030203030201020202030101000f000101 State = 0xac337ffeadcd66b44296c44be3bc030a Message-Authenticator = 0x20d3d3f1dc408bde9e511f4850a7f480 (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) if (User-Name != "%{tolower:%{User-Name}}") (2) EXPAND %{tolower:%{User-Name}} (2) --> testuser (2) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (2) if (User-Name =~ / /) (2) if (User-Name =~ / /) -> FALSE (2) if (User-Name =~ /@.*@/ ) (2) if (User-Name =~ /@.*@/ ) -> FALSE (2) if (User-Name =~ /\\.\\./ ) (2) if (User-Name =~ /\\.\\./ ) -> FALSE (2) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (2) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (2) if (User-Name =~ /\\.$/) (2) if (User-Name =~ /\\.$/) -> FALSE (2) if (User-Name =~ /(a)\\./) (2) if (User-Name =~ /(a)\\./) -> FALSE (2) } # filter_username filter_username = notfound (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : No '@' in User-Name = "testuser", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) eap : EAP packet type response id 254 length 255 (2) eap : Continuing tunnel setup. (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) authenticate { (2) eap : Expiring EAP session with state 0xac337ffeadcd66b4 (2) eap : Finished EAP session with state 0xac337ffeadcd66b4 (2) eap : Previous EAP request found for state 0xac337ffeadcd66b4, released from the list (2) eap : Peer sent PEAP (25) (2) eap : EAP PEAP (25) (2) eap : Calling eap_peap to process EAP data (2) eap_peap : processing EAP-TLS TLS Length 245 (2) eap_peap : Length Included (2) eap_peap : eaptls_verify returned 11 (2) eap_peap : (other): before/accept initialization (2) eap_peap : TLS_accept: before/accept initialization (2) eap_peap : <<< TLS 1.0 Handshake [length 00f0], ClientHello (2) eap_peap : TLS_accept: SSLv3 read client hello A (2) eap_peap : >>> TLS 1.0 Handshake [length 005e], ServerHello (2) eap_peap : TLS_accept: SSLv3 write server hello A (2) eap_peap : >>> TLS 1.0 Handshake [length 0919], Certificate (2) eap_peap : TLS_accept: SSLv3 write certificate A (2) eap_peap : >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (2) eap_peap : TLS_accept: SSLv3 write key exchange A (2) eap_peap : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (2) eap_peap : TLS_accept: SSLv3 write server done A (2) eap_peap : TLS_accept: SSLv3 flush data (2) eap_peap : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (2) eap_peap : eaptls_process returned 13 (2) eap_peap : FR_TLS_HANDLED (2) eap : New EAP session, adding 'State' attribute to reply 0xac337ffeaecc66b4 (2) [eap] = handled (2) } # authenticate = handled Sending Access-Challenge Id 60 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x01ff03ec19c000000ada160301005e0200005a030155db9f2a5748fcd51805f2324c2bc9003d983d076d16dfb2c852072864827c45202b5c6979693e22cc640a8726e21abfc4da4779a0d349188a0bb6c87d3233ad0dc014000012ff01000100000b000403000102000f00010116030109190b0009150009120003fd308203f9308202e1a00302010202021004300d06092a864886f70d01010505003081a1310b3009060355040613025553310b30090603550408130257413111300f060355040713084665726e64616c6531223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303332343139303335385a170d3238313133303139303335385a30818b310b3009060355040613025553310b300906035504081302574131223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d30820122300d06092 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffeaecc66b44296c44be3bc030a (2) Finished request Waking up in 0.3 seconds. Received Access-Request Id 61 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02ff00061900 State = 0xac337ffeaecc66b44296c44be3bc030a Message-Authenticator = 0xf134ca7d6d47ce150fa86ceda495b9b6 (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) filter_username filter_username { (3) if (User-Name != "%{tolower:%{User-Name}}") (3) EXPAND %{tolower:%{User-Name}} (3) --> testuser (3) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (3) if (User-Name =~ / /) (3) if (User-Name =~ / /) -> FALSE (3) if (User-Name =~ /@.*@/ ) (3) if (User-Name =~ /@.*@/ ) -> FALSE (3) if (User-Name =~ /\\.\\./ ) (3) if (User-Name =~ /\\.\\./ ) -> FALSE (3) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (3) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (3) if (User-Name =~ /\\.$/) (3) if (User-Name =~ /\\.$/) -> FALSE (3) if (User-Name =~ /(a)\\./) (3) if (User-Name =~ /(a)\\./) -> FALSE (3) } # filter_username filter_username = notfound (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : No '@' in User-Name = "testuser", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) eap : EAP packet type response id 255 length 6 (3) eap : Continuing tunnel setup. (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/raddb/sites-enabled/default (3) authenticate { (3) eap : Expiring EAP session with state 0xac337ffeaecc66b4 (3) eap : Finished EAP session with state 0xac337ffeaecc66b4 (3) eap : Previous EAP request found for state 0xac337ffeaecc66b4, released from the list (3) eap : Peer sent PEAP (25) (3) eap : EAP PEAP (25) (3) eap : Calling eap_peap to process EAP data (3) eap_peap : processing EAP-TLS (3) eap_peap : Received TLS ACK (3) eap_peap : Received TLS ACK (3) eap_peap : ACK handshake fragment handler (3) eap_peap : eaptls_verify returned 1 (3) eap_peap : eaptls_process returned 13 (3) eap_peap : FR_TLS_HANDLED (3) eap : New EAP session, adding 'State' attribute to reply 0xac337ffeaf3366b4 (3) [eap] = handled (3) } # authenticate = handled Sending Access-Challenge Id 61 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x010003e819400bb6c0da3a6f7818873f0279d606e0aeb56f2c2fff8928c6c5eef941db3bc116bbefb9eaa41733c0aa19ab2d764b47e75056a665144fbb09951b20559e50ad910303fd0f3c1eae82526b96e604e51e0e78c5b93b85044d1f27ef07b017dd151e74a778d28c73caa95dee831fc8fa6c02c98d0d8606d2f2a72e7aa15715a710ef07e3e73c76c87c5a5ddee6427a00050f3082050b308203f3a003020102020900a2f025aae13c9c30300d06092a864886f70d01010505003081a1310b3009060355040613025553310b30090603550408130257413111300f060355040713084665726e64616c6531223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303332343139303335385a170d3238313133303139303335385a3081a1310b3009060355040613025553310b30090603550408130257413111300f060355040713084665726e64616c6531223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffeaf3366b44296c44be3bc030a (3) Finished request Waking up in 0.3 seconds. Received Access-Request Id 62 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x020000061900 State = 0xac337ffeaf3366b44296c44be3bc030a Message-Authenticator = 0xcb56c029b6b43ae5dd19540233961ff8 (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4) authorize { (4) filter_username filter_username { (4) if (User-Name != "%{tolower:%{User-Name}}") (4) EXPAND %{tolower:%{User-Name}} (4) --> testuser (4) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (4) if (User-Name =~ / /) (4) if (User-Name =~ / /) -> FALSE (4) if (User-Name =~ /@.*@/ ) (4) if (User-Name =~ /@.*@/ ) -> FALSE (4) if (User-Name =~ /\\.\\./ ) (4) if (User-Name =~ /\\.\\./ ) -> FALSE (4) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (4) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (4) if (User-Name =~ /\\.$/) (4) if (User-Name =~ /\\.$/) -> FALSE (4) if (User-Name =~ /(a)\\./) (4) if (User-Name =~ /(a)\\./) -> FALSE (4) } # filter_username filter_username = notfound (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : No '@' in User-Name = "testuser", looking up realm NULL (4) suffix : No such realm "NULL" (4) [suffix] = noop (4) eap : EAP packet type response id 0 length 6 (4) eap : Continuing tunnel setup. (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/raddb/sites-enabled/default (4) authenticate { (4) eap : Expiring EAP session with state 0xac337ffeaf3366b4 (4) eap : Finished EAP session with state 0xac337ffeaf3366b4 (4) eap : Previous EAP request found for state 0xac337ffeaf3366b4, released from the list (4) eap : Peer sent PEAP (25) (4) eap : EAP PEAP (25) (4) eap : Calling eap_peap to process EAP data (4) eap_peap : processing EAP-TLS (4) eap_peap : Received TLS ACK (4) eap_peap : Received TLS ACK (4) eap_peap : ACK handshake fragment handler (4) eap_peap : eaptls_verify returned 1 (4) eap_peap : eaptls_process returned 13 (4) eap_peap : FR_TLS_HANDLED (4) eap : New EAP session, adding 'State' attribute to reply 0xac337ffea83266b4 (4) [eap] = handled (4) } # authenticate = handled Sending Access-Challenge Id 62 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0101031c190069657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a2f025aae13c9c30300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010080f321d1943c002ab4437a720d11daec43be07fdd539a7a17ab1841578cb5c19382dfe5ddb526c247f057b0d6486f23336d7465d4f5bdbc1338c97ad3a4b39b7917a091ed5c8c5c9c16bf0eda8087251516e44a62cf70d7be0c2ab4a8e415e5b03e40d28e40a3d2ddb4e96affa65080ae19fea6a3f9fb6a7daf4a6b43cb901fc7f1446099a5fc80c530839222f948eab2c070e76e34f15e29abdd9f58bf6a84d3493137c3b9cce7f587bc4b32d9e17c587fc2fa0d73965277a12f9858557d303adbc2b59d566989bcfa43dafa87e5bab4d2ff5aa1755f65658bf4c35aec45b9b852dac4f89d7ad5038e4cd12c34b1d0da5e01f4f3b20626b81a1701adc84393e160301014b0c0001470300174104b3d7781cd8a6929f1e5cf585020171c8c7255688b6bc99adc3e1f0eeea09c5a5fe2d0e47967 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffea83266b44296c44be3bc030a (4) Finished request Waking up in 0.3 seconds. Received Access-Request Id 63 from 127.0.0.1:35433 to 127.0.0.1:1812 length 348 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02010090198000000086160301004610000042410468aef3802264953b0ffe64b27b0f83f447a87c59c64bf07d2469a6088befd8f6b83cf6bb4402fe835e0271fdcfdb6e8a5e7ae471f7b7e288e6ddb03ce451053e14030100010116030100309cbdf6ca7f30ad8119e875efea52a26e51ca4774da01e75623932dadf8bf567a04bc278a4d4c6e260a864149c3105ac9 State = 0xac337ffea83266b44296c44be3bc030a Message-Authenticator = 0xb2950f28a83b928efd6969581896e10c (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) if (User-Name != "%{tolower:%{User-Name}}") (5) EXPAND %{tolower:%{User-Name}} (5) --> testuser (5) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (5) if (User-Name =~ / /) (5) if (User-Name =~ / /) -> FALSE (5) if (User-Name =~ /@.*@/ ) (5) if (User-Name =~ /@.*@/ ) -> FALSE (5) if (User-Name =~ /\\.\\./ ) (5) if (User-Name =~ /\\.\\./ ) -> FALSE (5) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (5) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (5) if (User-Name =~ /\\.$/) (5) if (User-Name =~ /\\.$/) -> FALSE (5) if (User-Name =~ /(a)\\./) (5) if (User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : No '@' in User-Name = "testuser", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : EAP packet type response id 1 length 144 (5) eap : Continuing tunnel setup. (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0xac337ffea83266b4 (5) eap : Finished EAP session with state 0xac337ffea83266b4 (5) eap : Previous EAP request found for state 0xac337ffea83266b4, released from the list (5) eap : Peer sent PEAP (25) (5) eap : EAP PEAP (25) (5) eap : Calling eap_peap to process EAP data (5) eap_peap : processing EAP-TLS TLS Length 134 (5) eap_peap : Length Included (5) eap_peap : eaptls_verify returned 11 (5) eap_peap : <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (5) eap_peap : TLS_accept: SSLv3 read client key exchange A (5) eap_peap : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_peap : <<< TLS 1.0 Handshake [length 0010], Finished (5) eap_peap : TLS_accept: SSLv3 read finished A (5) eap_peap : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_peap : TLS_accept: SSLv3 write change cipher spec A (5) eap_peap : >>> TLS 1.0 Handshake [length 0010], Finished (5) eap_peap : TLS_accept: SSLv3 write finished A (5) eap_peap : TLS_accept: SSLv3 flush data SSL: adding session 2b5c6979693e22cc640a8726e21abfc4da4779a0d349188a0bb6c87d3233ad0d to cache (5) eap_peap : (other): SSL negotiation finished successfully SSL Connection Established (5) eap_peap : eaptls_process returned 13 (5) eap_peap : FR_TLS_HANDLED (5) eap : New EAP session, adding 'State' attribute to reply 0xac337ffea93166b4 (5) [eap] = handled (5) } # authenticate = handled Sending Access-Challenge Id 63 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x01020041190014030100010116030100308eae5a41f6e395126186db8125de0b004e3ae1e8264e9acd8c82ab24482555bf6190fdd8be5dc9ce6cbf8887e886e1eb Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffea93166b44296c44be3bc030a (5) Finished request Waking up in 0.3 seconds. Received Access-Request Id 64 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x020200061900 State = 0xac337ffea93166b44296c44be3bc030a Message-Authenticator = 0x101a53003bdd588a9d9e5923504506b5 (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (User-Name != "%{tolower:%{User-Name}}") (6) EXPAND %{tolower:%{User-Name}} (6) --> testuser (6) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (6) if (User-Name =~ / /) (6) if (User-Name =~ / /) -> FALSE (6) if (User-Name =~ /@.