- Freeradius-Users - lists.freeradius.org

Policy on AI Agents
by Alan DeKok 23 Jan '26

23 Jan '26

We've started to get PRs which are untested AI slop. As such, we've created a policy to clarify when / where AI can be used. In short, AI is good for API completion, summaries, suggesting certain docs. PRs which are clearly untested AI slop will result in the submitter being banned from the GitHub repository. There isn't enough time in the day to review untested garbage code. https://github.com/FreeRADIUS/freeradius-server/blob/master/AGENTS.md

1 0

FreeRADIUS v.3.2.8 - preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length
by Ciummi 23 Jan '26

23 Jan '26

Hi everyone, I was using FreeRADIUS version 3.2.6 for x86_64-redhat-linux-gnu (Red Hat Enterprise Linux release 9.4), with Oracle Database 19 as the backend. I encountered some memory issues, so I upgraded to version 3.2.8, but the configuration in the preprocessing hints file, which was working perfectly with version 3.2.6, no longer works. DEFAULT Called-Station-Id =~ ".*491113$", User-Name =~ "^([^@]*)@((?i)libero.*)", Strip-User-Name = Yes Hint = "Access", Stripped-User-Name = "%{1}", Realm = "%{2}" 1) Version 3.2.6 echo "User-Name=brignani@libero.it,User-Password=******,Calling-Station-Id=_TEST-SDWAN-A0001,Called-Station-Id=755491113" | radclient -x 10.10.0.221:1812 auth "pippo" Sent Access-Request Id 3 from 0.0.0.0:55865 to xx.xx.x.xxx:1812 length 106 Message-Authenticator = 0x User-Name = "brignani(a)libero.it" User-Password = "******" Calling-Station-Id = "_TEST-SDWAN-A0001" Called-Station-Id = "755491113" Cleartext-Password = "******" Received Access-Accept Id 3 from xx.xx.x.xxx:1812 to xx.xx.x.xxx:55865 length 138 Service-Type = Framed-User Framed-Protocol = PPP Class = 0x415f313736393030393530385f4e413d554e4b4e4f574e5f313030303232375f323235373832365f313030303038385f313030303030305f313030305f595f4e5f305f313030303330385f305f4141413a7261643031 Message-Authenticator = 0xa0a3af25b5ebba0db2ad8f374aa7f5b4 Wed Jan 21 16:31:48 2026 : Debug: (0) EXPAND %{debug:3} Wed Jan 21 16:31:48 2026 : Debug: (0) --> 0 Wed Jan 21 16:31:48 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:31:48 2026 : Debug: (0) } # if (true == "true") = noop Wed Jan 21 16:31:48 2026 : Debug: (0) } # policy debug-rule = noop Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND ^([^@]*)@((?i) greenlake.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> ^([^@]*)@((?i) greenlake.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND ^([^@]*)@((?i) noise.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> ^([^@]*)@((?i) noise.it)$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0000$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0000$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*0020$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*2990$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*2990$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*1010$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*1010$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND .*491113$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> .*491113$ Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND ^([^@]*)@((?i)libero.*) Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> ^([^@]*)@((?i)libero.*) Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: hints: Matched DEFAULT at 138 Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND %{1} Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> brignani Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: EXPAND %{2} Wed Jan 21 16:31:48 2026 : Debug: (0) preprocess: --> libero.it Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Jan 21 16:31:48 2026 : Debug: (0) [preprocess] = ok Wed Jan 21 16:31:48 2026 : Debug: (0) if (!