- Freeradius-Users - lists.freeradius.org

EAP-TLS / OpenSSL Debug Output
by Ben Humpert 28 May '15

28 May '15

Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 read client certificate A Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 read client key exchange A Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: <<< TLS 1.0 Handshake [length 0106], CertificateVerify Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 read certificate verify A Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 read finished A Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 write change cipher spec A Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 write finished A Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: TLS_accept: SSLv3 flush data Wed May 27 00:16:37 2015 : Debug: (118) eap_tls: (other): SSL negotiation finished successfully Wed May 27 00:16:37 2015 : Debug: SSL Connection Established While Windows (including XP) as well as Apple clients (including iOS) are working great Android has issues connecting using EAP-TLS. As soon as I select a CA certificate in Android the connection is not possible. If I don't select any CA certificate the connection works, beside it's actually not EAP-TLS since the server certificate is not validated. Just for my understanding, in the above debug output which side of the >>> and <<< is the RADIUS server and which is the client? Does the second line means the server (left) read from the client (right)? If so does the last line means the server (left) wrote to the client (right)? The debug output of the failing Android EAP-TLS attempt is below - in case someone is interested. Wed May 27 00:10:44 2015 : Debug: (89) eap: EAP TLS (13) Wed May 27 00:10:44 2015 : Debug: (89) eap: Calling eap_tls to process EAP data Wed May 27 00:10:44 2015 : Debug: (89) eap_tls: Authenticate Wed May 27 00:10:44 2015 : Debug: (89) eap_tls: processing EAP-TLS Wed May 27 00:10:44 2015 : Debug: (89) eap_tls: eaptls_verify returned 7 Wed May 27 00:10:44 2015 : Debug: (89) eap_tls: Done initial handshake Wed May 27 00:10:44 2015 : Debug: (89) eap_tls: <<< TLS 1.0 Alert [length 0002], fatal unknown_ca Wed May 27 00:10:44 2015 : ERROR: (89) eap_tls: TLS Alert read:fatal:unknown CA Wed May 27 00:10:44 2015 : ERROR: (89) eap_tls: TLS_accept: Failed in SSLv3 read client certificate A Wed May 27 00:10:44 2015 : ERROR: (89) eap_tls: SSL says: error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Wed May 27 00:10:44 2015 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. Wed May 27 00:10:44 2015 : Debug: TLS receive handshake failed during operation Wed May 27 00:10:44 2015 : Debug: (89) eap_tls: eaptls_process returned 4 Wed May 27 00:10:44 2015 : ERROR: (89) eap: Failed continuing EAP TLS (13) session. EAP sub-module failed And for everybody else. Here is the official error return codes page for openssl https://www.openssl.org/docs/ssl/SSL_alert_type_string.html

2 5

attribute Access-Period dont work
by Sergio Diaz 27 May '15

27 May '15

Hello guys I have a FreeRADIUS Version 2.1.12 with mysql db I have a hotspot with coova chilli devices like Access point (open-mesh with cloud controller cloudtrax), everything Works fine except with the attribute” Access-Period” . I need limit a user access period for 1 day ,1 hour or 1 week from his first time he login using a prepaid card. In my test i put 3 minutes to this user, so after this time should Disconnected it when time limit exceed , but this not happens, the user still connected and enjoying the internet. I hope you can help me. 1. In the radcheck table i have this user : Id username attribute op value 930 513o Auth-Type := Accept 3015 513o Access-Period := 180 3016 513o Simultaneous-Use := 1 2. In the file default i have this in the authorize section: # See "Authorization Queries" in sql.conf # sql # # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd # # The ldap module will set Auth-Type to LDAP if it has not # already been set # ldap # # Enforce daily limits on time spent logged in. # daily # # Use the checkval module # checkval expiration logintime noresetcounter accessperiod 3. in the file counter.conf i have this: sqlcounter noresetcounter { counter-name = Max-All-Session-Time check-name = Max-All-Session sqlmod-inst = sql key = User-Name reset = never query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" } sqlcounter accessperiod { counter-name = Max-Access-Period-Time check-name = Access-Period sqlmod-inst = sql key = User-Name reset = never query = “SELECT UNIX_TIMESTAMP() – UNIX_TIMESTAMP(AcctStartTime) FROM radacct WHERE UserName = ‘%{%k}’ ORDER BY AcctStartTime LIMIT 1″ } 4. in the table radacct i see this registry: Username nasipaddress acctstarttime acctstoptime acctsessiontime 513o 10.255.216.1 1 Wireless-802.11 2015-05-21 10:45:11 null 3301 5. In my debug i see this , i hope you can help me. Ready to process requests. rad_recv: Access-Request packet from host 192.16.1.6 port 56055, id=122, length=301 ChilliSpot-Version = "1.2.8" User-Name = "513o" CHAP-Challenge = 0x6c50106ac087331ba01d102ffed40df6 CHAP-Password = 0x001757cc38635b5efdfc132cef6ef21fa7 Service-Type = Login-User Acct-Session-Id = "555e206c00000001" Framed-IP-Address = 10.255.216.63 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" Calling-Station-Id = "E0-06-E6-0E-4F-0B" Called-Station-Id = "AC-86-74-1D-9B-F0" NAS-IP-Address = 10.255.216.1 NAS-Identifier = "AP2" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Wicoin_Test" WISPr-Location-Name = "Wicoin_Test" WISPr-Logoff-URL = "http://10.255.216.1:3990/logoff" Message-Authenticator = 0xcd49be7589ebf0e0f806bd65d37b73e3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++- entering policy filter_username {...} +++? if (User-Name =~ /^ /) ? Evaluating (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ /^ /) -> FALSE +++? if (User-Name =~ / $$/) ? Evaluating (User-Name =~ / $$/) -> FALSE +++? if (User-Name =~ / $$/) -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") expand: %{User-Name} -> 513o expand: %{tolower:%{User-Name}} -> 513o ? Evaluating (User-Name != "%{tolower:%{User-Name}}") -> FALSE +++? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE ++- policy filter_username returns notfound ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "513o", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> 513o [sql] sql_set_user escaped user --> '513o' rlm_sql (sql): Reserving sql socket id: 24 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '513o' ORDER BY id rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '513o' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '513o' ORDER BY priority rlm_sql (sql): Released sql socket id: 24 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_sqlcounter: Entering module authorize code sqlcounter_expand: '.SELECT' [accessperiod] expand: .SELECT -> .SELECT WARNING: Please replace '%S' with '${sqlmod-inst}' sqlcounter_expand: '%{sql:.SELECT}' [accessperiod] sql_xlat [accessperiod] expand: %{User-Name} -> 513o [accessperiod] sql_set_user escaped user --> '513o' [accessperiod] expand: .SELECT -> .SELECT rlm_sql (sql): Reserving sql socket id: 23 rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): failed after re-connect rlm_sql (sql): database query error, .SELECT: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.SELECT' at line 1 rlm_sql (sql): Released sql socket id: 23 [accessperiod] expand: %{sql:.SELECT} -> rlm_sqlcounter: No integer found in string "" ++[accessperiod] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section session from file /etc/freeradius/sites-enabled/default +- entering group session {...} [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> 513o ++[radutmp] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> 513o [sql] sql_set_user escaped user --> '513o' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0x001757cc38635b5efdfc132cef6ef21fa7 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '513o', '0x001757cc38635b5efdfc132cef6ef21fa7', 'Access-Accept', '2015-05-21 13:14:16') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '513o', '0x001757cc38635b5efdfc132cef6ef21fa7', 'Access-Accept', '2015-05-21 13:14:16') rlm_sql (sql): Reserving sql socket id: 22 rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): Released sql socket id: 22 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 122 to 192.16.1.6 port 56055 Finished request 82. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host 192.16.1.6 port 54159, id=91, length=225 ChilliSpot-Version = "1.2.8" ChilliSpot-Attr-10 = 0x00000002 Event-Timestamp = "May 21 2015 13:14:16 CDT" Acct-Status-Type = Start User-Name = "513o" Acct-Session-Id = "555e206c00000001" Framed-IP-Address = 10.255.216.63 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 NAS-Port-Id = "00000001" Calling-Station-Id = "E0-06-E6-0E-4F-0B" Called-Station-Id = "AC-86-74-1D-9B-F0" NAS-IP-Address = 10.255.216.1 NAS-Identifier = "AP2" WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Wicoin_Test" WISPr-Location-Name = "Wicoin_Test" # Executing section preacct from file /etc/freeradius/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 192.16.1.6,NAS-IP-Address = 10.255.216.1,Acct-Session-Id = "555e206c00000001",User-Name = "513o"' [acct_unique] Acct-Unique-Session-ID = "392d59c5bb1cc208". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "513o", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/freeradius/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> 192.16.1.6 [detail] expand: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/freeradius/radacct/192.16.1.6/detail-20150521 [detail] /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/freeradius/radacct/192.16.1.6/detail-20150521 [detail] expand: %t -> Thu May 21 13:14:16 2015 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp [radutmp] expand: %{User-Name} -> 513o ++[radutmp] returns ok [sql] expand: %{User-Name} -> 513o [sql] sql_set_user escaped user --> '513o' [sql] expand: %{Acct-Delay-Time} -> [sql] ... expanding second conditional [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 21 rlm_sql_mysql: MYSQL check_error: 2006, returning SQL_DOWN rlm_sql (sql): Attempting to connect rlm_sql_mysql #21 rlm_sql_mysql: Starting connect to MySQL server for #21 rlm_sql (sql): Connected new DB handle, #21 rlm_sql (sql): Released sql socket id: 21 ++[sql] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> 513o attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 91 to 192.16.1.6 port 54159 Finished request 83. Cleaning up request 83 ID 91 with timestamp +4782 Going to the next request Waking up in 4.9 seconds. Cleaning up request 82 ID 122 with timestamp +4782 Ready to process requests. Saludos Cordiales, Sergio Diaz