*@/ ) (6) if (User-Name =~ /@.*@/ ) -> FALSE (6) if (User-Name =~ /\\.\\./ ) (6) if (User-Name =~ /\\.\\./ ) -> FALSE (6) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (User-Name =~ /\\.$/) (6) if (User-Name =~ /\\.$/) -> FALSE (6) if (User-Name =~ /(a)\\./) (6) if (User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : No '@' in User-Name = "testuser", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : EAP packet type response id 2 length 6 (6) eap : Continuing tunnel setup. (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { (6) eap : Expiring EAP session with state 0xac337ffea93166b4 (6) eap : Finished EAP session with state 0xac337ffea93166b4 (6) eap : Previous EAP request found for state 0xac337ffea93166b4, released from the list (6) eap : Peer sent PEAP (25) (6) eap : EAP PEAP (25) (6) eap : Calling eap_peap to process EAP data (6) eap_peap : processing EAP-TLS (6) eap_peap : Received TLS ACK (6) eap_peap : Received TLS ACK (6) eap_peap : ACK handshake is finished (6) eap_peap : eaptls_verify returned 3 (6) eap_peap : eaptls_process returned 3 (6) eap_peap : FR_TLS_SUCCESS (6) eap_peap : Session established. Decoding tunneled attributes. (6) eap_peap : Peap state TUNNEL ESTABLISHED (6) eap : New EAP session, adding 'State' attribute to reply 0xac337ffeaa3066b4 (6) [eap] = handled (6) } # authenticate = handled Sending Access-Challenge Id 64 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0103002b19001703010020d8963167cb2c91701ba58e1bd30091199cad2114d0ef5eebffb2506ba9a61c50 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffeaa3066b44296c44be3bc030a (6) Finished request Waking up in 0.3 seconds. Received Access-Request Id 65 from 127.0.0.1:35433 to 127.0.0.1:1812 length 284 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x020300501900170301002019e34d12ed021daad5109ab27ba81e2dd80c4006a3137fe2cbb4584c08b2e0c91703010020f274e1276548e21e74bccff55e31ec2e69fd2c23d10129e1cfe2e5a12000fe6e State = 0xac337ffeaa3066b44296c44be3bc030a Message-Authenticator = 0x4d70591d71e8115e95bc9188bc4e7e44 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (User-Name != "%{tolower:%{User-Name}}") (7) EXPAND %{tolower:%{User-Name}} (7) --> testuser (7) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (7) if (User-Name =~ / /) (7) if (User-Name =~ / /) -> FALSE (7) if (User-Name =~ /@.*@/ ) (7) if (User-Name =~ /@.*@/ ) -> FALSE (7) if (User-Name =~ /\\.\\./ ) (7) if (User-Name =~ /\\.\\./ ) -> FALSE (7) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (User-Name =~ /\\.$/) (7) if (User-Name =~ /\\.$/) -> FALSE (7) if (User-Name =~ /(a)\\./) (7) if (User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : No '@' in User-Name = "testuser", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : EAP packet type response id 3 length 80 (7) eap : Continuing tunnel setup. (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap : Expiring EAP session with state 0xac337ffeaa3066b4 (7) eap : Finished EAP session with state 0xac337ffeaa3066b4 (7) eap : Previous EAP request found for state 0xac337ffeaa3066b4, released from the list (7) eap : Peer sent PEAP (25) (7) eap : EAP PEAP (25) (7) eap : Calling eap_peap to process EAP data (7) eap_peap : processing EAP-TLS (7) eap_peap : eaptls_verify returned 7 (7) eap_peap : Done initial handshake (7) eap_peap : eaptls_process returned 7 (7) eap_peap : FR_TLS_OK (7) eap_peap : Session established. Decoding tunneled attributes. (7) eap_peap : Peap state WAITING FOR INNER IDENTITY (7) eap_peap : Identity - testuser (7) eap_peap : Got inner identity 'testuser' (7) eap_peap : Setting default EAP type for tunneled EAP session. (7) eap_peap : Got tunneled request EAP-Message = 0x0203000d017465737475736572 server default { (7) eap_peap : Setting User-Name to testuser Sending tunneled request EAP-Message = 0x0203000d017465737475736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'testuser' server inner-tunnel { (7) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) [chap] = noop (7) [mschap] = noop (7) suffix : No '@' in User-Name = "testuser", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) Proxy-To-Realm := 'LOCAL' (7) } # update control = noop (7) eap : EAP packet type response id 3 length 13 (7) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Peer sent Identity (1) (7) eap : Calling eap_mschapv2 to process EAP data (7) eap_mschapv2 : Issuing Challenge (7) eap : New EAP session, adding 'State' attribute to reply 0xb1be9a22b1ba80a3 (7) [eap] = handled (7) } # authenticate = handled } # server inner-tunnel (7) eap_peap : Got tunneled reply code 11 EAP-Message = 0x010400221a0104001d10027ae9f0cd1c776d593ea7329525024b7465737475736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1be9a22b1ba80a3164ac945e67a1095 (7) eap_peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x010400221a0104001d10027ae9f0cd1c776d593ea7329525024b7465737475736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1be9a22b1ba80a3164ac945e67a1095 (7) eap_peap : Got tunneled Access-Challenge (7) eap : New EAP session, adding 'State' attribute to reply 0xac337ffeab3766b4 (7) [eap] = handled (7) } # authenticate = handled Sending Access-Challenge Id 65 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0104004b190017030100407891a16aa2b3472c046f41f0e18d7b91991cdd2415e05527ead38adf7c992b7138371115d7410f4dd47175742f6326e25d991fecf1c1664047cbed2d7c4947df Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffeab3766b44296c44be3bc030a (7) Finished request Waking up in 0.3 seconds. Received Access-Request Id 66 from 127.0.0.1:35433 to 127.0.0.1:1812 length 348 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02040090190017030100207efb9a41982ebc4831585f9fc96a3aa74e1735a6b09a1be5369a156d6e55ae121703010060ccea57586e02203538208536cb2dfd3bd2e67510b7ea0ec2c7e5b5fd551f38b25ddbe523a7e811878c69856a2770b10af175930120f6db569c878cc39836354de44475593dc6b61c2142896e59ece5f0a38acccc3a4faeee156a41f958399798 State = 0xac337ffeab3766b44296c44be3bc030a Message-Authenticator = 0x110a83574ebcde0b705ebe475a27cd09 (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8) authorize { (8) filter_username filter_username { (8) if (User-Name != "%{tolower:%{User-Name}}") (8) EXPAND %{tolower:%{User-Name}} (8) --> testuser (8) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (8) if (User-Name =~ / /) (8) if (User-Name =~ / /) -> FALSE (8) if (User-Name =~ /@.*@/ ) (8) if (User-Name =~ /@.*@/ ) -> FALSE (8) if (User-Name =~ /\\.\\./ ) (8) if (User-Name =~ /\\.\\./ ) -> FALSE (8) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (8) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (8) if (User-Name =~ /\\.$/) (8) if (User-Name =~ /\\.$/) -> FALSE (8) if (User-Name =~ /(a)\\./) (8) if (User-Name =~ /(a)\\./) -> FALSE (8) } # filter_username filter_username = notfound (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix : No '@' in User-Name = "testuser", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) eap : EAP packet type response id 4 length 144 (8) eap : Continuing tunnel setup. (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/default (8) authenticate { (8) eap : Expiring EAP session with state 0xb1be9a22b1ba80a3 (8) eap : Finished EAP session with state 0xac337ffeab3766b4 (8) eap : Previous EAP request found for state 0xac337ffeab3766b4, released from the list (8) eap : Peer sent PEAP (25) (8) eap : EAP PEAP (25) (8) eap : Calling eap_peap to process EAP data (8) eap_peap : processing EAP-TLS (8) eap_peap : eaptls_verify returned 7 (8) eap_peap : Done initial handshake (8) eap_peap : eaptls_process returned 7 (8) eap_peap : FR_TLS_OK (8) eap_peap : Session established. Decoding tunneled attributes. (8) eap_peap : Peap state phase2 (8) eap_peap : EAP type MSCHAPv2 (26) (8) eap_peap : Got tunneled request EAP-Message = 0x020400431a0204003e31a7bbe3cde881d2e06d41a5b6a44f0d94000000000000000069d59066f3db91279151c9f6dac509f5418c01689cf27420007465737475736572 server default { (8) eap_peap : Setting User-Name to testuser Sending tunneled request EAP-Message = 0x020400431a0204003e31a7bbe3cde881d2e06d41a5b6a44f0d94000000000000000069d59066f3db91279151c9f6dac509f5418c01689cf27420007465737475736572 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'testuser' State = 0xb1be9a22b1ba80a3164ac945e67a1095 server inner-tunnel { (8) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8) authorize { (8) [chap] = noop (8) [mschap] = noop (8) suffix : No '@' in User-Name = "testuser", looking up realm NULL (8) suffix : No such realm "NULL" (8) [suffix] = noop (8) update control { (8) Proxy-To-Realm := 'LOCAL' (8) } # update control = noop (8) eap : EAP packet type response id 4 length 67 (8) eap : No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) files : users: Matched entry testuser at line 6 (8) [files] = ok (8) [expiration] = noop (8) [logintime] = noop (8) WARNING: pap : Auth-Type already set. Not setting to PAP (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = EAP (8) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) authenticate { (8) eap : Expiring EAP session with state 0xb1be9a22b1ba80a3 (8) eap : Finished EAP session with state 0xb1be9a22b1ba80a3 (8) eap : Previous EAP request found for state 0xb1be9a22b1ba80a3, released from the list (8) eap : Peer sent MSCHAPv2 (26) (8) eap : EAP MSCHAPv2 (26) (8) eap : Calling eap_mschapv2 to process EAP data (8) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8) eap_mschapv2 : Auth-Type MS-CHAP { (8) mschap : Found Cleartext-Password, hashing to create LM-Password (8) mschap : Found Cleartext-Password, hashing to create NT-Password (8) mschap : Creating challenge hash with username: testuser (8) mschap : Client is using MS-CHAPv2 (8) mschap : Adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # Auth-Type MS-CHAP = ok MSCHAP Success (8) eap : New EAP session, adding 'State' attribute to reply 0xb1be9a22b0bb80a3 (8) [eap] = handled (8) } # authenticate = handled } # server inner-tunnel (8) eap_peap : Got tunneled reply code 11 EAP-Message = 0x010500331a0304002e533d39434644443638374641354143433544414444363231413738393232313443323137324238443136 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1be9a22b0bb80a3164ac945e67a1095 (8) eap_peap : Got tunneled reply RADIUS code 11 EAP-Message = 0x010500331a0304002e533d39434644443638374641354143433544414444363231413738393232313443323137324238443136 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1be9a22b0bb80a3164ac945e67a1095 (8) eap_peap : Got tunneled Access-Challenge (8) eap : New EAP session, adding 'State' attribute to reply 0xac337ffea43666b4 (8) [eap] = handled (8) } # authenticate = handled Sending Access-Challenge Id 66 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0105005b1900170301005088813548ddf94724b53a20fdbc87fd1c46cce9cb304463628b94edbf3ccce0f8db9c8820d2ff1187b5a5410a8485ae18e99d36f48180441d914360a165bb11572625ee26bcb38e940bede46acd1078dd Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffea43666b44296c44be3bc030a (8) Finished request Waking up in 0.3 seconds. Received Access-Request Id 67 from 127.0.0.1:35433 to 127.0.0.1:1812 length 284 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x0205005019001703010020f09ba916b1bb58e1700e3b1ca5851eee9b039c85e8e6d846367d9d6cca7a68a4170301002091a3f0516ee8f4b1cd8bd7f571ab50adc3a38373ba07180ac04d9511ea3aa4f0 State = 0xac337ffea43666b44296c44be3bc030a Message-Authenticator = 0x92f7efa862baddcd14f8f37226c93cc4 (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9) authorize { (9) filter_username filter_username { (9) if (User-Name != "%{tolower:%{User-Name}}") (9) EXPAND %{tolower:%{User-Name}} (9) --> testuser (9) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (9) if (User-Name =~ / /) (9) if (User-Name =~ / /) -> FALSE (9) if (User-Name =~ /@.*@/ ) (9) if (User-Name =~ /@.*@/ ) -> FALSE (9) if (User-Name =~ /\\.\\./ ) (9) if (User-Name =~ /\\.\\./ ) -> FALSE (9) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (9) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (9) if (User-Name =~ /\\.$/) (9) if (User-Name =~ /\\.