&request:User-Name) { Wed Jan 21 16:31:48 2026 : Debug: (0) if (!&request:User-Name) -> FALSE Wed Jan 21 16:31:48 2026 : Debug: (0) policy nas-info { Wed Jan 21 16:31:48 2026 : Debug: (0) update control { Wed Jan 21 16:31:48 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: calling cache-nas (rlm_cache) Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: EXPAND %{NAS-IP-Address} Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: --> xx.xx.x.xxx Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: Mutex acquired Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: No cache entry found for "xx.xx.x.xxx" Wed Jan 21 16:31:48 2026 : Debug: (0) cache-nas: Mutex released Wed Jan 21 16:31:48 2026 : Debug: (0) modsingle[authorize]: returned from cache-nas (rlm_cache) Wed Jan 21 16:31:48 2026 : Debug: (0) [cache-nas] = notfound Wed Jan 21 16:31:48 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:31:48 2026 : Debug: (0) if (notfound) -> TRUE Wed Jan 21 16:31:48 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:31:48 2026 : Debug: (0) update control { Wed Jan 21 16:31:48 2026 : Debug: (0) EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed Jan 21 16:31:48 2026 : Debug: (0) --> brignani Wed Jan 21 16:31:48 2026 : Debug: (0) SQL-User-Name set to 'brignani' 2) Version 3.2.8 [root@glaaarad01 ~]# echo "User-Name=brignani@libero.it,User-Password=******,Calling-Station-Id=_TEST-SDWAN-A0001,Called-Station-Id=755491113" | radclient -x 10.10.1.217:1812 auth "pippo" Sent Access-Request Id 9 from 0.0.0.0:48083 to xx.xx.x.xxx:1812 length 106 User-Name = "brignani(a)libero.it" User-Password = "******" Calling-Station-Id = "_TEST-SDWAN-A0001" Called-Station-Id = "755491113" Cleartext-Password = "******" Received Access-Reject Id 9 from xx.xx.x.xxx:1812 to xx.xx.x.xxx:48083 length 38 Message-Authenticator = 0xbca819113f66bc3aa5b2f79c3aef6ecc (0) -: Expected Access-Accept got Access-Reject Wed Jan 21 16:36:50 2026 : Debug: (0) EXPAND %{debug:3} Wed Jan 21 16:36:50 2026 : Debug: (0) --> 0 Wed Jan 21 16:36:50 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:36:50 2026 : Debug: (0) } # if (true == "true") = noop Wed Jan 21 16:36:50 2026 : Debug: (0) } # policy debug-rule = noop Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation failed with code (-51): NULL argument passed with non-zero length ... Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Jan 21 16:36:50 2026 : Debug: (0) [preprocess] = ok Wed Jan 21 16:36:50 2026 : Debug: (0) if (!&request:User-Name) { Wed Jan 21 16:36:50 2026 : Debug: (0) if (!&request:User-Name) -> FALSE Wed Jan 21 16:36:50 2026 : Debug: (0) policy nas-info { Wed Jan 21 16:36:50 2026 : Debug: (0) update control { Wed Jan 21 16:36:50 2026 : Debug: (0) } # update control = noop Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: calling cache-nas (rlm_cache) Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: EXPAND %{NAS-IP-Address} Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: --> xx.xx.x.xxx Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: Mutex acquired Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: No cache entry found for "xx.xx.x.xxx" Wed Jan 21 16:36:50 2026 : Debug: (0) cache-nas: Mutex released Wed Jan 21 16:36:50 2026 : Debug: (0) modsingle[authorize]: returned from cache-nas (rlm_cache) Wed Jan 21 16:36:50 2026 : Debug: (0) [cache-nas] = notfound Wed Jan 21 16:36:50 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:36:50 2026 : Debug: (0) if (notfound) -> TRUE Wed Jan 21 16:36:50 2026 : Debug: (0) if (notfound) { Wed Jan 21 16:36:50 2026 : Debug: (0) update control { Wed Jan 21 16:36:50 2026 : Debug: (0) EXPAND %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} Wed Jan 21 16:36:50 2026 : Debug: (0) --> brignani(a)libero.it Kind regards, Andrea