2 7

Log
by sandy.napoles＠eccmg.cupet.cu 27 May '15

27 May '15

Hello list, Iam using freeradius with autentication in samba4 as Active directory, everything is ok, but I can not see the log, I need check the log because I want that client is conected to this server, in my radius.conf log { destination = files file = ${logdir}/radius.log requests = ${logdir}/radiusd-%{%{Virtual-Server}:-DEFAULT}-%Y%m%d.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes When I go to /var/log/freeradius the folder radacct is empty. My server is not a debug mode. Somebody can helpme?

2 4

LOG
by sandy.napoles＠eccmg.cupet.cu 27 May '15

27 May '15

Hello list...How I can analice the log in freeradius, for example with w3perl I can built report about the squid, postfix, etc. I can take report about the log in freeradius.

2 2

Re: Authentication us mySQL and AD(LDAP)
by chenjiang 27 May '15

27 May '15

Hi! Alan Thanks for the information. I still have one more question for the authentication logic, if the backend LDAP authentication fail but SQL authentication OK (the scanario is for WIFI access, internal employees account stored in LDAP and visitor account stored in mySQL), will FreeRADIUS returns âAuth-Acceptâ or âAuth-Rejectâ? BR! Chen Jiang Microshield Technology Co., Ltd åäº¬å¸æµ·æ·åºè¥¿ä¸ç¯åè·¯50å·è±ªæå¤§å¦C2åº§18-19å± 100048 (86)10-88518768 (86)18612696123 [1]chenjiang(a)microshield.com.cn åå§é®ä»¶ åä»¶äºº: Alan DeKok<aland(a)deployingradius.com> æ¶ä»¶äºº: FreeRadius users mailing list<freeradius-users(a)lists.freeradius.org> åéæ¶é´: 2015å¹´5æ26æ¥(å¨äº)â20:24 ä¸»é¢: Re: Authentication us mySQL and AD(LDAP) On May 25, 2015, at 10:06 PM, chenjiang <[2]chenjiang(a)microshield.com.cn> wrote: > Sorry for disturbing, I am struggleing with FreeRADIUS user > authentication through Windows AD(LDAP), but I found when enable LDAP > mySQL backend is not works any more. That shouldn't happen. Odds are something else is going wrong. > From debug output(radius -X), we found even mySQL module returns > OK,FreeRADIUS still returns Accept-Reject when LDAP module returns > fail. Well, if the LDAP module fails, that's a problem. > [ldap] ldap_search() failed: Operations error Read raddb/modules/ldap. Look for "operations error". If it doesn't appear t here, upgrade to 2.2.8. This issue is fixed, and documented. And yes, you can use LDAP and MySQL at the same time. There's no magic. You just use both, and both work. Alan DeKok. - List info/subscribe/unsubscribe? See [3]http://www.freeradius.org/list/users.htm l References 1. mailto:chenjiang@microshield.com.cn 2. mailto:chenjiang@microshield.com.cn 3. http://www.freeradius.org/list/users.html

2 1

version 3.0.7 SOFT ASSERT FAILED
by Khapare Joshi 27 May '15

27 May '15

I have installed version 3.0.7 (freebsd) it was working fine but now i see quite a lot May 26 10:05:30 myserver radiusd[37509]: SOFT ASSERT FAILED src/lib/event.c[192]: *(ev->parent) == ev May 26 10:05:30 myserverradiusd[37509]: SOFT ASSERT FAILED src/lib/event.c[198]: ret == 1 May 26 10:41:28 myserverradiusd[72303]: SOFT ASSERT FAILED src/lib/event.c[192]: *(ev->parent) == ev installed from the ports. Any clue

3 2

Problem with freeradius and LDAP: crypt and MD5 password
by Ana Gallardo Gómez 27 May '15