$/) -> FALSE (9) if (User-Name =~ /(a)\\./) (9) if (User-Name =~ /(a)\\./) -> FALSE (9) } # filter_username filter_username = notfound (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix : No '@' in User-Name = "testuser", looking up realm NULL (9) suffix : No such realm "NULL" (9) [suffix] = noop (9) eap : EAP packet type response id 5 length 80 (9) eap : Continuing tunnel setup. (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /etc/raddb/sites-enabled/default (9) authenticate { (9) eap : Expiring EAP session with state 0xb1be9a22b0bb80a3 (9) eap : Finished EAP session with state 0xac337ffea43666b4 (9) eap : Previous EAP request found for state 0xac337ffea43666b4, released from the list (9) eap : Peer sent PEAP (25) (9) eap : EAP PEAP (25) (9) eap : Calling eap_peap to process EAP data (9) eap_peap : processing EAP-TLS (9) eap_peap : eaptls_verify returned 7 (9) eap_peap : Done initial handshake (9) eap_peap : eaptls_process returned 7 (9) eap_peap : FR_TLS_OK (9) eap_peap : Session established. Decoding tunneled attributes. (9) eap_peap : Peap state phase2 (9) eap_peap : EAP type MSCHAPv2 (26) (9) eap_peap : Got tunneled request EAP-Message = 0x020500061a03 server default { (9) eap_peap : Setting User-Name to testuser Sending tunneled request EAP-Message = 0x020500061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'testuser' State = 0xb1be9a22b0bb80a3164ac945e67a1095 server inner-tunnel { (9) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (9) authorize { (9) [chap] = noop (9) [mschap] = noop (9) suffix : No '@' in User-Name = "testuser", looking up realm NULL (9) suffix : No such realm "NULL" (9) [suffix] = noop (9) update control { (9) Proxy-To-Realm := 'LOCAL' (9) } # update control = noop (9) eap : EAP packet type response id 5 length 6 (9) eap : EAP-MSCHAPV2 success, returning short-circuit ok (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (9) authenticate { (9) eap : Expiring EAP session with state 0xb1be9a22b0bb80a3 (9) eap : Finished EAP session with state 0xb1be9a22b0bb80a3 (9) eap : Previous EAP request found for state 0xb1be9a22b0bb80a3, released from the list (9) eap : Peer sent MSCHAPv2 (26) (9) eap : EAP MSCHAPv2 (26) (9) eap : Calling eap_mschapv2 to process EAP data (9) eap : Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (9) (null) post-auth { ... } # empty sub-section is ignored } # server inner-tunnel (9) eap_peap : Got tunneled reply code 2 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed MS-MPPE-Send-Key = 0x62b5d44437c16ef3e9639a6e70630dce MS-MPPE-Recv-Key = 0x53749455e55cad37bb61abd38f93ffde EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'testuser' (9) eap_peap : Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed MS-MPPE-Send-Key = 0x62b5d44437c16ef3e9639a6e70630dce MS-MPPE-Recv-Key = 0x53749455e55cad37bb61abd38f93ffde EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'testuser' (9) eap_peap : Tunneled authentication was successful. (9) eap_peap : SUCCESS (9) eap : New EAP session, adding 'State' attribute to reply 0xac337ffea53566b4 (9) [eap] = handled (9) } # authenticate = handled Sending Access-Challenge Id 67 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0106002b19001703010020696438a4d8a852d2b5fd2c3fad99ed06f8a1e864ac9db9c91a10b76df019806b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xac337ffea53566b44296c44be3bc030a (9) Finished request Waking up in 0.2 seconds. Received Access-Request Id 68 from 127.0.0.1:35433 to 127.0.0.1:1812 length 284 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000006' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02060050190017030100208cd6608dbef4cecccee1609aa390bd34c942a7213e02eef520eaa7c07e3415071703010020fefd8e765597b61f693aa7a85b63f9a76f288bd27597cf75bb04d9465b8dc65a State = 0xac337ffea53566b44296c44be3bc030a Message-Authenticator = 0x04686e408fa7398a03cade732d7cd4e0 (10) # Executing section authorize from file /etc/raddb/sites-enabled/default (10) authorize { (10) filter_username filter_username { (10) if (User-Name != "%{tolower:%{User-Name}}") (10) EXPAND %{tolower:%{User-Name}} (10) --> testuser (10) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (10) if (User-Name =~ / /) (10) if (User-Name =~ / /) -> FALSE (10) if (User-Name =~ /@.*@/ ) (10) if (User-Name =~ /@.*@/ ) -> FALSE (10) if (User-Name =~ /\\.\\./ ) (10) if (User-Name =~ /\\.\\./ ) -> FALSE (10) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (10) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (10) if (User-Name =~ /\\.$/) (10) if (User-Name =~ /\\.$/) -> FALSE (10) if (User-Name =~ /(a)\\./) (10) if (User-Name =~ /(a)\\./) -> FALSE (10) } # filter_username filter_username = notfound (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix : No '@' in User-Name = "testuser", looking up realm NULL (10) suffix : No such realm "NULL" (10) [suffix] = noop (10) eap : EAP packet type response id 6 length 80 (10) eap : Continuing tunnel setup. (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = EAP (10) # Executing group from file /etc/raddb/sites-enabled/default (10) authenticate { (10) eap : Expiring EAP session with state 0xac337ffea53566b4 (10) eap : Finished EAP session with state 0xac337ffea53566b4 (10) eap : Previous EAP request found for state 0xac337ffea53566b4, released from the list (10) eap : Peer sent PEAP (25) (10) eap : EAP PEAP (25) (10) eap : Calling eap_peap to process EAP data (10) eap_peap : processing EAP-TLS (10) eap_peap : eaptls_verify returned 7 (10) eap_peap : Done initial handshake (10) eap_peap : eaptls_process returned 7 (10) eap_peap : FR_TLS_OK (10) eap_peap : Session established. Decoding tunneled attributes. (10) eap_peap : Peap state send tlv success (10) eap_peap : Received EAP-TLV response. (10) eap_peap : Success (10) WARNING: eap_peap : No information to cache: session caching will be disabled for session 2b5c6979693e22cc640a8726e21abfc4da4779a0d349188a0bb6c87d3233ad0d SSL: Removing session 2b5c6979693e22cc640a8726e21abfc4da4779a0d349188a0bb6c87d3233ad0d from the cache (10) eap : Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/raddb/sites-enabled/default (10) post-auth { (10) [exec] = noop (10) remove_reply_message_if_eap remove_reply_message_if_eap { (10) if (reply:EAP-Message && reply:Reply-Message) (10) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (10) else else { (10) [noop] = noop (10) } # else else = noop (10) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (10) } # post-auth = noop Sending Access-Accept Id 68 from 127.0.0.1:1812 to 127.0.0.1:35433 MS-MPPE-Recv-Key = 0xba01a942a8b3dfda0603e53c13c857c7d1a76001693e7ca2d16dec6e0f9b7077 MS-MPPE-Send-Key = 0x6bab05ab2b1e70f9f7509cea40e5f580bea110c5804f19833e6544bb8ea44f56 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'testuser' (10) Finished request Waking up in 0.2 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 58 with timestamp +28 (1) Cleaning up request packet ID 59 with timestamp +28 (2) Cleaning up request packet ID 60 with timestamp +28 (3) Cleaning up request packet ID 61 with timestamp +28 (4) Cleaning up request packet ID 62 with timestamp +28 (5) Cleaning up request packet ID 63 with timestamp +28 (6) Cleaning up request packet ID 64 with timestamp +28 (7) Cleaning up request packet ID 65 with timestamp +28 (8) Cleaning up request packet ID 66 with timestamp +28 (9) Cleaning up request packet ID 67 with timestamp +28 (10) Cleaning up request packet ID 68 with timestamp +28 Ready to process requests. radiusd output eap-ttls/autheap=md5 [1mradiusd: FreeRADIUS Version 3.0.3, for host x86_64-redhat-linux-gnu, built on Jun 3 2014 at 12:39:33[0m [1mCopyright (C) 1999-2014 The FreeRADIUS server project and contributors[0m [1mThere is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A[0m [1mPARTICULAR PURPOSE[0m [1mYou may redistribute copies of FreeRADIUS under the terms of the[0m [1mGNU General Public License[0m [1mFor more information about these matters, see the file named COPYRIGHT[0m [1mStarting - reading configuration files ...[0m including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/chap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/detail.log including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/accounting including configuration file /etc/raddb/policy.d/cui including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel main { security { user = "radiusd" group = "radiusd" allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = "CVE-2014-0160" } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_soh # Instantiating module "soh" from file /etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog linelog { filename = "/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog linelog log_accounting { filename = "/var/log/radius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/raddb/mods-enabled/utf8 # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" ca_file = "/etc/raddb/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_unix # Instantiating module "unix" from file /etc/raddb/mods-enabled/unix unix { radwtmp = "/var/log/radius/radwtmp" } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_files # Instantiating module "files" from file /etc/raddb/mods-enabled/files files { filename = "/etc/raddb/mods-config/files/authorize" usersfile = "/etc/raddb/mods-config/files/authorize" acctusersfile = "/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:2 Cistron compatibility checks for entry lanforge ... [/etc/raddb/mods-config/files/authorize]:6 Cistron compatibility checks for entry testuser ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:202 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/authorize [/etc/raddb/mods-config/files/authorize]:2 Cistron compatibility checks for entry lanforge ... [/etc/raddb/mods-config/files/authorize]:6 Cistron compatibility checks for entry testuser ... [/etc/raddb/mods-config/files/authorize]:188 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:195 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb/mods-config/files/authorize]:202 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration # Loaded module rlm_chap # Instantiating module "chap" from file /etc/raddb/mods-enabled/chap # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_expr # Instantiating module "expr" from file /etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_digest # Instantiating module "digest" from file /etc/raddb/mods-enabled/digest # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" hints = "/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints # Instantiating module "echo" from file /etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/raddb/mods-enabled/dhcp # Loaded module rlm_detail # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail detail { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/raddb/mods-enabled/unpack # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_always # Instantiating module "reject" from file /etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "exec" from file /etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/raddb/mods-enabled/replicate # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /etc/raddb/mods-enabled/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Instantiating module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no log_packet_header = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server default { # from file /etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 46457 Ready to process requests. Received Access-Request Id 69 from 127.0.0.1:35433 to 127.0.0.1:1812 length 199 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x025c000d017465737475736572 Message-Authenticator = 0x1e1963353af55f1a65eb716257a1e5ec (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) if (User-Name != "%{tolower:%{User-Name}}") (0) EXPAND %{tolower:%{User-Name}} (0) --> testuser (0) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) if (User-Name =~ / /) (0) if (User-Name =~ / /) -> FALSE (0) if (User-Name =~ /@.*@/ ) (0) if (User-Name =~ /@.*@/ ) -> FALSE (0) if (User-Name =~ /\\.\\./ ) (0) if (User-Name =~ /\\.\\./ ) -> FALSE (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (0) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (0) if (User-Name =~ /\\.$/) (0) if (User-Name =~ /\\.