2 1

Forward copy of accounting events
by Karl Frauendienst 21 Jan '26

21 Jan '26

Good morning, I'm on my second FreeRADIUS installation, so I'm still getting a feel for how it works. It's authenticating WiFi users against Active Directory using the winbind + LDAP method described on the website. I have the winbind authentication and LDAP attribute checks working, and users are able to successfully connect, but I'm stuck on something with the accounting. This network has a device that tracks user logon events by receiving RADIUS accounting events (essentially keeps up with what user is on what IP address), but it's not really suitable as the only accounting server when it comes to troubleshooting or other matters. What I need is for FreeRADIUS to continue logging accounting events to disk as it is currently, but I need an additional copy of accounting events forwarded to another IP address. I know how to do this in Windows NPS, but I'm still trying to wrap my head around how to configure that in FreeRADIUS. I'm running FreeRADIUS 3.2.8 on Ubuntu Server 24.0.3. Thanks Karl > FreeRADIUS Version 3.2.8 > Copyright (C) 1999-2025 The FreeRADIUS server project and contributors > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License > For more information about these matters, see the file named COPYRIGHT > > FreeRADIUS is developed, maintained, and supported by InkBridge > Networks. > For commercial support, please email sales(a)inkbridgenetworks.com > https://inkbridgenetworks.com/ > Starting - reading configuration files ... > including dictionary file /usr/share/freeradius/dictionary > including dictionary file /usr/share/freeradius/dictionary.dhcp > including dictionary file /usr/share/freeradius/dictionary.vqp > including dictionary file /etc/freeradius/dictionary > including configuration file /etc/freeradius/radiusd.conf > including configuration file /etc/freeradius/proxy.conf > including configuration file /etc/freeradius/clients.conf > including files in directory /etc/freeradius/mods-enabled/ > including configuration file /etc/freeradius/mods-enabled/detail > including configuration file /etc/freeradius/mods-enabled/pap > including configuration file /etc/freeradius/mods-enabled/detail.log > including configuration file /etc/freeradius/mods-enabled/eap > including configuration file > /etc/freeradius/mods-enabled/proxy_rate_limit > including configuration file /etc/freeradius/mods-enabled/files > including configuration file /etc/freeradius/mods-enabled/date > including configuration file /etc/freeradius/mods-enabled/digest > including configuration file /etc/freeradius/mods-enabled/realm > including configuration file /etc/freeradius/mods-enabled/cache_auth > including configuration file /etc/freeradius/mods-enabled/attr_filter > including configuration file /etc/freeradius/mods-enabled/exec > including configuration file /etc/freeradius/mods-enabled/preprocess > including configuration file /etc/freeradius/mods-enabled/radutmp > including configuration file /etc/freeradius/mods-enabled/sradutmp > including configuration file /etc/freeradius/mods-enabled/utf8 > including configuration file /etc/freeradius/mods-enabled/ntlm_auth > including configuration file /etc/freeradius/mods-enabled/mschap > including configuration file /etc/freeradius/mods-enabled/unpack > including configuration file /etc/freeradius/mods-enabled/ldap > including configuration file /etc/freeradius/mods-enabled/soh > including configuration file /etc/freeradius/mods-enabled/logintime > including configuration file /etc/freeradius/mods-enabled/passwd > including configuration file /etc/freeradius/mods-enabled/always > including configuration file /etc/freeradius/mods-enabled/echo > including configuration file /etc/freeradius/mods-enabled/expiration > including configuration file /etc/freeradius/mods-enabled/unix > including configuration file > /etc/freeradius/mods-enabled/dynamic_clients > including configuration file /etc/freeradius/mods-enabled/linelog > including configuration file /etc/freeradius/mods-enabled/expr > including configuration file /etc/freeradius/mods-enabled/replicate > including configuration file /etc/freeradius/mods-enabled/totp > including configuration file /etc/freeradius/mods-enabled/chap > including files in directory /etc/freeradius/policy.d/ > including configuration file /etc/freeradius/policy.d/eap > including configuration file /etc/freeradius/policy.d/dhcp > including configuration file /etc/freeradius/policy.d/accounting > including configuration file /etc/freeradius/policy.d/debug > including configuration file /etc/freeradius/policy.d/filter > including configuration file /etc/freeradius/policy.d/abfab-tr > including configuration file /etc/freeradius/policy.d/canonicalization > including configuration file /etc/freeradius/policy.d/control > including configuration file /etc/freeradius/policy.d/operator-name > including configuration file /etc/freeradius/policy.d/rfc7542 > including configuration