27 May '15

Hello! Sorry for my english. I'm working with freeradius FreeRADIUS Version 2.1.12 Sorry to ask again about this, I have been looking for the solution, but I can't resolve my problem. I have a LDAP server with users password in crypt for PDI and PAS and in MD5 for students. The password in LDAP for an user is only available when you do bind with that user. I can see here that you can get the authentication result from the bind result http://confluence.diamond.ac.uk/display/PAAUTH/Using+LDAP+as+authentication… ¿Is this function available in freeradius 2.1.12? Meanwhile I try to do bind whit my user (PAS - crypt password in userPassword attribute in LDAP) and authenticate whith a clear text password, but I can't auth... My config: # cat /etc/freeradius/sites-enabled/rinuex_email server rinuex_email { authorize { suffix files ldapemail pap } authenticate { Auth-Type PAP { pap } } post-auth { sql_log Post-Auth-Type REJECT { sql_log } } } # cat /etc/freeradius/modules-enabled/ldap ldap ldapemail { server = "ldap.unex.es" identity = "uid=aigallardo,ou=people,dc=unex,dc=es" password = "XXXX" basedn = "ou=people,dc=unex,dc=es" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" password_attribute = userPassword ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } # dictionary_mapping = ${confdir}/ldap.attrmap.email edir_account_policy_check = no set_auth_type = yes } My log: rad_recv: Access-Request packet from host 158.49.245.14 port 50406, id=16, length=62 User-Name = "aigallardo(a)unex.es" Vendor-Specific = 0x00000000020a3035303837372b2b NAS-IP-Address = 158.49.245.14 Fri Apr 10 11:37:38 2015 : Info: server rinuex_email { Fri Apr 10 11:37:38 2015 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/rinuex_email Fri Apr 10 11:37:38 2015 : Info: +- entering group authorize {...} Fri Apr 10 11:37:38 2015 : Info: [suffix] Looking up realm "unex.es" for User-Name = "aigallardo(a)unex.es" Fri Apr 10 11:37:38 2015 : Info: [suffix] Found realm "unex.es" Fri Apr 10 11:37:38 2015 : Info: [suffix] Adding Stripped-User-Name = "aigallardo" Fri Apr 10 11:37:38 2015 : Info: [suffix] Adding Realm = "unex.es" Fri Apr 10 11:37:38 2015 : Info: [suffix] Authentication realm is LOCAL. Fri Apr 10 11:37:38 2015 : Info: ++[suffix] returns ok Fri Apr 10 11:37:38 2015 : Info: [files] users: Matched entry DEFAULT at line 42 Fri Apr 10 11:37:38 2015 : Info: ++[files] returns ok Fri Apr 10 11:37:38 2015 : Info: [ldapemail] performing user authorization for aigallardo Fri Apr 10 11:37:38 2015 : Info: [ldapemail] expand: %{Stripped-User-Name} -> aigallardo Fri Apr 10 11:37:38 2015 : Info: [ldapemail] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=aigallardo) Fri Apr 10 11:37:38 2015 : Info: [ldapemail] expand: ou=people,dc=unex,dc=es -> ou=people,dc=unex,dc=es Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] ldap_get_conn: Checking Id: 0 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] ldap_get_conn: Got Id: 0 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] attempting LDAP reconnection Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] (re)connect to ldap.unex.es:389, authentication 0 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] bind as uid=aigallardo,ou=people,dc=unex,dc=es/XXXX to ldap.unex.es:389 Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] waiting for bind result ... Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] Bind was successful Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] performing search in ou=people,dc=unex,dc=es, with filter (uid=aigallardo) Fri Apr 10 11:37:38 2015 : Info: [ldapemail] Added User-Password = {crypt}XXXXXXXXXXXX in check items Fri Apr 10 11:37:38 2015 : Info: [ldapemail] No default NMAS login sequence Fri Apr 10 11:37:38 2015 : Info: [ldapemail] looking for check items in directory... Fri Apr 10 11:37:38 2015 : Info: [ldapemail] looking for reply items in directory... Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] sn -> Nombre-Completo = "gallardo gomez" Fri Apr 10 11:37:38 2015 : Info: [ldapemail] user aigallardo authorized to use remote access Fri Apr 10 11:37:38 2015 : Debug: [ldapemail] ldap_release_conn: Release Id: 0 Fri Apr 10 11:37:38 2015 : Info: ++[ldapemail] returns ok Fri Apr 10 11:37:38 2015 : Info: [pap] No clear-text password in the request. Not performing PAP. Fri Apr 10 11:37:38 2015 : Info: ++[pap] returns noop Fri Apr 10 11:37:38 2015 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Apr 10 11:37:38 2015 : Info: !!! Replacing User-Password in config items with Cleartext-Password. !!! Fri Apr 10 11:37:38 2015 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Apr 10 11:37:38 2015 : Info: !!! Please update your configuration so that the "known good" !!! Fri Apr 10 11:37:38 2015 : Info: !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Fri Apr 10 11:37:38 2015 : Info: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Fri Apr 10 11:37:38 2015 : Info: WARNING: Please update your configuration, and remove 'Auth-Type = Local' Fri Apr 10 11:37:38 2015 : Info: WARNING: Use the PAP or CHAP modules instead. Fri Apr 10 11:37:38 2015 : Info: No User-Password or CHAP-Password attribute in the request. Fri Apr 10 11:37:38 2015 : Info: Cannot perform authentication. Fri Apr 10 11:37:38 2015 : Info: Failed to authenticate the user. Fri Apr 10 11:37:38 2015 : Info: } # server rinuex_email Fri Apr 10 11:37:38 2015 : Info: Using Post-Auth-Type Reject I would like to auth my users with clear-text passwords and with EAP (TTLS+PAP). What do you think that is the best option in my case? Thank you very much in advance. -- :::::::::::::::::::::::::::::::::::: :: Ana Gallardo Gómez :: ::::::::::::::::::::::::::::::::::::

3 4

Unlang to Called-Station-Id to get SSID
by Vikash Gounder 27 May '15

27 May '15

Hi, Iam trying to do a conditional logic using unlang on the default sites-enabled to see if the Called-Station-Id has myssid. So the logic I am using on default sites is: if ("%{Called-Station-Id}" =~ /myssid/) { update control { Proxy-To-Realm := 'visitors-ssid' } } and i have another site under sites-enabled called visitors-ssid. from the logs, i can see the ssid is there as i have configured on radiusd.conf to show msg_goodpass = "%{Called-Station-Id}" On on visitors-ssid site, i have allowed mschap authentication to a particular domain. somehow from the logs the logic fails, just wondering if Iam on the right path. What i am trying to achieve is based on SSID, authenticate users on different sites rather than all authentication going via inner-tunnel. Grateful if someone has came with the same scenario or managed to implement a similar scenario. Thanks, Vikash

2 1

User Groups within FR
by Ben Humpert 26 May '15

26 May '15

I'm using EAP-TLS and authentication works well. I also sanitize Called-Station-Id, Calling-Station-Id and in the same process create Called-Station-Ssid. This also works very well. This is done at first in the authorize section. My mods-config/files/authorize file has two entries as below. tlsuser Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "43", Tunnel-Type = "VLAN" DEFAULT Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "1", Tunnel-Type = "VLAN" My switches support Dynamic VLAN Assignment so this current configuration is fine. My Wifi Access Points however do NOT support it, thus I have to use a unique SSID for each VLAN. Because of that I have to check to which SSID a user is connecting to and accept or reject him based on which VLAN he's allowed to access. I tried using (note the single = in the check item!) tlsuser Called-Station-Ssid = "vlan43" Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "43", Tunnel-Type = "VLAN" This allows me to connect to a switch (which doesn't cause the creation of Called-Station-Ssid) but also to an access point. However, it does not prevent me connecting to a forbidden SSID. If I use == in the check item it actually does prevent me from connecting to a forbidden SSID but also from connecting through switches. So, should I use a regex in the "users" file for each user entry or should I do this with a policy using unlang? And if using unlang is advised - I think using groups is the better approach than hardcoding usernames into the code - how do I create groups which contain a) the usernames that are part of that group and b) one or more Called-Station-Ssid entries the user is allowed to connect to? I thought about arrays but I couldn't find infos if it's supported or how it's used. I actually have a perfectly working unlang code for doing what I want to achieve but that checks LDAP and I want to get rid of it since it's kind of an overkill for just assigning users into groups. Thank you very much in advance! Ben