$/) -> FALSE (0) if (User-Name =~ /(a)\\./) (0) if (User-Name =~ /(a)\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : No '@' in User-Name = "testuser", looking up realm NULL (0) suffix : No such realm "NULL" (0) [suffix] = noop (0) eap : EAP packet type response id 92 length 13 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent Identity (1) (0) eap : Calling eap_md5 to process EAP data (0) eap_md5 : Issuing MD5 Challenge (0) eap : New EAP session, adding 'State' attribute to reply 0x50d301f2508e05e4 (0) [eap] = handled (0) } # authenticate = handled Sending Access-Challenge Id 69 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x015d00160410b3641ca954151e4533a20422cc0d5499 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f2508e05e49f3c072d4998f54e (0) Finished request Waking up in 0.3 seconds. Received Access-Request Id 70 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x025d00060315 State = 0x50d301f2508e05e49f3c072d4998f54e Message-Authenticator = 0x72f583eed65978a196eef4b1230c8969 (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) if (User-Name != "%{tolower:%{User-Name}}") (1) EXPAND %{tolower:%{User-Name}} (1) --> testuser (1) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) if (User-Name =~ / /) (1) if (User-Name =~ / /) -> FALSE (1) if (User-Name =~ /@.*@/ ) (1) if (User-Name =~ /@.*@/ ) -> FALSE (1) if (User-Name =~ /\\.\\./ ) (1) if (User-Name =~ /\\.\\./ ) -> FALSE (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (1) if (User-Name =~ /\\.$/) (1) if (User-Name =~ /\\.$/) -> FALSE (1) if (User-Name =~ /(a)\\./) (1) if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "testuser", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : EAP packet type response id 93 length 6 (1) eap : No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) files : users: Matched entry testuser at line 6 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) WARNING: pap : Auth-Type already set. Not setting to PAP (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = EAP (1) # Executing group from file /etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0x50d301f2508e05e4 (1) eap : Finished EAP session with state 0x50d301f2508e05e4 (1) eap : Previous EAP request found for state 0x50d301f2508e05e4, released from the list (1) eap : Peer sent NAK (3) (1) eap : Found mutually acceptable type TTLS (21) (1) eap : Calling eap_ttls to process EAP data (1) eap_ttls : Flushing SSL sessions (of #0) (1) eap_ttls : Initiate (1) eap_ttls : Start returned 1 (1) eap : New EAP session, adding 'State' attribute to reply 0x50d301f2518d14e4 (1) [eap] = handled (1) } # authenticate = handled Sending Access-Challenge Id 70 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x015e00061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f2518d14e49f3c072d4998f54e (1) Finished request Waking up in 0.3 seconds. Received Access-Request Id 71 from 127.0.0.1:35433 to 127.0.0.1:1812 length 455 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x025e00fb150016030100f0010000ec030355db9f58716436253836d68898c5a8dcc1dcd5798cb7577260ef17cf8ba35277000084c030c02cc028c024c014c00a00a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084c012c00800160013c00dc003000ac02fc02bc027c023c013c00900a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f009600410007c011c007c00cc0020005000400ff0100003f000b000403000102000a00080006001900180017000d002200200601060206030501050205030401040204030301030203030201020202030101000f000101 State = 0x50d301f2518d14e49f3c072d4998f54e Message-Authenticator = 0xcd476cd25bce3078ad79a7fc0114694e (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) if (User-Name != "%{tolower:%{User-Name}}") (2) EXPAND %{tolower:%{User-Name}} (2) --> testuser (2) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (2) if (User-Name =~ / /) (2) if (User-Name =~ / /) -> FALSE (2) if (User-Name =~ /@.*@/ ) (2) if (User-Name =~ /@.*@/ ) -> FALSE (2) if (User-Name =~ /\\.\\./ ) (2) if (User-Name =~ /\\.\\./ ) -> FALSE (2) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (2) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (2) if (User-Name =~ /\\.$/) (2) if (User-Name =~ /\\.$/) -> FALSE (2) if (User-Name =~ /(a)\\./) (2) if (User-Name =~ /(a)\\./) -> FALSE (2) } # filter_username filter_username = notfound (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : No '@' in User-Name = "testuser", looking up realm NULL (2) suffix : No such realm "NULL" (2) [suffix] = noop (2) eap : EAP packet type response id 94 length 251 (2) eap : Continuing tunnel setup. (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/raddb/sites-enabled/default (2) authenticate { (2) eap : Expiring EAP session with state 0x50d301f2518d14e4 (2) eap : Finished EAP session with state 0x50d301f2518d14e4 (2) eap : Previous EAP request found for state 0x50d301f2518d14e4, released from the list (2) eap : Peer sent TTLS (21) (2) eap : EAP TTLS (21) (2) eap : Calling eap_ttls to process EAP data (2) eap_ttls : Authenticate (2) eap_ttls : processing EAP-TLS (2) eap_ttls : eaptls_verify returned 7 (2) eap_ttls : Done initial handshake (2) eap_ttls : (other): before/accept initialization (2) eap_ttls : TLS_accept: before/accept initialization (2) eap_ttls : <<< TLS 1.0 Handshake [length 00f0], ClientHello (2) eap_ttls : TLS_accept: SSLv3 read client hello A (2) eap_ttls : >>> TLS 1.0 Handshake [length 005e], ServerHello (2) eap_ttls : TLS_accept: SSLv3 write server hello A (2) eap_ttls : >>> TLS 1.0 Handshake [length 0919], Certificate (2) eap_ttls : TLS_accept: SSLv3 write certificate A (2) eap_ttls : >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange (2) eap_ttls : TLS_accept: SSLv3 write key exchange A (2) eap_ttls : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (2) eap_ttls : TLS_accept: SSLv3 write server done A (2) eap_ttls : TLS_accept: SSLv3 flush data (2) eap_ttls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (2) eap_ttls : eaptls_process returned 13 (2) eap : New EAP session, adding 'State' attribute to reply 0x50d301f2528c14e4 (2) [eap] = handled (2) } # authenticate = handled Sending Access-Challenge Id 71 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x015f03ec15c000000ada160301005e0200005a030155db9f584db34533da4fee646fb40168204255dcf2fa3ed4953b699db4776a7d209016094a0dd1b7a76e0e05e547fa1af2e5d1de4a0360ef30daaa052a58d60a2fc014000012ff01000100000b000403000102000f00010116030109190b0009150009120003fd308203f9308202e1a00302010202021004300d06092a864886f70d01010505003081a1310b3009060355040613025553310b30090603550408130257413111300f060355040713084665726e64616c6531223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303332343139303335385a170d3238313133303139303335385a30818b310b3009060355040613025553310b300906035504081302574131223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d30820122300d06092 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f2528c14e49f3c072d4998f54e (2) Finished request Waking up in 0.3 seconds. Received Access-Request Id 72 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x025f00061500 State = 0x50d301f2528c14e49f3c072d4998f54e Message-Authenticator = 0x0d0c97b08ee84812e23243f4490db586 (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3) authorize { (3) filter_username filter_username { (3) if (User-Name != "%{tolower:%{User-Name}}") (3) EXPAND %{tolower:%{User-Name}} (3) --> testuser (3) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (3) if (User-Name =~ / /) (3) if (User-Name =~ / /) -> FALSE (3) if (User-Name =~ /@.*@/ ) (3) if (User-Name =~ /@.*@/ ) -> FALSE (3) if (User-Name =~ /\\.\\./ ) (3) if (User-Name =~ /\\.\\./ ) -> FALSE (3) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (3) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (3) if (User-Name =~ /\\.$/) (3) if (User-Name =~ /\\.$/) -> FALSE (3) if (User-Name =~ /(a)\\./) (3) if (User-Name =~ /(a)\\./) -> FALSE (3) } # filter_username filter_username = notfound (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : No '@' in User-Name = "testuser", looking up realm NULL (3) suffix : No such realm "NULL" (3) [suffix] = noop (3) eap : EAP packet type response id 95 length 6 (3) eap : Continuing tunnel setup. (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/raddb/sites-enabled/default (3) authenticate { (3) eap : Expiring EAP session with state 0x50d301f2528c14e4 (3) eap : Finished EAP session with state 0x50d301f2528c14e4 (3) eap : Previous EAP request found for state 0x50d301f2528c14e4, released from the list (3) eap : Peer sent TTLS (21) (3) eap : EAP TTLS (21) (3) eap : Calling eap_ttls to process EAP data (3) eap_ttls : Authenticate (3) eap_ttls : processing EAP-TLS (3) eap_ttls : Received TLS ACK (3) eap_ttls : Received TLS ACK (3) eap_ttls : ACK handshake fragment handler (3) eap_ttls : eaptls_verify returned 1 (3) eap_ttls : eaptls_process returned 13 (3) eap : New EAP session, adding 'State' attribute to reply 0x50d301f253b314e4 (3) [eap] = handled (3) } # authenticate = handled Sending Access-Challenge Id 72 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x016003ec15c000000ada0bb6c0da3a6f7818873f0279d606e0aeb56f2c2fff8928c6c5eef941db3bc116bbefb9eaa41733c0aa19ab2d764b47e75056a665144fbb09951b20559e50ad910303fd0f3c1eae82526b96e604e51e0e78c5b93b85044d1f27ef07b017dd151e74a778d28c73caa95dee831fc8fa6c02c98d0d8606d2f2a72e7aa15715a710ef07e3e73c76c87c5a5ddee6427a00050f3082050b308203f3a003020102020900a2f025aae13c9c30300d06092a864886f70d01010505003081a1310b3009060355040613025553310b30090603550408130257413111300f060355040713084665726e64616c6531223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3135303332343139303335385a170d3238313133303139303335385a3081a1310b3009060355040613025553310b30090603550408130257413111300f060355040713084665726e64616c6531223020060355040a131943616e64656c6120546563686e6f6c6f6769657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e646 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f253b314e49f3c072d4998f54e (3) Finished request Waking up in 0.3 seconds. Received Access-Request Id 73 from 127.0.0.1:35433 to 127.0.0.1:1812 length 210 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x026000061500 State = 0x50d301f253b314e49f3c072d4998f54e Message-Authenticator = 0x908f1679efeb92e028fc30a7dcb9b7ba (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4) authorize { (4) filter_username filter_username { (4) if (User-Name != "%{tolower:%{User-Name}}") (4) EXPAND %{tolower:%{User-Name}} (4) --> testuser (4) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (4) if (User-Name =~ / /) (4) if (User-Name =~ / /) -> FALSE (4) if (User-Name =~ /@.*@/ ) (4) if (User-Name =~ /@.*@/ ) -> FALSE (4) if (User-Name =~ /\\.\\./ ) (4) if (User-Name =~ /\\.\\./ ) -> FALSE (4) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (4) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (4) if (User-Name =~ /\\.$/) (4) if (User-Name =~ /\\.$/) -> FALSE (4) if (User-Name =~ /(a)\\./) (4) if (User-Name =~ /(a)\\./) -> FALSE (4) } # filter_username filter_username = notfound (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : No '@' in User-Name = "testuser", looking up realm NULL (4) suffix : No such realm "NULL" (4) [suffix] = noop (4) eap : EAP packet type response id 96 length 6 (4) eap : Continuing tunnel setup. (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/raddb/sites-enabled/default (4) authenticate { (4) eap : Expiring EAP session with state 0x50d301f253b314e4 (4) eap : Finished EAP session with state 0x50d301f253b314e4 (4) eap : Previous EAP request found for state 0x50d301f253b314e4, released from the list (4) eap : Peer sent TTLS (21) (4) eap : EAP TTLS (21) (4) eap : Calling eap_ttls to process EAP data (4) eap_ttls : Authenticate (4) eap_ttls : processing EAP-TLS (4) eap_ttls : Received TLS ACK (4) eap_ttls : Received TLS ACK (4) eap_ttls : ACK handshake fragment handler (4) eap_ttls : eaptls_verify returned 1 (4) eap_ttls : eaptls_process returned 13 (4) eap : New EAP session, adding 'State' attribute to reply 0x50d301f254b214e4 (4) [eap] = handled (4) } # authenticate = handled Sending Access-Challenge Id 73 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x01610320158000000ada69657320496e632e3126302406092a864886f70d0109011617737570706f72744063616e64656c61746563682e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900a2f025aae13c9c30300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010080f321d1943c002ab4437a720d11daec43be07fdd539a7a17ab1841578cb5c19382dfe5ddb526c247f057b0d6486f23336d7465d4f5bdbc1338c97ad3a4b39b7917a091ed5c8c5c9c16bf0eda8087251516e44a62cf70d7be0c2ab4a8e415e5b03e40d28e40a3d2ddb4e96affa65080ae19fea6a3f9fb6a7daf4a6b43cb901fc7f1446099a5fc80c530839222f948eab2c070e76e34f15e29abdd9f58bf6a84d3493137c3b9cce7f587bc4b32d9e17c587fc2fa0d73965277a12f9858557d303adbc2b59d566989bcfa43dafa87e5bab4d2ff5aa1755f65658bf4c35aec45b9b852dac4f89d7ad5038e4cd12c34b1d0da5e01f4f3b20626b81a1701adc84393e160301014b0c0001470300174104fbf2d53615bc5c819ef155d1dfa5071da42b39e57fd34ec2646ddf46a2dfeb45208 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f254b214e49f3c072d4998f54e (4) Finished request Waking up in 0.3 seconds. Received Access-Request Id 74 from 127.0.0.1:35433 to 127.0.0.1:1812 length 344 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x0261008c1500160301004610000042410423e3dfe2477a63232b6e4fccf08158a5924191052d1a251f00c953ebbc3523599aa6f86a24ce4193484477c0090530017619efcfc52af399d120d9b74d1be5821403010001011603010030d112d500999066dba189d981474584fc8bfa41a8840b2470a0ae3ce511b8f008c0cb43fe1b296f26781f3cde714b03f9 State = 0x50d301f254b214e49f3c072d4998f54e Message-Authenticator = 0x825ea105175bc59e94ff872a81b99d10 (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) if (User-Name != "%{tolower:%{User-Name}}") (5) EXPAND %{tolower:%{User-Name}} (5) --> testuser (5) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (5) if (User-Name =~ / /) (5) if (User-Name =~ / /) -> FALSE (5) if (User-Name =~ /@.*@/ ) (5) if (User-Name =~ /@.*@/ ) -> FALSE (5) if (User-Name =~ /\\.\\./ ) (5) if (User-Name =~ /\\.\\./ ) -> FALSE (5) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (5) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (5) if (User-Name =~ /\\.$/) (5) if (User-Name =~ /\\.$/) -> FALSE (5) if (User-Name =~ /(a)\\./) (5) if (User-Name =~ /(a)\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : No '@' in User-Name = "testuser", looking up realm NULL (5) suffix : No such realm "NULL" (5) [suffix] = noop (5) eap : EAP packet type response id 97 length 140 (5) eap : Continuing tunnel setup. (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0x50d301f254b214e4 (5) eap : Finished EAP session with state 0x50d301f254b214e4 (5) eap : Previous EAP request found for state 0x50d301f254b214e4, released from the list (5) eap : Peer sent TTLS (21) (5) eap : EAP TTLS (21) (5) eap : Calling eap_ttls to process EAP data (5) eap_ttls : Authenticate (5) eap_ttls : processing EAP-TLS (5) eap_ttls : eaptls_verify returned 7 (5) eap_ttls : Done initial handshake (5) eap_ttls : <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange (5) eap_ttls : TLS_accept: SSLv3 read client key exchange A (5) eap_ttls : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_ttls : <<< TLS 1.0 Handshake [length 0010], Finished (5) eap_ttls : TLS_accept: SSLv3 read finished A (5) eap_ttls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_ttls : TLS_accept: SSLv3 write change cipher spec A (5) eap_ttls : >>> TLS 1.0 Handshake [length 0010], Finished (5) eap_ttls : TLS_accept: SSLv3 write finished A (5) eap_ttls : TLS_accept: SSLv3 flush data SSL: adding session 9016094a0dd1b7a76e0e05e547fa1af2e5d1de4a0360ef30daaa052a58d60a2f to cache (5) eap_ttls : (other): SSL negotiation finished successfully SSL Connection Established (5) eap_ttls : eaptls_process returned 13 (5) eap : New EAP session, adding 'State' attribute to reply 0x50d301f255b114e4 (5) [eap] = handled (5) } # authenticate = handled Sending Access-Challenge Id 74 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0162004515800000003b14030100010116030100302d049a98a8f080fea5ed9220f940a8ee70324e43ed9e93d80f6decc9c0e32c1ac82222b1b19e56f79eeb753cdc90513f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f255b114e49f3c072d4998f54e (5) Finished request Waking up in 0.3 seconds. Received Access-Request Id 75 from 127.0.0.1:35433 to 127.0.0.1:1812 length 300 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x02620060150017030100207ea8b262a94e87b5234baae2960c2d8facdc610d567f3bab979a0f3c8a7077121703010030a7e47e5b30b3a97a92fba6aacfe6533fee5f3dc6b8fe386160c71b022a3fb6184edb679f240fb32ee8e6580fb82d71da State = 0x50d301f255b114e49f3c072d4998f54e Message-Authenticator = 0x7113dafe2b68a99d6e9d20b902c5688e (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) if (User-Name != "%{tolower:%{User-Name}}") (6) EXPAND %{tolower:%{User-Name}} (6) --> testuser (6) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (6) if (User-Name =~ / /) (6) if (User-Name =~ / /) -> FALSE (6) if (User-Name =~ /@.*@/ ) (6) if (User-Name =~ /@.*@/ ) -> FALSE (6) if (User-Name =~ /\\.\\./ ) (6) if (User-Name =~ /\\.\\./ ) -> FALSE (6) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (6) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (6) if (User-Name =~ /\\.$/) (6) if (User-Name =~ /\\.$/) -> FALSE (6) if (User-Name =~ /(a)\\./) (6) if (User-Name =~ /(a)\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : No '@' in User-Name = "testuser", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) eap : EAP packet type response id 98 length 96 (6) eap : Continuing tunnel setup. (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/default (6) authenticate { (6) eap : Expiring EAP session with state 0x50d301f255b114e4 (6) eap : Finished EAP session with state 0x50d301f255b114e4 (6) eap : Previous EAP request found for state 0x50d301f255b114e4, released from the list (6) eap : Peer sent TTLS (21) (6) eap : EAP TTLS (21) (6) eap : Calling eap_ttls to process EAP data (6) eap_ttls : Authenticate (6) eap_ttls : processing EAP-TLS (6) eap_ttls : eaptls_verify returned 7 (6) eap_ttls : Done initial handshake (6) eap_ttls : eaptls_process returned 7 (6) eap_ttls : Session established. Proceeding to decode tunneled attributes. (6) eap_ttls : Got tunneled request EAP-Message = 0x0200000d017465737475736572 (6) eap_ttls : Got tunneled identity of testuser (6) eap_ttls : Setting default EAP type for tunneled EAP session. (6) eap_ttls : Sending tunneled request EAP-Message = 0x0200000d017465737475736572 User-Name = 'testuser' server inner-tunnel { (6) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) [chap] = noop (6) [mschap] = noop (6) suffix : No '@' in User-Name = "testuser", looking up realm NULL (6) suffix : No such realm "NULL" (6) [suffix] = noop (6) update control { (6) Proxy-To-Realm := 'LOCAL' (6) } # update control = noop (6) eap : EAP packet type response id 0 length 13 (6) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6) authenticate { (6) eap : Peer sent Identity (1) (6) eap : Calling eap_md5 to process EAP data (6) eap_md5 : Issuing MD5 Challenge (6) eap : New EAP session, adding 'State' attribute to reply 0xc301a575c300a1f9 (6) [eap] = handled (6) } # authenticate = handled } # server inner-tunnel (6) eap_ttls : Got tunneled reply code 11 EAP-Message = 0x0101001604105792cb508a0c0a2fbb7a527d155230a6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc301a575c300a1f9b738300baef24065 (6) eap_ttls : Got tunneled Access-Challenge (6) eap : New EAP session, adding 'State' attribute to reply 0x50d301f256b014e4 (6) [eap] = handled (6) } # authenticate = handled Sending Access-Challenge Id 75 from 127.0.0.1:1812 to 127.0.0.1:35433 EAP-Message = 0x0163004f1580000000451703010040e1174a3efa0dd5a00aa5494cd878f1949acb9e63883254544b7072953d48be56d929b37cfc30840b827e99b545e44151eb9fd27e871170152c16068221086f90 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x50d301f256b014e49f3c072d4998f54e (6) Finished request Waking up in 0.3 seconds. Received Access-Request Id 76 from 127.0.0.1:35433 to 127.0.0.1:1812 length 316 User-Name = 'testuser' NAS-IP-Address = 127.0.0.1 Called-Station-Id = '04-F0-21-17-94-44:ac-vap-ch149' NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = '04-F0-21-E7-56-41' Connect-Info = 'CONNECT 54Mbps 802.11a' Acct-Session-Id = '55DB92D7-00000007' X-Ascend-Home-Agent-UDP-Port = 1027076 X-Ascend-Multilink-ID = 1027074 X-Ascend-Num-In-Multilink = 1027073 Framed-MTU = 1400 EAP-Message = 0x0263007015001703010020e06ee46476e095c41e67b99cebf1e4247fec25b3ecd26c9c3861e69cd3aeb51317030100409e6b93afcaa0cc118fdc9f334fb4330860da522423d57eceb4e6c844ec9ef16a7e4cff2b6493fbc3ee8e18bed186c1c1353ef86b9909e09a74b3a8c7191306bd State = 0x50d301f256b014e49f3c072d4998f54e Message-Authenticator = 0xfa22560254781849b5ec116212e464a4 (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7) authorize { (7) filter_username filter_username { (7) if (User-Name != "%{tolower:%{User-Name}}") (7) EXPAND %{tolower:%{User-Name}} (7) --> testuser (7) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (7) if (User-Name =~ / /) (7) if (User-Name =~ / /) -> FALSE (7) if (User-Name =~ /@.*@/ ) (7) if (User-Name =~ /@.*@/ ) -> FALSE (7) if (User-Name =~ /\\.\\./ ) (7) if (User-Name =~ /\\.\\./ ) -> FALSE (7) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (7) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (7) if (User-Name =~ /\\.$/) (7) if (User-Name =~ /\\.$/) -> FALSE (7) if (User-Name =~ /(a)\\./) (7) if (User-Name =~ /(a)\\./) -> FALSE (7) } # filter_username filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix : No '@' in User-Name = "testuser", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) eap : EAP packet type response id 99 length 112 (7) eap : Continuing tunnel setup. (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/default (7) authenticate { (7) eap : Expiring EAP session with state 0xc301a575c300a1f9 (7) eap : Finished EAP session with state 0x50d301f256b014e4 (7) eap : Previous EAP request found for state 0x50d301f256b014e4, released from the list (7) eap : Peer sent TTLS (21) (7) eap : EAP TTLS (21) (7) eap : Calling eap_ttls to process EAP data (7) eap_ttls : Authenticate (7) eap_ttls : processing EAP-TLS (7) eap_ttls : eaptls_verify returned 7 (7) eap_ttls : Done initial handshake (7) eap_ttls : eaptls_process returned 7 (7) eap_ttls : Session established. Proceeding to decode tunneled attributes. (7) eap_ttls : Got tunneled request EAP-Message = 0x020100160410ba01eba69294cd1d8c7a8e6d35630693 (7) eap_ttls : Sending tunneled request EAP-Message = 0x020100160410ba01eba69294cd1d8c7a8e6d35630693 User-Name = 'testuser' State = 0xc301a575c300a1f9b738300baef24065 server inner-tunnel { (7) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7) authorize { (7) [chap] = noop (7) [mschap] = noop (7) suffix : No '@' in User-Name = "testuser", looking up realm NULL (7) suffix : No such realm "NULL" (7) [suffix] = noop (7) update control { (7) Proxy-To-Realm := 'LOCAL' (7) } # update control = noop (7) eap : EAP packet type response id 1 length 22 (7) eap : No EAP Start, assuming it's an on-going EAP conversation (7) [eap] = updated (7) files : users: Matched entry testuser at line 6 (7) [files] = ok (7) [expiration] = noop (7) [logintime] = noop (7) WARNING: pap : Auth-Type already set. Not setting to PAP (7) [pap] = noop (7) } # authorize = updated (7) Found Auth-Type = EAP (7) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) authenticate { (7) eap : Expiring EAP session with state 0xc301a575c300a1f9 (7) eap : Finished EAP session with state 0xc301a575c300a1f9 (7) eap : Previous EAP request found for state 0xc301a575c300a1f9, released from the list (7) eap : Peer sent MD5 (4) (7) eap : EAP MD5 (4) (7) eap : Calling eap_md5 to process EAP data (7) eap : Freeing handler (7) [eap] = ok (7) } # authenticate = ok (7) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (7) (null) post-auth { ... } # empty sub-section is ignored } # server inner-tunnel (7) eap_ttls : Got tunneled reply code 2 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'testuser' (7) eap_ttls : Got tunneled Access-Accept (7) WARNING: eap_ttls : No information to cache: session caching will be disabled for session 9016094a0dd1b7a76e0e05e547fa1af2e5d1de4a0360ef30daaa052a58d60a2f SSL: Removing session 9016094a0dd1b7a76e0e05e547fa1af2e5d1de4a0360ef30daaa052a58d60a2f from the cache (7) eap : Freeing handler rlm_eap_ttls: Freeing handler for user testuser (7) [eap] = ok (7) } # authenticate = ok (7) # Executing section post-auth from file /etc/raddb/sites-enabled/default (7) post-auth { (7) [exec] = noop (7) remove_reply_message_if_eap remove_reply_message_if_eap { (7) if (reply:EAP-Message && reply:Reply-Message) (7) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (7) else else { (7) [noop] = noop (7) } # else else = noop (7) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (7) } # post-auth = noop Sending Access-Accept Id 76 from 127.0.0.1:1812 to 127.0.0.1:35433 MS-MPPE-Recv-Key = 0x4a4d9dfb87504956f93d37026a663aef7e83282c328bfcf16d830d6410f47dd9 MS-MPPE-Send-Key = 0x652c8825bf925a95a7c7776c3bc73dd67f8387c570977550015dea4a6d6c23ad EAP-Message = 0x03630004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = 'testuser' (7) Finished request Waking up in 0.3 seconds. Waking up in 4.6 seconds.