2 7

TLS Certificate error?
by Scott A. Johnson 26 May '15

26 May '15

Hello, I’m using version 2.2.0 which is installed with Mac OS X 10.10.3. Trying to get EAP-TLS working. I *think* I have my certificates installed, and permissions set correctly, however my clients can’t connect and the error, best I can tell, is certificate based as I receive the error “certificate signature failure”. Where I’m not sure is if this means I have something wrong with my public/private key, an error in my config files with FreeRadius, or something else entirely. Pasting an excerpt of what I believe my problem is, then the entire listing when I run "sudo radiusd -X”. Any help appreciated. Thanks. Scott EXCERPT: +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 07f4], Certificate [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = excelsior.REDACTED [tls] --> BUF-Name = REDACTED CA ROOT [tls] --> subject = /CN=REDACTED CA ROOT/O=REDACTED/OU=Network Operations/ST=Alaska/C=US/L=Nome/emailAddress=REDACTED(a)gmail.com [tls] --> issuer = /CN=REDACTED CA ROOT/O=REDACTED/OU=Network Operations/ST=Alaska/C=US/L=Nome/emailAddress=REDACTED(a)gmail.com [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect (certificate signature failure): [excelsior.REDACTED/<via Auth-Type = EAP>] (from client melbourne.REDACTED port 0 cli 80-BE-05-3A-12-72) Using Post-Auth-Type REJECT FULL OUTPUT OF “radiusd -X” FreeRADIUS Version 2.2.0, for host i386-apple-darwin13.0, built on Mar 31 2015 at 12:21:58 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /Library/Server/radius/raddb/radiusd.conf including configuration file /Library/Server/radius/raddb/clients.conf including files in directory /Library/Server/radius/raddb/modules/ including configuration file /Library/Server/radius/raddb/modules/acct_unique including configuration file /Library/Server/radius/raddb/modules/always including configuration file /Library/Server/radius/raddb/modules/attr_filter including configuration file /Library/Server/radius/raddb/modules/attr_rewrite including configuration file /Library/Server/radius/raddb/modules/cache including configuration file /Library/Server/radius/raddb/modules/chap including configuration file /Library/Server/radius/raddb/modules/checkval including configuration file /Library/Server/radius/raddb/modules/counter including configuration file /Library/Server/radius/raddb/modules/cui including configuration file /Library/Server/radius/raddb/modules/detail including configuration file /Library/Server/radius/raddb/modules/detail.example.com including configuration file /Library/Server/radius/raddb/modules/detail.log including configuration file /Library/Server/radius/raddb/modules/dhcp_sqlippool including configuration file /Library/Server/radius/raddb/sql/mysql/ippool-dhcp.conf including configuration file /Library/Server/radius/raddb/modules/digest including configuration file /Library/Server/radius/raddb/modules/dynamic_clients including configuration file /Library/Server/radius/raddb/modules/echo including configuration file /Library/Server/radius/raddb/modules/etc_group including configuration file /Library/Server/radius/raddb/modules/exec including configuration file /Library/Server/radius/raddb/modules/expiration including configuration file /Library/Server/radius/raddb/modules/expr including configuration file /Library/Server/radius/raddb/modules/files including configuration file /Library/Server/radius/raddb/modules/inner-eap including configuration file /Library/Server/radius/raddb/modules/ippool including configuration file /Library/Server/radius/raddb/modules/krb5 including configuration file /Library/Server/radius/raddb/modules/ldap including configuration file /Library/Server/radius/raddb/modules/linelog including configuration file /Library/Server/radius/raddb/modules/logintime including configuration file /Library/Server/radius/raddb/modules/mac2ip including configuration file /Library/Server/radius/raddb/modules/mac2vlan including configuration file /Library/Server/radius/raddb/modules/mschap including configuration file /Library/Server/radius/raddb/modules/ntlm_auth including configuration file /Library/Server/radius/raddb/modules/opendirectory including configuration file /Library/Server/radius/raddb/modules/otp including configuration file /Library/Server/radius/raddb/modules/pam including configuration file /Library/Server/radius/raddb/modules/pap including configuration file /Library/Server/radius/raddb/modules/passwd including configuration file /Library/Server/radius/raddb/modules/perl including configuration file /Library/Server/radius/raddb/modules/policy including configuration file /Library/Server/radius/raddb/modules/preprocess including configuration file /Library/Server/radius/raddb/modules/radrelay including configuration file /Library/Server/radius/raddb/modules/radutmp including configuration file /Library/Server/radius/raddb/modules/realm including configuration file /Library/Server/radius/raddb/modules/redis including configuration file /Library/Server/radius/raddb/modules/rediswho including configuration file /Library/Server/radius/raddb/modules/replicate including configuration file /Library/Server/radius/raddb/modules/smbpasswd including configuration file /Library/Server/radius/raddb/modules/smsotp including configuration file /Library/Server/radius/raddb/modules/soh including configuration file /Library/Server/radius/raddb/modules/sql_log including configuration file /Library/Server/radius/raddb/modules/sqlcounter_expire_on_login including configuration file /Library/Server/radius/raddb/modules/sradutmp including configuration file /Library/Server/radius/raddb/modules/unix including configuration file /Library/Server/radius/raddb/modules/wimax including configuration file /Library/Server/radius/raddb/eap.conf including configuration file /Library/Server/radius/raddb/sql.conf including configuration file /Library/Server/radius/raddb/sql/sqlite/dialup.conf including configuration file /Library/Server/radius/raddb/policy.conf including files in directory /Library/Server/radius/raddb/sites-enabled/ including configuration file /Library/Server/radius/raddb/sites-enabled/control-socket including configuration file /Library/Server/radius/raddb/sites-enabled/default including configuration file /Library/Server/radius/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /Library/Server/radius/raddb/dictionary main { name = "radiusd" prefix = "/Applications/Server.app/Contents/ServerRoot/usr" localstatedir = "/private/var" sbindir = "/Applications/Server.app/Contents/ServerRoot/usr/sbin" logdir = "/private/var/log/radius" run_dir = "/private/var" libdir = "/Applications/Server.app/Contents/ServerRoot/usr/lib/freeradius" radacctdir = "/private/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/private/var/radiusd.pid" checkrad = "/Applications/Server.app/Contents/ServerRoot/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /Library/Server/radius/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /Library/Server/radius/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /Library/Server/radius/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /Library/Server/radius/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /Library/Server/radius/raddb/sql.conf sql { driver = "rlm_sql_sqlite" server = "localhost" port = "" login = "radius" password = "radpass" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/private/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_sqlite (module rlm_sql_sqlite) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #0 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #0 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #1 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #1 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #2 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #2 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #3 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #3 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_sqlite #4 rlm_sql_sqlite: Opening sqlite database /Library/Server/radius/raddb/sqlite_radius_client_database for #4 rlm_sql_sqlite: sqlite3_open() = 0 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id,nasname,shortname,type,secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_sqlite: sqlite3_prepare() = 0 rlm_sql_sqlite: sqlite3_step = 100 rlm_sql (sql): Read entry nasname=10.0.2.212,shortname=melbourne.REDACTED,secret=8AToGBlTfakHTRIgDkgxkJKOGpwPuRj8nC6WywGBmiQOiHL5oz rlm_sql (sql): Adding client 10.0.2.212 (melbourne.REDACTED, server=<none>) to clients list rlm_sql_sqlite: sqlite3_step = 101 rlm_sql_sqlite: sqlite3_finalize() = 0 rlm_sql (sql): Released sql socket id: 4 } radiusd: #### Loading Virtual Servers #### server { # from file /Library/Server/radius/raddb/radiusd.conf modules { Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /Library/Server/radius/raddb/eap.conf eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/Library/Server/radius/raddb/certs" pem_file_type = yes private_key_file = "server.key" certificate_file = "server.crt" CA_file = "server.crt" private_key_password = “REDACTED” dh_file = "/Library/Server/radius/raddb/certs/dh" random_file = "/Library/Server/radius/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/Library/Server/radius/raddb/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { tmpdir = "/tmp/radiusd" client = "/usr/bin/openssl verify -CApath /Library/Server/radius/raddb/certs %{TLS-Client-Cert-Filename}" } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /Library/Server/radius/raddb/modules/preprocess preprocess { huntgroups = "/Library/Server/radius/raddb/huntgroups" hints = "/Library/Server/radius/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /Library/Server/radius/raddb/huntgroups reading pairlist file /Library/Server/radius/raddb/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /Library/Server/radius/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /Library/Server/radius/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_files Module: Instantiating module "files" from file /Library/Server/radius/raddb/modules/files files { usersfile = "/Library/Server/radius/raddb/users" acctusersfile = "/Library/Server/radius/raddb/acct_users" preproxy_usersfile = "/Library/Server/radius/raddb/preproxy_users" compat = "no" } reading pairlist file /Library/Server/radius/raddb/users reading pairlist file /Library/Server/radius/raddb/acct_users reading pairlist file /Library/Server/radius/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /Library/Server/radius/raddb/modules/detail detail { detailfile = "/private/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /Library/Server/radius/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/Library/Server/radius/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /Library/Server/radius/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /Library/Server/radius/raddb/modules/radutmp radutmp { filename = "/private/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /Library/Server/radius/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/Library/Server/radius/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /Library/Server/radius/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /Library/Server/radius/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /Library/Server/radius/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /Library/Server/radius/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /Library/Server/radius/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes use_open_directory = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /Library/Server/radius/raddb/modules/unix unix { radwtmp = "/private/var/log/radius/radwtmp" } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/private/var/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /private/var/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=4, length=210 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x024a001b01657863656c73696f722e616b67686574746f2e636f6d Message-Authenticator = 0x25fa1d3162e5d274f37dd609d784e864 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 74 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 4 to 10.0.2.212 port 32817 EAP-Message = 0x014b00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01225f91016952cfb3e720410b079302 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=5, length=353 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x024b00980d800000008e16030100890100008503015563dc437b970647c704a53905a9ef995102a97e4e93d9353f774bd59e92d43000004a00ffc024c023c00ac009c008c028c027c014c013c012c026c025c005c004c003c02ac029c00fc00ec00d006b0067003900330016003d003c0035002f000ac007c011c002c00c0005000401000012000a00080006001700180019000b00020100 State = 0x01225f91016952cfb3e720410b079302 Message-Authenticator = 0x09da5a8ca03143ce1fe242d7846b6c9a # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 75 length 152 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 142 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0089], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0446], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [tls] TLS_accept: SSLv3 write key exchange A [tls] >>> TLS 1.0 Handshake [length 00bb], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 10.0.2.212 port 32817 EAP-Message = 0x014c04000dc00000075316030100310200002d03015563dc4307b72fca4a9e4d223bc00807a5c8cc128360c6d430002ed4736304d0000039000005ff0100010016030104460b00044200043f00043c3082043830820320a003020102020101300b06092a864886f70d01010b3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973 EAP-Message = 0x636f74742e612e6a6f686e736f6e40676d61696c2e636f6d301e170d3135303532343233313834335a170d3138303930353233313834335a3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a EAP-Message = 0x0282010100d382b05f1f2b02e7d4e7029d8bc1abfaddc1d4d2c7fa97698adb0e930d4bbb780d3a38637c8943e2d2ecac3e190318ca0c24b58f1ab98fbbfa9f066452d3fae77183eaad7b8459f275cc4d2f8b84a60dee373e40dff311eab2b5db0e212739fc71298002e5265282568ffea594b7c7c0fed2adee0129df98474e69a9fef0de66f643ff1883fcd74b98448db4e231be0eebe7a39144dc646473f91be952fb407429f944fffe2b16fc17a2e13cff5873043246f4c89ebc61e01427ced66633cf4685183e18fd1e906c88facb1878394181e00f1369d12c69825f22ae2ad31022cc35158a61e80a611ff3d8ddc0bb211baca7b4696f09491343 EAP-Message = 0x456438585a7840db0203010001a371306f300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201be304c0603551d250101ff0442304006082b0601050507030406082b0601050507030206082b0601050507030106082b0601050507030306072b06010502030406072b0601050203050604551d2500300d06092a864886f70d01010b050003820101003998868f30bb38272971676fbfb238c12a845b76744db0a22dfcdd2026b08c22a5ad4c058c1379440372336cbb283bc9cabc6c7b0068b338c25e9dd37a6092a305afe2fd36af92a0bb2ad05ed31b131b3f5ce08df86f19d93251108e1ba90356e17aec90aab58f7d7a EAP-Message = 0x5878127fef2b98ebdd0d6593 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01225f91006e52cfb3e720410b079302 