4 8

Re: EAP-sim using freeradius
by Matthew Newton 25 Aug '15

25 Aug '15

On Tue, Aug 25, 2015 at 04:26:38PM -0700, Siddharth Katragadda wrote: > With the noop change, I get: > > 145) [passwd] = ok > (145) if ("%{escape:%{control:EAP-Sim-Rand1}}"=="h"){ > (145) EXPAND %{escape:%{control:EAP-Sim-Rand1}} > (145) --> So it expanded to nothing. > (145) if ("%{escape:%{control:EAP-Sim-Rand1}}"=="h") -> FALSE > (145) eap: Peer sent EAP Response (code 2) ID 2 length 6 > > Does this mean passwd is not saving the values properly after reading them > from simtriplets.dat? Or you're reading the wrong file, or something else simple like that. There's been no significant code changes in rlm_passwd between 3.0.9 and HEAD, so if it works here then you must have something wrong in your config. And I used the config you posted verbatim, so it's probably something very obscure, or more likely blindingly simple. Start with a completely clean install. Just set up rlm_passwd to read the file, no need for eap or anything else like that. Send in a request, and see if it gets EAP-Sim-Rand1 as expected with the above expansion. That's what I had here. If so then you've got something wrong in your config, so start diffing to work out what. If the simple config doesn't work as expected, post the *whole* debug output to the list, rather than small bits of it, which leaves everyone guessing and is incredibly annoying. Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0

freeradius 3.x - proxy realm - problem to strip username
by ERIC TANGUY 25 Aug '15

25 Aug '15

Hello I use freeradius 3.0.9 , PAM module and RSA server (strong authenticator server) I have a user with a realm (user_realm), with the proxy function and the PAM module on my radius server, I want to forward the request on my RSA server. I have a problem because the incoming user on my RSA server is user_realm and not user only As belong my config - radiusd.conf original config with adding proxy_requests = yes $INCLUDE proxy.conf - proxy.conf original config with adding realm rsa { authhost = LOCAL accthost = LOCAL } - sites-enabled/default original config with adding authorize { .... underscore arobase .... } authenticate { .... Auth-Type PAMRSA { pam-rsa } ... } preacct { .... underscore arobase .. } - mods-enabled/pam pam pam-rsa{ pam_auth = rsasecurid } - mods-enabled/realm realm underscore { format = suffix delimiter = "_" } realm arobase { format = suffix delimiter = "@" } My error radius.log (0) Received Access-Request Id 124 from h.j.k.l:35867 to v.w.x.y :1812 length 115 (0) User-Name = " user_rsa " (0) User-Password = "xxxxx" (0) NAS-Port = 1 (0) NAS-Port-Id = "tty1" (0) NAS-Port-Type = Virtual (0) Calling-Station-Id = "a.b.c.d" (0) NAS-IP-Address = e.f.g.h (0) Event-Timestamp = "Aug 20 2015 17:34:04 CEST" (0) Message-Authenticator = 0xc1a0732bc8b62562111e7479ca859ee0 (0) Proxy-State = 0x313339 (0) # Executing section authorize from file /opt/freeradius-3.0.9/etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = " user_rsa ", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: No EAP-Message, not doing EAP (0) [eap] = noop (0) [files] = noop (0) sql1: EXPAND %{User-Name} (0) sql1: --> user_rsa (0) sql1: SQL-User-Name set to 'a0327_rsa' rlm_sql (sql1): Reserved connection (1) (0) sql1: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql1: --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' user_rsa ' ORDER BY id (0) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' user_rsa ' ORDER BY id (0) sql1: User found in radcheck table (0) sql1: Conditional check items matched, merging assignment check items (0) sql1: Expiration := "Dec 30 2035 00:00:00 CET" (0) sql1: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id (0) sql1: --> SELECT id, username, attribute, value, op FROM radreply WHERE username = ' user_rsa ' ORDER BY id (0) sql1: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = ' user_rsa ' ORDER BY id (0) sql1: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority (0) sql1: --> SELECT groupname FROM radusergroup WHERE username = ' user_rsa ' ORDER BY priority (0) sql1: Executing select query: SELECT groupname FROM radusergroup WHERE username = ' user_rsa ' ORDER BY priority (0) sql1: User found in the group table (0) sql1: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id (0) sql1: --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Rebontux_RSA' ORDER BY id (0) sql1: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Rebontux_RSA' ORDER BY id (0) sql1: Group "Rebontux_RSA": Conditional check items matched (0) sql1: Group "Rebontux_RSA": Merging assignment check items (0) sql1: Auth-Type := PAMRSA (0) sql1: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{sql1-SQL-Group}' ORDER BY id (0) sql1: --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Rebontux_RSA' ORDER BY id (0) sql1: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Rebontux_RSA' ORDER BY id (0) sql1: Group "Rebontux_RSA": Merging reply items (0) sql1: Service-Type = Authenticate-Only rlm_sql (sql1): Released connection (1) rlm_sql (sql1): 0 of 6 connections in use. Need more spares rlm_sql (sql1): Opening additional connection (6), 1 of 26 pending slots used rlm_sql_mysql: Starting connect to MySQL server rlm_sql_mysql: Connected to database 'radius' on radiustux1-a.l.infra via TCP/IP, server version 5.6.24-enterprise-commercial-advanced-log, protocol version 10 (0) [sql1] = ok (0) expiration: Account will expire at 'Dec 30 2035 00:00:00 CET' (0) [expiration] = ok (0) [logintime] = noop (0) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (0) pap: WARNING: Authentication will fail unless a "known good" password is available (0) [pap] = noop (0) } # authorize = ok (0) Found Auth-Type = PAMRSA (0) # Executing group from file /opt/freeradius-3.0.9/etc/raddb/sites-enabled/default (0) Auth-Type PAMRSA { (0) pam-rsa: Using pamauth string "rsasecurid" for pam.conf lookup (0) pam-rsa: ERROR: pam_authenticate failed: Authentication failure (0) [pam-rsa] = reject (0) } # Auth-Type PAMRSA = reject (0) Failed to authenticate the user (0) Login incorrect (pam-rsa: pam_authenticate failed: Authentication failure): [ user_rsa ] (0) Using Post-Auth-Type Reject My error rsa.log unknow user ' user_rsa ' - -- Eric TANGUY Réseaux et Infrastructures Informatique DTI 1, rue Louis Lichou 29480 Le Relecq-Kerhuon www.arkea.com T. +33(0)298003671 -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

3 2

Odd issue with EAP-TTLS... Tunneled challenge invalid?
by Stefan Paetow 25 Aug '15