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=6, length=207 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x024c00060d00 State = 0x01225f91006e52cfb3e720410b079302 Message-Authenticator = 0x55a0649c9f63d4eee5491d479d547ca2 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 76 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 10.0.2.212 port 32817 EAP-Message = 0x014d03670d80000007534fa5e8c2905f845d124c1271b0a022f8c74304c3f1fc6c606367141945240a914b538239f27c525a8cdbc8c27a9a0324829d5d76b9265799375e69a7c3a50ba06cdb8698104c7d117c41fa5fe7c171fcb4bcc157bb1a1c61972be7cd8c672f232c7d9471d5f8a81dae59793a4dbd8f4000573a46518d94cc58c4cf1e9bb11ceceacadb58fe77ff4c086a30160301020d0c0002090080d5a9b49c3a74120e0ab80fafbacf3b7c0a0a4971814dcf0918484d21147c0971b222e6d2d8bc6fa92f13683f7f792a3ffffa6a0fd59dc268612175a84b610a268924ff711100ef2091bf096450b9fe33d9c89768044a45cf9922c54710 EAP-Message = 0xd83e201a78cbec5ff7df962d1d13c1ce76f59c2fb2e9fc36da77a054442693d74d56730001050080b27b19fb4ee27274196d95ffaadca22f8f817fb34b5483b91ba8e8cf67ade0612c3d0d7d0d4bdf047b5eb6a1fa0b8b41d1dde26d880bb887d803e383fa6c60c45682bfddfe9917fe7b65e5d8099b5932e567b985e5db31e25a13ade81d6a234f31ef5935664790e92fb6c8462c9b655127fd8a7fb1400e82d3495902b2c6986e010055a625d94b8a8dfa31dcf5203b924ac4236c8100b330c109baafc6fb94dfa08155421005aa93b3c9c54cc9e188506d010506e842b8d98daf5a47fbec72a550c55029272a5b9f0f934cfe972c749f9f41e0c4e9 EAP-Message = 0x673fdbaf8dd649de2f2983117345b1a634c9745a0ab2b5ea74a5dfa9e2a093a1268cea05ee70aac8276fc2312aef0bfa49f2933a50bae9fbcb15347caf38a1e575f86f7c4c6c584c6762cf51adf172aa3796f5a63da7352799c6794b02cd10042aa5f0e278c097867479489b4e7ce1ee57b3726a5b9da517169b01fdbc295ea66f0946c6282e5f5b65256d45549f21bd1dfd089f2ca0486ae99ab61639a3abec1cec4f9c69c3206409e2197bcc16030100bb0d0000b305030401024000ab00a93081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b301906035504 EAP-Message = 0x0b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01225f91036f52cfb3e720410b079302 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=7, length=1487 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x024d04fc0dc0000009ca16030107f40b0007f00007ed0003ab308203a73082028fa00302010202010a300b06092a864886f70d01010b3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d301e170d3135303532353032303233325a170d3136303532343032303233 EAP-Message = 0x325a305d311f301d06035504030c16657863656c73696f722e616b67686574746f2e636f6d310b3009060355040613025553312d302b06092a864886f70d010901161e73636f74742e612e6a6f686e736f6e4077656c6c73666172676f2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c5a9c7fb77faa3b27e434505743b5e7662a6abc512d873049cae8074243cfc556439e7b4780dfb054f63dfbf148303b4a41c3c495c3c4837661888d88ffe3d3561fad3a3a07a006b8bc0031fbaf7f659c321208741b4b778eaeb4b076df24bfd4858c49bc271b7ec8fe518083f360cd4c2980ba1e4abb48c42a136 EAP-Message = 0xb97f33d0ba311a1ccb604cbeaba1900060a83ecc5132c925ef0e1883a4c1c9a3fd10305cc1f852f3db3ee819e252fc82270d6642da69633ae255bdcd9c596d5b5fcc1ae32cd36f2968c9ef5945b829e2370f4b1ef1466e5b6a806c0381abe60c0e70e90ba12b847b856ec79151ac41b0ebfb3b26562c2fdac6380acc9485584c999982702f0203010001a32a3028300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b06010505070302300d06092a864886f70d01010b050003820101007d3b8b74f07a5d7eb3acfa9870e571f69e9df262eaec17a4e9054aab826d7ce554cd6c7e159372be9efef6bd453b93d0f57b26 EAP-Message = 0x952dd184a421224f9dc3776c14ef596f47d5912dd87783c7d78ea14fca2f3eab987de8cd25434bf7c4f0a104b70fa6426677d300ccf844d1746c4649d91eaf82e7c8a9eae8b99960e3e0a9eb10599685bbbf4c6ada0c7a2d79bf23fe0cac48da9d444590fe378327c19ba1074c8f524592530c65c43c8b4c4b27b6534029dd87f140dca526b8d2731376b4ce55c3a9bdf88584a4bb9653394a4b8a1d0f6e3faaf5ba892daf7c52f7292c5c5d90ad7e6694d0f689e882998eddae207c584f92e77e0043a1afc685218f7f6643bd00043c3082043830820320a003020102020101300b06092a864886f70d01010b3081a63119301706035504030c10414b EAP-Message = 0x47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d301e170d3135303532343233313834335a170d3138303930353233313834335a3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e657477 EAP-Message = 0x6f726b204f706572617469 State = 0x01225f91036f52cfb3e720410b079302 Message-Authenticator = 0x2440d17407bd35257e345216c3df16a4 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 77 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 2506 [tls] Received EAP-TLS First Fragment of the message [tls] eaptls_verify returned 9 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 7 to 10.0.2.212 port 32817 EAP-Message = 0x014e00060d00 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01225f91026c52cfb3e720410b079302 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=8, length=1455 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x024e04de0d006f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d382b05f1f2b02e7d4e7029d8bc1abfaddc1d4d2c7fa97698adb0e930d4bbb780d3a38637c8943e2d2ecac3e190318ca0c24b58f1ab98fbbfa9f066452d3fae77183eaad7b8459f275cc4d2f8b84a60dee373e40dff311eab2b5db0e212739fc71298002e5265282568ffea594b7c7c0fed2adee0129df98474e69a9 EAP-Message = 0xfef0de66f643ff1883fcd74b98448db4e231be0eebe7a39144dc646473f91be952fb407429f944fffe2b16fc17a2e13cff5873043246f4c89ebc61e01427ced66633cf4685183e18fd1e906c88facb1878394181e00f1369d12c69825f22ae2ad31022cc35158a61e80a611ff3d8ddc0bb211baca7b4696f09491343456438585a7840db0203010001a371306f300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201be304c0603551d250101ff0442304006082b0601050507030406082b0601050507030206082b0601050507030106082b0601050507030306072b06010502030406072b0601050203050604551d250030 EAP-Message = 0x0d06092a864886f70d01010b050003820101003998868f30bb38272971676fbfb238c12a845b76744db0a22dfcdd2026b08c22a5ad4c058c1379440372336cbb283bc9cabc6c7b0068b338c25e9dd37a6092a305afe2fd36af92a0bb2ad05ed31b131b3f5ce08df86f19d93251108e1ba90356e17aec90aab58f7d7a5878127fef2b98ebdd0d65934fa5e8c2905f845d124c1271b0a022f8c74304c3f1fc6c606367141945240a914b538239f27c525a8cdbc8c27a9a0324829d5d76b9265799375e69a7c3a50ba06cdb8698104c7d117c41fa5fe7c171fcb4bcc157bb1a1c61972be7cd8c672f232c7d9471d5f8a81dae59793a4dbd8f4000573a4651 EAP-Message = 0x8d94cc58c4cf1e9bb11ceceacadb58fe77ff4c086a30160301008610000082008076ae79d0ea88643b5cbbc47bf605ea6056d9f9f31a2b3e4c4905ed82b9547d7088a6c38d72239281428afaddb24d8e9cd52a220cffafec9ed506b0e1d51559c5c82f9746a2f2a45ab5f47cfd255f2bbf170b5df1a4e50c73ed36b74a9abaa9476eab9a897463d55189dc935c669eaff7f3b452d991a13c51a7582dbc35a62f4316030101060f0001020100ac295e703efa852fb102990efb0b4204c27abf5c2a1f3d0c9f9751ad0e9b386ab5f4b63090c521fdbb38244eb5af4c8959076c80672747b2cf1dd327889db859ba6b7f68540272ce446fa569d3e59efd41 EAP-Message = 0x19daaa4c523ad21e6a8a114f41e86c0590d58e2098a6921c0cf1946f777f3825aaf06c4c7301de1a17ff2e8a46104ab57caddfe8e54e3da7f226a8f210e1d09b08b5318dd386c9ad50ae8996e29ae657d6d5827acb73447e6d556b001de51662637257da3d56164f09090a89aa8619fce80162d2b00361ceb84fdcdbb5c355a38bfb643fca4fdfab7ae0064dcd5a7a43d6ae9a6e048181213036647c37e421160ade6819f0bd28115eb9739d9da0b8140301000101160301003068e729c6d8580453099ff4313996d147ef59b22a90cb83af06b7e67ea7ab1cf22cc541fb61f6b978f7f9cdad684838aa State = 0x01225f91026c52cfb3e720410b079302 Message-Authenticator = 0xb5c05f761e635be28cfe0d537a85e7e8 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 78 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 07f4], Certificate [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = excelsior.REDACTED [tls] --> BUF-Name = REDACTED CA ROOT [tls] --> subject = /CN=REDACTED CA ROOT/O=REDACTED/OU=Network Operations/ST=Alaska/C=US/L=Nome/emailAddress=REDACTED(a)gmail.com [tls] --> issuer = /CN=REDACTED CA ROOT/O=REDACTED/OU=Network Operations/ST=Alaska/C=US/L=Nome/emailAddress=REDACTED(a)gmail.com [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect (certificate signature failure): [excelsior.REDACTED/<via Auth-Type = EAP>] (from client melbourne.REDACTED port 0 cli 80-BE-05-3A-12-72) Using Post-Auth-Type REJECT # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group REJECT {...} ++? if ("%{EAP-Message}") expand: %{EAP-Message} -> 0x024e04de0d006f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d382b05f1f2b02e7d4e7029d8bc1abfaddc1d4d2c7fa97698adb0e930d4bbb780d3a38637c8943e2d2ecac3e190318ca0c24b58f1ab98fbbfa9f066452d3fae77183eaad7b8459f275cc4d2f8b84a60dee373e40dff311eab2b5db0e212739fc71298002e5265282568ffea594b7c7c0fed2adee0129df98474e69a9 ? Evaluating ("%{EAP-Message}") -> TRUE ++? if ("%{EAP-Message}") -> TRUE ++- entering if ("%{EAP-Message}") {...} expand: %{Message-Authenticator} -> 0xb5c05f761e635be28cfe0d537a85e7e8 +++[reply] returns noop ++- if ("%{EAP-Message}") returns noop [attr_filter.access_reject] expand: %{User-Name} -> excelsior.REDACTED attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 8 to 10.0.2.212 port 32817 EAP-Message = 0x044e0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=9, length=210 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02f2001b01657863656c73696f722e616b67686574746f2e636f6d Message-Authenticator = 0x83c791cc5877bd077c0961d93cecdead # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 242 length 27 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 9 to 10.0.2.212 port 32817 EAP-Message = 0x01f300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd1d2c5bcdee2148e0c4efca7138c662 Finished request 5. Going to the next request Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=10, length=353 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02f300980d800000008e16030100890100008503015563dc45cc56c1efaa2cc6712a2b8e5493a662ee52a6311a68b42c0d1001822f00004a00ffc024c023c00ac009c008c028c027c014c013c012c026c025c005c004c003c02ac029c00fc00ec00d006b0067003900330016003d003c0035002f000ac007c011c002c00c0005000401000012000a00080006001700180019000b00020100 State = 0xcd1d2c5bcdee2148e0c4efca7138c662 Message-Authenticator = 0x90be50ebd35ab89ba525e4dfa557d9a7 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 243 length 152 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 142 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0089], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 0031], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 0446], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [tls] TLS_accept: SSLv3 write key exchange A [tls] >>> TLS 1.0 Handshake [length 00bb], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 10 to 10.0.2.212 port 32817 EAP-Message = 0x01f404000dc00000075316030100310200002d03015563dc45971ac2228efffbc2df066c646694798f220d29d35d3965cba5076c76000039000005ff0100010016030104460b00044200043f00043c3082043830820320a003020102020101300b06092a864886f70d01010b3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973 EAP-Message = 0x636f74742e612e6a6f686e736f6e40676d61696c2e636f6d301e170d3135303532343233313834335a170d3138303930353233313834335a3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a EAP-Message = 0x0282010100d382b05f1f2b02e7d4e7029d8bc1abfaddc1d4d2c7fa97698adb0e930d4bbb780d3a38637c8943e2d2ecac3e190318ca0c24b58f1ab98fbbfa9f066452d3fae77183eaad7b8459f275cc4d2f8b84a60dee373e40dff311eab2b5db0e212739fc71298002e5265282568ffea594b7c7c0fed2adee0129df98474e69a9fef0de66f643ff1883fcd74b98448db4e231be0eebe7a39144dc646473f91be952fb407429f944fffe2b16fc17a2e13cff5873043246f4c89ebc61e01427ced66633cf4685183e18fd1e906c88facb1878394181e00f1369d12c69825f22ae2ad31022cc35158a61e80a611ff3d8ddc0bb211baca7b4696f09491343 EAP-Message = 0x456438585a7840db0203010001a371306f300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201be304c0603551d250101ff0442304006082b0601050507030406082b0601050507030206082b0601050507030106082b0601050507030306072b06010502030406072b0601050203050604551d2500300d06092a864886f70d01010b050003820101003998868f30bb38272971676fbfb238c12a845b76744db0a22dfcdd2026b08c22a5ad4c058c1379440372336cbb283bc9cabc6c7b0068b338c25e9dd37a6092a305afe2fd36af92a0bb2ad05ed31b131b3f5ce08df86f19d93251108e1ba90356e17aec90aab58f7d7a EAP-Message = 0x5878127fef2b98ebdd0d6593 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd1d2c5bcce92148e0c4efca7138c662 Finished request 6. Going to the next request Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=11, length=207 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02f400060d00 State = 0xcd1d2c5bcce92148e0c4efca7138c662 Message-Authenticator = 0xdcb38934bb553b00882b2180b31f24bb # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 244 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 11 to 10.0.2.212 port 32817 EAP-Message = 0x01f503670d80000007534fa5e8c2905f845d124c1271b0a022f8c74304c3f1fc6c606367141945240a914b538239f27c525a8cdbc8c27a9a0324829d5d76b9265799375e69a7c3a50ba06cdb8698104c7d117c41fa5fe7c171fcb4bcc157bb1a1c61972be7cd8c672f232c7d9471d5f8a81dae59793a4dbd8f4000573a46518d94cc58c4cf1e9bb11ceceacadb58fe77ff4c086a30160301020d0c0002090080d5a9b49c3a74120e0ab80fafbacf3b7c0a0a4971814dcf0918484d21147c0971b222e6d2d8bc6fa92f13683f7f792a3ffffa6a0fd59dc268612175a84b610a268924ff711100ef2091bf096450b9fe33d9c89768044a45cf9922c54710 EAP-Message = 0xd83e201a78cbec5ff7df962d1d13c1ce76f59c2fb2e9fc36da77a054442693d74d567300010500802a74984a5f651db815612265315dab94cf8ed8c35f12a8ee8dc65d8dfafff25805842759ee1c223670e1e0fb9f51955c53c3d149c00ea3ece7518a3b0b318b156b4f10fab1e590862ad49fbcae23df2430a00b43a1bad6b8a1e5f1fdb7d9c4e087d54303984ec695ef01e5a1dae25f12b9edaf1e0de139a13e990bf836e885bc01007594387c10b6cf639b83bb1551526e7edd3bb849d14dc36550f42316166daeed07f22037e614f598d8ee419f566efac7ad90b71d88799a5fcc5dd52cabacaaf3e1b86bd37786cf050f800edb179894dc8d6223 EAP-Message = 0x4a05c165eeb09b5db2f7bff6598bcd4cc6d8245d14ec9b7466f3f10395c02b82586687fe0c0f117cfa5d6bff8c6dc78899f4d7b62e6ec88467b4296ce9d6f4272254aa8d683545a26feb8b863f44fb13cc0083740dc540507327a2d004c06fe7691ca49eb813b33aff9442d1dba472830ec56b16bc5a20111598815131ba26aa9822b1176bb948597833f49bc2e46b6bdd80d76593b2d27b5cd23983bdc4b608a0029d25a3d2fcb3806bc9435616030100bb0d0000b305030401024000ab00a93081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b301906035504 EAP-Message = 0x0b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd1d2c5bcfe82148e0c4efca7138c662 Finished request 7. Going to the next request Waking up in 3.1 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=12, length=1487 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02f504fc0dc0000009ca16030107f40b0007f00007ed0003ab308203a73082028fa00302010202010a300b06092a864886f70d01010b3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d301e170d3135303532353032303233325a170d3136303532343032303233 EAP-Message = 0x325a305d311f301d06035504030c16657863656c73696f722e616b67686574746f2e636f6d310b3009060355040613025553312d302b06092a864886f70d010901161e73636f74742e612e6a6f686e736f6e4077656c6c73666172676f2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c5a9c7fb77faa3b27e434505743b5e7662a6abc512d873049cae8074243cfc556439e7b4780dfb054f63dfbf148303b4a41c3c495c3c4837661888d88ffe3d3561fad3a3a07a006b8bc0031fbaf7f659c321208741b4b778eaeb4b076df24bfd4858c49bc271b7ec8fe518083f360cd4c2980ba1e4abb48c42a136 EAP-Message = 0xb97f33d0ba311a1ccb604cbeaba1900060a83ecc5132c925ef0e1883a4c1c9a3fd10305cc1f852f3db3ee819e252fc82270d6642da69633ae255bdcd9c596d5b5fcc1ae32cd36f2968c9ef5945b829e2370f4b1ef1466e5b6a806c0381abe60c0e70e90ba12b847b856ec79151ac41b0ebfb3b26562c2fdac6380acc9485584c999982702f0203010001a32a3028300e0603551d0f0101ff04040302078030160603551d250101ff040c300a06082b06010505070302300d06092a864886f70d01010b050003820101007d3b8b74f07a5d7eb3acfa9870e571f69e9df262eaec17a4e9054aab826d7ce554cd6c7e159372be9efef6bd453b93d0f57b26 EAP-Message = 0x952dd184a421224f9dc3776c14ef596f47d5912dd87783c7d78ea14fca2f3eab987de8cd25434bf7c4f0a104b70fa6426677d300ccf844d1746c4649d91eaf82e7c8a9eae8b99960e3e0a9eb10599685bbbf4c6ada0c7a2d79bf23fe0cac48da9d444590fe378327c19ba1074c8f524592530c65c43c8b4c4b27b6534029dd87f140dca526b8d2731376b4ce55c3a9bdf88584a4bb9653394a4b8a1d0f6e3faaf5ba892daf7c52f7292c5c5d90ad7e6694d0f689e882998eddae207c584f92e77e0043a1afc685218f7f6643bd00043c3082043830820320a003020102020101300b06092a864886f70d01010b3081a63119301706035504030c10414b EAP-Message = 0x47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e6574776f726b204f7065726174696f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d301e170d3135303532343233313834335a170d3138303930353233313834335a3081a63119301706035504030c10414b47686574746f20434120524f4f5431153013060355040a0c0c414b47686574746f2e636f6d311b3019060355040b0c124e657477 EAP-Message = 0x6f726b204f706572617469 State = 0xcd1d2c5bcfe82148e0c4efca7138c662 Message-Authenticator = 0x298751ce5d021e84c76d895e0d8079f4 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 245 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 2506 [tls] Received EAP-TLS First Fragment of the message [tls] eaptls_verify returned 9 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 12 to 10.0.2.212 port 32817 EAP-Message = 0x01f600060d00 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcd1d2c5bceeb2148e0c4efca7138c662 Finished request 8. Going to the next request Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 10.0.2.212 port 32817, id=13, length=1455 User-Name = "excelsior.REDACTED" NAS-IP-Address = 10.0.2.212 NAS-Identifier = "0418d6105a2e" NAS-Port = 0 Called-Station-Id = "04-18-D6-1B-45-C1:secure.REDACTED" Calling-Station-Id = "80-BE-05-3A-12-72" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02f604de0d006f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d382b05f1f2b02e7d4e7029d8bc1abfaddc1d4d2c7fa97698adb0e930d4bbb780d3a38637c8943e2d2ecac3e190318ca0c24b58f1ab98fbbfa9f066452d3fae77183eaad7b8459f275cc4d2f8b84a60dee373e40dff311eab2b5db0e212739fc71298002e5265282568ffea594b7c7c0fed2adee0129df98474e69a9 EAP-Message = 0xfef0de66f643ff1883fcd74b98448db4e231be0eebe7a39144dc646473f91be952fb407429f944fffe2b16fc17a2e13cff5873043246f4c89ebc61e01427ced66633cf4685183e18fd1e906c88facb1878394181e00f1369d12c69825f22ae2ad31022cc35158a61e80a611ff3d8ddc0bb211baca7b4696f09491343456438585a7840db0203010001a371306f300f0603551d130101ff040530030101ff300e0603551d0f0101ff0404030201be304c0603551d250101ff0442304006082b0601050507030406082b0601050507030206082b0601050507030106082b0601050507030306072b06010502030406072b0601050203050604551d250030 EAP-Message = 0x0d06092a864886f70d01010b050003820101003998868f30bb38272971676fbfb238c12a845b76744db0a22dfcdd2026b08c22a5ad4c058c1379440372336cbb283bc9cabc6c7b0068b338c25e9dd37a6092a305afe2fd36af92a0bb2ad05ed31b131b3f5ce08df86f19d93251108e1ba90356e17aec90aab58f7d7a5878127fef2b98ebdd0d65934fa5e8c2905f845d124c1271b0a022f8c74304c3f1fc6c606367141945240a914b538239f27c525a8cdbc8c27a9a0324829d5d76b9265799375e69a7c3a50ba06cdb8698104c7d117c41fa5fe7c171fcb4bcc157bb1a1c61972be7cd8c672f232c7d9471d5f8a81dae59793a4dbd8f4000573a4651 EAP-Message = 0x8d94cc58c4cf1e9bb11ceceacadb58fe77ff4c086a3016030100861000008200804ab58d0bb504ba8bb26f9fd078ddcbc4aab6f191a7e1e48a524480cfa18bc27345f630b26ad1e3cd9f7ad682b523817dd0a5aacd64893ccc72a61bfdb27048497aec9cbdd524ceb647df1532e882e620b3e77aef1eef10fe24406f6ec8191a52a775ea1904cc67e821a95e975e998e4eeab9dc2702bb0fd7268357a0e289076316030101060f00010201004f060c2d60aa075ac423db932d27aefbb53d8acbd4be8a342ffaaa7673d7476e3570fe68076f5f01dde2bba47b2be20a33f7f3da5396e77eb0f9c8635e8caf4518cd6cec5fafcfde331f16214d543923c1 EAP-Message = 0xd8ba2376518d720ccaaea91f2e74d75e25586d5585700085f07abaa37767f460b5531242341cd9593974f7779fb4aed46e04763f7a3d5cdd40bb6eeb210099d7f77b5b800d86f34cc668b38332954abdaa04b683b343c3dff5c956f517a0b9867c3e002f98174f7502e58b0755a807e38550fc07b273caa714e49485396ddf95298de41f291319725b40bc272983a9abc5ac0eaccffeb4b50ecb0d456e4035b885d1ae1b28803a12148777dd770b0b1403010001011603010030943862ac5b33a9d15a6c49d981287e7bc9e8ada5924a68ea08562ec6fb5696c9aabc5aeb7408ccb8fbcdb5a4f25c37c6 State = 0xcd1d2c5bceeb2148e0c4efca7138c662 Message-Authenticator = 0x524988758316be767df6d5d82b608979 # Executing section authorize from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "excelsior.REDACTED", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 246 length 253 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 07f4], Certificate [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = excelsior.REDACTED [tls] --> BUF-Name = REDACTED CA ROOT [tls] --> subject = /CN=REDACTED CA ROOT/O=REDACTED/OU=Network Operations/ST=Alaska/C=US/L=Nome/emailAddress=REDACTED(a)gmail.com [tls] --> issuer = /CN=REDACTED CA ROOT/O=REDACTED/OU=Network Operations/ST=Alaska/C=US/L=Nome/emailAddress=REDACTED(a)gmail.com [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect (certificate signature failure): [excelsior.REDACTED/<via Auth-Type = EAP>] (from client melbourne.REDACTED port 0 cli 80-BE-05-3A-12-72) Using Post-Auth-Type REJECT # Executing group from file /Library/Server/radius/raddb/sites-enabled/default +- entering group REJECT {...} ++? if ("%{EAP-Message}") expand: %{EAP-Message} -> 0x02f604de0d006f6e73310f300d06035504080c06416c61736b61310b3009060355040613025553310d300b06035504070c044e6f6d653128302606092a864886f70d010901161973636f74742e612e6a6f686e736f6e40676d61696c2e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d382b05f1f2b02e7d4e7029d8bc1abfaddc1d4d2c7fa97698adb0e930d4bbb780d3a38637c8943e2d2ecac3e190318ca0c24b58f1ab98fbbfa9f066452d3fae77183eaad7b8459f275cc4d2f8b84a60dee373e40dff311eab2b5db0e212739fc71298002e5265282568ffea594b7c7c0fed2adee0129df98474e69a9 ? Evaluating ("%{EAP-Message}") -> TRUE ++? if ("%{EAP-Message}") -> TRUE ++- entering if ("%{EAP-Message}") {...} expand: %{Message-Authenticator} -> 0x524988758316be767df6d5d82b608979 +++[reply] returns noop ++- if ("%{EAP-Message}") returns noop [attr_filter.access_reject] expand: %{User-Name} -> excelsior.REDACTED attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 9 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 9 Sending Access-Reject of id 13 to 10.0.2.212 port 32817 EAP-Message = 0x04f60004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 1.9 seconds. Cleaning up request 0 ID 4 with timestamp +13 Cleaning up request 1 ID 5 with timestamp +13 Cleaning up request 2 ID 6 with timestamp +13 Waking up in 0.1 seconds. Cleaning up request 3 ID 7 with timestamp +13 Waking up in 1.0 seconds. Cleaning up request 4 ID 8 with timestamp +13 Waking up in 0.4 seconds. Cleaning up request 5 ID 9 with timestamp +15 Cleaning up request 6 ID 10 with timestamp +15 Cleaning up request 7 ID 11 with timestamp +15 Waking up in 0.1 seconds. Cleaning up request 8 ID 12 with timestamp +15 Waking up in 1.0 seconds. Cleaning up request 9 ID 13 with timestamp +15 Ready to process requests.

3 4