25 Aug '15

Hi, One of our sites has run into an issue where they are trying to connect to their server with EAP-TTLS. They've used rad_eap_test on the same machine just to test the connection locally and this is the output log. I'm stumped... I've never seen this error before. Any suggestions will be most appreciated! :-) -- debug log follows -- freeradius -fxx -l stdout Copyright (C) 1999-2015 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/dictionary including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/dhcp including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/utf8 including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/eap including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/cache_eap including configuration file /etc/freeradius/mods-enabled/unpack including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/linelog including files in directory /etc/freeradius/policy.d/ including configuration file /etc/freeradius/policy.d/debug including configuration file /etc/freeradius/policy.d/canonicalization including configuration file /etc/freeradius/policy.d/abfab-tr including configuration file /etc/freeradius/policy.d/dhcp including configuration file /etc/freeradius/policy.d/cui including configuration file /etc/freeradius/policy.d/control including configuration file /etc/freeradius/policy.d/eap including configuration file /etc/freeradius/policy.d/filter including configuration file /etc/freeradius/policy.d/operator-name including configuration file /etc/freeradius/policy.d/accounting including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/abfab-tls including configuration file /etc/freeradius/sites-enabled/abfab-tr-idp including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/channel_bindings main { security { user = "freerad" group = "freerad" allow_core_dumps = no } } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dynamic = yes dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } realm muj.prostor { } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = digest radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_realm # Instantiating module "IPASS" from file /etc/freeradius/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no default_community = "none" rp_realm = "none" trust_router = "none" tr_port = 0 } Warning: dh_check failed with 8 : the g value is not a generator # Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no default_community = "apc.moonshot.ja.net" rp_realm = "painless-security.com" trust_router = "localhost" tr_port = 0 } # Instantiating module "realmpercent" from file /etc/freeradius/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no default_community = "none" rp_realm = "none" trust_router = "none" tr_port = 0 } # Instantiating module "ntdomain" from file /etc/freeradius/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no default_community = "none" rp_realm = "none" trust_router = "none" tr_port = 0 } # Loaded module rlm_chap # Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" hints = "/etc/freeradius/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/mods-config/preprocess/huntgroups reading pairlist file /etc/freeradius/mods-config/preprocess/hints # Loaded module rlm_expr # Instantiating module "expr" from file /etc/freeradius/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_expiration # Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration # Loaded module rlm_soh # Instantiating module "soh" from file /etc/freeradius/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_pap # Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap pap { normalise = yes } # Loaded module rlm_exec # Instantiating module "ntlm_auth" from file /etc/freeradius/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /etc/freeradius/mods-enabled/dhcp # Loaded module rlm_digest # Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest # Loaded module rlm_utf8 # Instantiating module "utf8" from file /etc/freeradius/mods-enabled/utf8 # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/mods-config/attr_filter/accounting_response # Loaded module rlm_unix # Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } # Loaded module rlm_radutmp # Instantiating module "sradutmp" from file /etc/freeradius/mods-enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_eap # Instantiating module "eap" from file /etc/freeradius/mods-enabled/eap eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 1024 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_mschap # Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_detail # Instantiating module "auth_log" from file /etc/freeradius/mods-enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/mods-enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /etc/freeradius/mods-enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_logintime # Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { minimum_timeout = 60 } # Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_always # Instantiating module "reject" from file /etc/freeradius/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "fail" from file /etc/freeradius/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "ok" from file /etc/freeradius/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Instantiating module "handled" from file /etc/freeradius/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "invalid" from file /etc/freeradius/mods-enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Instantiating module "userlock" from file /etc/freeradius/mods-enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /etc/freeradius/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "noop" from file /etc/freeradius/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "updated" from file /etc/freeradius/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /etc/freeradius/mods-enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Loaded module rlm_unpack # Instantiating module "unpack" from file /etc/freeradius/mods-enabled/unpack # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /etc/freeradius/mods-enabled/dynamic_clients # Loaded module rlm_replicate # Instantiating module "replicate" from file /etc/freeradius/mods-enabled/replicate # Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Instantiating module "echo" from file /etc/freeradius/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loaded module rlm_files # Instantiating module "files" from file /etc/freeradius/mods-enabled/files files { filename = "/etc/freeradius/mods-config/files/authorize" usersfile = "/etc/freeradius/mods-config/files/authorize" acctusersfile = "/etc/freeradius/mods-config/files/accounting" preproxy_usersfile = "/etc/freeradius/mods-config/files/pre-proxy" compat = "cistron" } reading pairlist file /etc/freeradius/mods-config/files/authorize [/etc/freeradius/mods-config/files/authorize]:1 Cistron compatibility checks for entry testuser ... [/etc/freeradius/mods-config/files/authorize]:184 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/freeradius/mods-config/files/authorize [/etc/freeradius/mods-config/files/authorize]:1 Cistron compatibility checks for entry testuser ... [/etc/freeradius/mods-config/files/authorize]:184 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ... [/etc/freeradius/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ... reading pairlist file /etc/freeradius/mods-config/files/accounting reading pairlist file /etc/freeradius/mods-config/files/pre-proxy # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /etc/freeradius/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_linelog # Instantiating module "linelog" from file /etc/freeradius/mods-enabled/linelog linelog { filename = "/var/log/freeradius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{Packet-Type}:-default}" } # Instantiating module "log_accounting" from file /etc/freeradius/mods-enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf } # server server abfab-idp { # from file /etc/freeradius/sites-enabled/abfab-tr-idp # Loading authenticate {...} # Loading authorize {...} # Loading post-proxy {...} # Loading post-auth {...} Ignoring "sql" (see raddb/mods-available/README.rst) } # server abfab-idp server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} } # server inner-tunnel server default { # from file /etc/freeradius/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default server channel_bindings { # from file /etc/freeradius/sites-enabled/channel_bindings # Loading authorize {...} } # server channel_bindings /etc/freeradius/policy.d/abfab-tr[29] Please change %{gss-acceptor-host-name}} to &gss-acceptor-host-name} thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 cleanup_delay = 5 max_queue_size = 65536 auto_limit_acct = no } Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" virtual_server = "abfab-idp" ipaddr = * port = 2083 proto = "tcp" tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" ca_file = "/etc/freeradius/certs/ca.pem" private_key_password = <<< secret >>> psk_query = "%{psksql:select hex(key) from psk_keys where keyid = '%{TLS-PSK-Identity}'}" dh_file = "/etc/freeradius/certs/dh" fragment_size = 8192 include_length = yes check_crl = no cipher_list = "DEFAULT" require_client_cert = yes ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } Thread 5 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request clients = "radsec-abfab" client default { ipaddr = 0.0.0.0/0 require_message_authenticator = no proto = "tls" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth proto tcp address * port 2083 (TLS) bound to server abfab-idp Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 37846 Ready to process requests Threads: total/active/spare threads = 5/0/5 Waking up in 0.3 seconds. Thread 5 got semaphore Thread 5 handling request 0, (1 handled so far) (0) Received Access-Request Id 0 from 127.0.0.1:56718 to 127.0.0.1:1812 length 151 (0) User-Name = 'testuser(a)muj.prostor' (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = '70-6F-6C-69-73-68' (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = 'rad_eap_test + eapol_test' (0) EAP-Message = 0x02000019017465737475736572406d756a2e70726f73746f72 (0) Message-Authenticator = 0xed71a7d4f2b5822548f6f2f3a6a5d07e (0) # Executing section authorize from file /etc/freeradius/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (!&User-Name) { (0) if (!&User-Name) -> FALSE (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@.*@/ ) { (0) if (&User-Name =~ /@.*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /(a)\./) { (0) if (&User-Name =~ /(a)\./) -> FALSE (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: Looking up realm "muj.prostor" for User-Name = "testuser(a)muj.prostor" (0) suffix: Found realm "muj.prostor" (0) suffix: Adding Stripped-User-Name = "testuser" (0) suffix: Adding Realm = "muj.prostor" (0) suffix: Authentication realm is LOCAL (0) [suffix] = ok (0) eap: Peer sent code Response (2) ID 0 length 25 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) authenticate { (0) eap: Peer sent method Identity (1) (0) eap: Calling eap_ttls to process EAP data (0) eap_ttls: Flushing SSL sessions (of #0) (0) eap_ttls: Initiate (0) eap_ttls: Start returned 1 (0) eap: EAP session adding &reply:State = 0x46d103e846d0160f (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/sites-enabled/default (0) Sent Access-Challenge Id 0 from 127.0.0.1:1812 to 127.0.0.1:56718 length 64 (0) EAP-Message = 0x010100061520 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x46d103e846d0160f61e71b3cd5f9b6f6 (0) Finished request Thread 5 waiting to be assigned a request Waking up in 0.3 seconds. Thread 4 got semaphore Thread 4 handling request 1, (1 handled so far) (1) Received Access-Request Id 1 from 127.0.0.1:56718 to 127.0.0.1:1812 length 439 (1) User-Name = 'testuser(a)muj.prostor' (1) NAS-IP-Address = 127.0.0.1 (1) Calling-Station-Id = '70-6F-6C-69-73-68' (1) Framed-MTU = 1400 (1) NAS-Port-Type = Wireless-802.11 (1) Connect-Info = 'rad_eap_test + eapol_test' (1) EAP-Message = 0x020101251500160301011a01000116030355dc61f58c4c31193cddd93c26520c7eddc459e4e09204c951b419d67933a97b000082c030c02cc028c024c014c00a00a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084c012c00800160013c00dc003000ac02fc02bc0 (1) State = 0x46d103e846d0160f61e71b3cd5f9b6f6 (1) Message-Authenticator = 0xc80ae9487430191ab0f2a75c134138ff (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/sites-enabled/default (1) authorize { (1) policy filter_username { (1) if (!&User-Name) { (1) if (!&User-Name) -> FALSE (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@.*@/ ) { (1) if (&User-Name =~ /@.*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /(a)\./) { (1) if (&User-Name =~ /(a)\./) -> FALSE (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: Looking up realm "muj.prostor" for User-Name = "testuser(a)muj.prostor" (1) suffix: Found realm "muj.prostor" (1) suffix: Adding Stripped-User-Name = "testuser" (1) suffix: Adding Realm = "muj.prostor" (1) suffix: Authentication realm is LOCAL (1) [suffix] = ok (1) eap: Peer sent code Response (2) ID 1 length 293 (1) eap: Continuing tunnel setup (1) [eap] = ok (1) } # authorize = ok (1) Found Auth-Type = EAP (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x46d103e846d0160f (1) eap: Finished EAP session with state 0x46d103e846d0160f (1) eap: Previous EAP request found for state 0x46d103e846d0160f, released from the list (1) eap: Peer sent method TTLS (21) (1) eap: EAP TTLS (21) (1) eap: Calling eap_ttls to process EAP data (1) eap_ttls: Authenticate (1) eap_ttls: processing EAP-TLS (1) eap_ttls: eaptls_verify returned 7 (1) eap_ttls: Done initial handshake (1) eap_ttls: (other): before/accept initialization (1) eap_ttls: TLS_accept: before/accept initialization (1) eap_ttls: <<< Unknown TLS version [length 011a] (1) eap_ttls: TLS_accept: SSLv3 read client hello A (1) eap_ttls: >>> Unknown TLS version [length 005e] (1) eap_ttls: TLS_accept: SSLv3 write server hello A (1) eap_ttls: >>> Unknown TLS version [length 08d0] (1) eap_ttls: TLS_accept: SSLv3 write certificate A (1) eap_ttls: >>> Unknown TLS version [length 014d] (1) eap_ttls: TLS_accept: SSLv3 write key exchange A (1) eap_ttls: >>> Unknown TLS version [length 0004] (1) eap_ttls: TLS_accept: SSLv3 write server done A (1) eap_ttls: TLS_accept: SSLv3 flush data (1) eap_ttls: TLS_accept: Need to read more data: SSLv3 read client certificate A (1) eap_ttls: TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (1) eap_ttls: eaptls_process returned 13 (1) eap: EAP session adding &reply:State = 0x46d103e847d3160f (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/sites-enabled/default (1) Sent Access-Challenge Id 1 from 127.0.0.1:1812 to 127.0.0.1:56718 length 1068 Waking up in 0.3 seconds. Thread 3 got semaphore Thread 3 handling request 2, (1 handled so far) (2) Received Access-Request Id 2 from 127.0.0.1:56718 to 127.0.0.1:1812 length 150 (2) User-Name = 'testuser(a)muj.prostor' (2) NAS-IP-Address = 127.0.0.1 (2) Calling-Station-Id = '70-6F-6C-69-73-68' (2) Framed-MTU = 1400 (2) NAS-Port-Type = Wireless-802.11 (2) Connect-Info = 'rad_eap_test + eapol_test' (2) EAP-Message = 0x020200061500 (2) State = 0x46d103e847d3160f61e71b3cd5f9b6f6 (2) Message-Authenticator = 0x84302ab07957fd907f96539016886952 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/sites-enabled/default (2) authorize { (2) policy filter_username { (2) if (!&User-Name) { (2) if (!&User-Name) -> FALSE (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@.*@/ ) { (2) if (&User-Name =~ /@.*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /(a)\./) { (2) if (&User-Name =~ /(a)\./) -> FALSE (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: Looking up realm "muj.prostor" for User-Name = "testuser(a)muj.prostor" (2) suffix: Found realm "muj.prostor" (2) suffix: Adding Stripped-User-Name = "testuser" (2) suffix: Adding Realm = "muj.prostor" (2) suffix: Authentication realm is LOCAL (2) [suffix] = ok (2) eap: Peer sent code Response (2) ID 2 length 6 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x46d103e847d3160f (2) eap: Finished EAP session with state 0x46d103e847d3160f (2) eap: Previous EAP request found for state 0x46d103e847d3160f, released from the list (2) eap: Peer sent method TTLS (21) (2) eap: EAP TTLS (21) (2) eap: Calling eap_ttls to process EAP data (2) eap_ttls: Authenticate (2) eap_ttls: processing EAP-TLS (2) eap_ttls: Received TLS ACK (2) eap_ttls: Received TLS ACK (2) eap_ttls: ACK handshake fragment handler (2) eap_ttls: eaptls_verify returned 1 (2) eap_ttls: eaptls_process returned 13 (2) eap: EAP session adding &reply:State = 0x46d103e844d2160f (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/sites-enabled/default (2) Sent Access-Challenge Id 2 from 127.0.0.1:1812 to 127.0.0.1:56718 length 1068 (2) EAP-Message = 0x010303ec15c000000a93e2c34c916a4923a0a7cb7d119c2dd6e88d64047881f0345c6a783e137e4ad1b43a5d9ab52cc0c73125f99bfef62dbf29ad4bdd1cf290f17fb81e3561fee9cd6dd01ee4bec7dc5e0a41c8556d075599629772825b591745e91a70039acdd4ea1b08bddefeb11003f1d66b8f4faa (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x46d103e844d2160f61e71b3cd5f9b6f6 (2) Finished request Thread 3 waiting to be assigned a request Waking up in 0.3 seconds. Thread 1 got semaphore Thread 1 handling request 3, (1 handled so far) (3) Received Access-Request Id 3 from 127.0.0.1:56718 to 127.0.0.1:1812 length 150 (3) User-Name = 'testuser(a)muj.prostor' (3) NAS-IP-Address = 127.0.0.1 (3) Calling-Station-Id = '70-6F-6C-69-73-68' (3) Framed-MTU = 1400 (3) NAS-Port-Type = Wireless-802.11 (3) Connect-Info = 'rad_eap_test + eapol_test' (3) EAP-Message = 0x020300061500 (3) State = 0x46d103e844d2160f61e71b3cd5f9b6f6 (3) Message-Authenticator = 0x11e45ebcedd7f01a46e41f4b533fa08e (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/sites-enabled/default (3) authorize { (3) policy filter_username { (3) if (!&User-Name) { (3) if (!&User-Name) -> FALSE (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@.*@/ ) { (3) if (&User-Name =~ /@.*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /(a)\./) { (3) if (&User-Name =~ /(a)\./) -> FALSE (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: Looking up realm "muj.prostor" for User-Name = "testuser(a)muj.prostor" (3) suffix: Found realm "muj.prostor" (3) suffix: Adding Stripped-User-Name = "testuser" (3) suffix: Adding Realm = "muj.prostor" (3) suffix: Authentication realm is LOCAL (3) [suffix] = ok (3) eap: Peer sent code Response (2) ID 3 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x46d103e844d2160f (3) eap: Finished EAP session with state 0x46d103e844d2160f (3) eap: Previous EAP request found for state 0x46d103e844d2160f, released from the list (3) eap: Peer sent method TTLS (21) (3) eap: EAP TTLS (21) (3) eap: Calling eap_ttls to process EAP data (3) eap_ttls: Authenticate (3) eap_ttls: processing EAP-TLS (3) eap_ttls: Received TLS ACK (3) eap_ttls: Received TLS ACK (3) eap_ttls: ACK handshake fragment handler (3) eap_ttls: eaptls_verify returned 1 (3) eap_ttls: eaptls_process returned 13 (3) eap: EAP session adding &reply:State = 0x46d103e845d5160f (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/sites-enabled/default (3) Sent Access-Challenge Id 3 from 127.0.0.1:1812 to 127.0.0.1:56718 length 791 (3) EAP-Message = 0x010402d9158000000a93696361746520417574686f72697479820900aa79031e627d0b9b300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x46d103e845d5160f61e71b3cd5f9b6f6 (3) Finished request Thread 1 waiting to be assigned a request (1) EAP-Message = 0x010203ec15c000000a93160303005e0200005a030355dc61f59ac52305bad83957a2594d506564f4919ded134816948fc39c4652072033a218d505462c178a405e16e5bed8f0817d9f80e78b6093836ce2edb7050e38c030000012ff01000100000b000403000102000f00010116030308d00b0008cc00 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x46d103e847d3160f61e71b3cd5f9b6f6 (1) Finished request Thread 4 waiting to be assigned a request Waking up in 0.3 seconds. Thread 2 got semaphore Thread 2 handling request 4, (1 handled so far) (4) Received Access-Request Id 4 from 127.0.0.1:56718 to 127.0.0.1:1812 length 276 (4) User-Name = 'testuser(a)muj.prostor' (4) NAS-IP-Address = 127.0.0.1 (4) Calling-Station-Id = '70-6F-6C-69-73-68' (4) Framed-MTU = 1400 (4) NAS-Port-Type = Wireless-802.11 (4) Connect-Info = 'rad_eap_test + eapol_test' (4) EAP-Message = 0x020400841500160303004610000042410481a878870091dbc32381894b3e7fba2cb9a93e7b008584396f1cac88db37617f18ba55919a1b9d1015b6029a2eef48a4d927a1db72b840799cc11aee416b97fc14030300010116030300289bb9f986e5ca653f81b6ba7f28e6ee93e19764d9132d5ebcc40fee (4) State = 0x46d103e845d5160f61e71b3cd5f9b6f6 (4) Message-Authenticator = 0x92430f432b19026a1bbeba45a11720f2 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/sites-enabled/default (4) authorize { (4) policy filter_username { (4) if (!&User-Name) { (4) if (!&User-Name) -> FALSE (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@.*@/ ) { (4) if (&User-Name =~ /@.*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /(a)\./) { (4) if (&User-Name =~ /(a)\./) -> FALSE (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: Looking up realm "muj.prostor" for User-Name = "testuser(a)muj.prostor" (4) suffix: Found realm "muj.prostor" (4) suffix: Adding Stripped-User-Name = "testuser" (4) suffix: Adding Realm = "muj.prostor" (4) suffix: Authentication realm is LOCAL (4) [suffix] = ok (4) eap: Peer sent code Response (2) ID 4 length 132 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x46d103e845d5160f (4) eap: Finished EAP session with state 0x46d103e845d5160f (4) eap: Previous EAP request found for state 0x46d103e845d5160f, released from the list (4) eap: Peer sent method TTLS (21) (4) eap: EAP TTLS (21) (4) eap: Calling eap_ttls to process EAP data (4) eap_ttls: Authenticate (4) eap_ttls: processing EAP-TLS (4) eap_ttls: eaptls_verify returned 7 (4) eap_ttls: Done initial handshake (4) eap_ttls: <<< Unknown TLS version [length 0046] (4) eap_ttls: TLS_accept: SSLv3 read client key exchange A (4) eap_ttls: <<< Unknown TLS version [length 0001] (4) eap_ttls: <<< Unknown TLS version [length 0010] (4) eap_ttls: TLS_accept: SSLv3 read finished A (4) eap_ttls: >>> Unknown TLS version [length 0001] (4) eap_ttls: TLS_accept: SSLv3 write change cipher spec A (4) eap_ttls: >>> Unknown TLS version [length 0010] (4) eap_ttls: TLS_accept: SSLv3 write finished A (4) eap_ttls: TLS_accept: SSLv3 flush data SSL: adding session 33a218d505462c178a405e16e5bed8f0817d9f80e78b6093836ce2edb7050e38 to cache (4) eap_ttls: (other): SSL negotiation finished successfully SSL Connection Established (4) eap_ttls: eaptls_process returned 13 (4) eap: EAP session adding &reply:State = 0x46d103e842d4160f (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/sites-enabled/default (4) Sent Access-Challenge Id 4 from 127.0.0.1:1812 to 127.0.0.1:56718 length 119 (4) EAP-Message = 0x0105003d1580000000331403030001011603030028d2f96f0244ac87d5119f22c6ae3674bc26cad6b86e55ba9bcf36306e4fd27a4c435176c40bac962d (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x46d103e842d4160f61e71b3cd5f9b6f6 (4) Finished request Thread 2 waiting to be assigned a request Waking up in 0.3 seconds. Thread 5 got semaphore Thread 5 handling request 5, (2 handled so far) (5) Received Access-Request Id 5 from 127.0.0.1:56718 to 127.0.0.1:1812 length 299 (5) User-Name = 'testuser(a)muj.prostor' (5) NAS-IP-Address = 127.0.0.1 (5) Calling-Station-Id = '70-6F-6C-69-73-68' (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) Connect-Info = 'rad_eap_test + eapol_test' (5) EAP-Message = 0x0205009b150017030300909bb9f986e5ca65406ad6d8a5567e4030dd6799f0d9e62358ccb7757c9dc4e604195a0f82566daf76417338606b1bd876e23263daa71a931ea157e4a1f2d869b4a1c41b135062418f2d930e5f670f351de2b29881ad79287339240d86db4e56e2c1e583df8e12f998e33ebdef (5) State = 0x46d103e842d4160f61e71b3cd5f9b6f6 (5) Message-Authenticator = 0x06a44849163989b16f3b13a91e6847b9 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/sites-enabled/default (5) authorize { (5) policy filter_username { (5) if (!&User-Name) { (5) if (!&User-Name) -> FALSE (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@.*@/ ) { (5) if (&User-Name =~ /@.*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /(a)\./) { (5) if (&User-Name =~ /(a)\./) -> FALSE (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: Looking up realm "muj.prostor" for User-Name = "testuser(a)muj.prostor" (5) suffix: Found realm "muj.prostor" (5) suffix: Adding Stripped-User-Name = "testuser" (5) suffix: Adding Realm = "muj.prostor" (5) suffix: Authentication realm is LOCAL (5) [suffix] = ok (5) eap: Peer sent code Response (2) ID 5 length 155 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x46d103e842d4160f (5) eap: Finished EAP session with state 0x46d103e842d4160f (5) eap: Previous EAP request found for state 0x46d103e842d4160f, released from the list (5) eap: Peer sent method TTLS (21) (5) eap: EAP TTLS (21) (5) eap: Calling eap_ttls to process EAP data (5) eap_ttls: Authenticate (5) eap_ttls: processing EAP-TLS (5) eap_ttls: eaptls_verify returned 7 (5) eap_ttls: Done initial handshake (5) eap_ttls: eaptls_process returned 7 (5) eap_ttls: Session established. Proceeding to decode tunneled attributes (5) eap_ttls: Tunneled challenge is incorrect SSL: Removing session 33a218d505462c178a405e16e5bed8f0817d9f80e78b6093836ce2edb7050e38 from the cache (5) eap: ERROR: Failed continuing EAP TTLS (21) session. EAP sub-module failed (5) eap: Failed in EAP select (5) [eap] = invalid (5) } # authenticate = invalid (5) Failed to authenticate the user (5) Using Post-Auth-Type Reject (5) # Executing group from file /etc/freeradius/sites-enabled/default (5) Post-Auth-Type REJECT { (5) attr_filter.access_reject: EXPAND %{User-Name} (5) attr_filter.access_reject: --> testuser(a)muj.prostor (5) attr_filter.access_reject: Matched entry DEFAULT at line 18 (5) [attr_filter.access_reject] = updated (5) eap: Reply already contained an EAP-Message, not inserting EAP-Failure (5) [eap] = noop (5) policy remove_reply_message_if_eap { (5) if (&reply:EAP-Message && &reply:Reply-Message) { (5) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (5) else { (5) [noop] = noop (5) } # else = noop (5) } # policy remove_reply_message_if_eap = noop (5) } # Post-Auth-Type REJECT = updated (5) Delaying response for 1.000000 seconds Thread 5 waiting to be assigned a request Waking up in 0.6 seconds. (5) Sending delayed response (5) Sent Access-Reject Id 5 from 127.0.0.1:1812 to 127.0.0.1:56718 length 44 (5) EAP-Message = 0x04050004 (5) Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds. (0) <done>: Cleaning up request packet ID 0 with timestamp +14 (1) <done>: Cleaning up request packet ID 1 with timestamp +14 (2) <done>: Cleaning up request packet ID 2 with timestamp +14 (3) <done>: Cleaning up request packet ID 3 with timestamp +14 (4) <done>: Cleaning up request packet ID 4 with timestamp +14 (5) Cleaning up request packet ID 5 with timestamp +14 Ready to process requests -- debug log ends -- Thank you :-) Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

2 2

MySQL Connect Timeout?
by Susan Barnes 24 Aug '15

24 Aug '15

Hi List, Is there a way to set a connect timeout for a MySQL-Server? At the moment it seems to be a bit longer then 60 seconds, but I cannot find where this is set (Using freeradius 3.0.9). Thanks for your help Susan -- S.Barnes Cologne University IT/Networking Dept.

2 5

No Pool-Name defined - how should I connect an IP poolwith an APN or requests from a specific NAS?
by Sophie Loewenthal 24 Aug '15

24 Aug '15

Hi, We have FreeRadius running on Centos 6 ( freeradius-2.1.12-1.el6.x86_64) . I have a new NAS set up and I would like to have a Pool configured for this. We have several existing NAS and Pool_Names set up that work. They were configured by a previous team. I cannot find the logic between how an incoming request for IP allocation and a Pool-Name. The message was, Mon Aug 24 10:39:10 2015 : Auth: Login OK: [0000008fa] (from client v-nas-x2x port 9380 cli 882393728079768) Mon Aug 24 10:39:10 2015 : Info: No Pool-Name defined (did x2x.v.trimbletl.com cli 882393728079768 port 9380 user 0000008fa) How could I assigned a Pool-Name to requests from our APN? I should create some IP addresses i radippool for this, but I would prefer the incoming APN x2x.v.trimbletl.com to use an existing IP pool for now. /etc/raddb/users contains some entries, DEFAULT NAS-IP-Address == 172.200.100.1, Pool-Name := v DEFAULT NAS-IP-Address == 195.232.123.0, Pool-Name := v-x2x DEFAULT NAS-IP-Address == 10.123.255.254, Pool-Name := p-c DEFAULT NAS-IP-Address == 10.123.255.254, Pool-Name := p-m DEFAULT ramed-IP-Netmask = 255.255.255.255 Our ip pool has four pool_names defined and we have lots of IP addresses, mysql> select count(*) from radippool; +----------+ | count(*) | +----------+ | 422652 | I've read up on the sqlippool dox and could not how ours worked. Any ideas? Kind regards, Sophie

2 1