file > /etc/freeradius/policy.d/moonshot-targeted-ids > including configuration file /etc/freeradius/policy.d/cui > including files in directory /etc/freeradius/sites-enabled/ > including configuration file > /etc/freeradius/sites-enabled/inner-tunnel > including configuration file /etc/freeradius/sites-enabled/default > main { > security { > user = "freerad" > group = "freerad" > allow_core_dumps = no > } > name = "freeradius" > prefix = "/usr" > localstatedir = "/var" > logdir = "/var/log/freeradius" > run_dir = "/var/run/freeradius" > } > main { > name = "freeradius" > prefix = "/usr" > localstatedir = "/var" > sbindir = "/usr/sbin" > logdir = "/var/log/freeradius" > run_dir = "/var/run/freeradius" > libdir = "/usr/lib/freeradius" > radacctdir = "/var/log/freeradius/radacct" > hostname_lookups = no > max_request_time = 30 > proxy_dedup_window = 1 > cleanup_delay = 5 > max_requests = 16384 > max_fds = 512 > postauth_client_lost = no > pidfile = "/var/run/freeradius/freeradius.pid" > checkrad = "/usr/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > colourise = yes > msg_denied = "You are already logged in - access denied" > } > resources { > } > security { > max_attributes = 200 > reject_delay = 1.000000 > delay_proxy_rejects = no > status_server = yes > require_message_authenticator = "auto" > limit_proxy_state = "auto" > } > unlang { > group_stop_return = no > policy_stop_return = no > } > } > radiusd: #### Loading Realms and Home Servers #### > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > nonblock = no > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > secret = <<< secret >>> > response_window = 20.000000 > response_timeouts = 1 > max_outstanding = 65536 > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > check_timeout = 4 > num_answers_to_alive = 3 > revive_interval = 120 > limit { > max_connections = 16 > max_requests = 0 > lifetime = 0 > idle_timeout = 0 > } > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server linewize { > nonblock = no > ipaddr = <<< secret >>> > port = 1813 > type = "acct" > secret = <<< secret >>> > response_window = 30.000000 > response_timeouts = 1 > max_outstanding = 65536 > zombie_period = 40 > status_check = "none" > ping_interval = 30 > check_timeout = 4 > num_answers_to_alive = 3 > revive_interval = 300 > limit { > max_connections = 16 > max_requests = 0 > lifetime = 0 > idle_timeout = 0 > } > coa { > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > } > home_server_pool my_auth_failover { > type = fail-over > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client access_points { > ipaddr = <<< secret >>> > require_message_authenticator = "no" > secret = <<< secret >>> > proto = "*" > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > client localhost { > ipaddr = 127.0.0.1 > secret = <<< secret >>> > nas_type = "other" > proto = "*" > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 900 > } > } > Shared secret for client localhost is short, and likely can be > broken by an attacker. > client localhost_ipv6 { > ipv6addr = ::1 > secret = <<< secret >>> > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > Shared secret for client localhost_ipv6 is short, and likely can > be broken by an attacker. > Debugger not attached > Configuration version: 77e6-bd6c-9d72-6756 > # Creating Auth-Type = mschap > # Creating Auth-Type = eap > # Creating Auth-Type = PAP > # Creating Auth-Type = CHAP > # Creating Auth-Type = MS-CHAP > # Creating Auth-Type = digest > # Creating Autz-Type = New-TLS-Connection > radiusd: #### Instantiating modules #### > modules { > # Loaded module rlm_detail > # Loading module "detail" from file > /etc/freeradius/mods-enabled/detail > detail { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loaded module rlm_pap > # Loading module "pap" from file /etc/freeradius/mods-enabled/pap > pap { > normalise = yes > } > # Loading module "auth_log" from file > /etc/freeradius/mods-enabled/detail.log > detail auth_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loading module "reply_log" from file > /etc/freeradius/mods-enabled/detail.log > detail reply_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loading module "pre_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > detail pre_proxy_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loading module "post_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > detail post_proxy_log { > filename = > "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" > header = "%t" > permissions = 384 > locking = no > dates_as_integer = no > escape_filenames = no > log_packet_header = no > } > # Loaded module rlm_eap > # Loading module "eap" from file /etc/freeradius/mods-enabled/eap > eap { > default_eap_type = "md5" > timer_expire = 60 > max_eap_type = 52 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 16384 > dedup_key = "" > } > # Loaded module rlm_proxy_rate_limit > # Loading module "proxy_rate_limit" from file > /etc/freeradius/mods-enabled/proxy_rate_limit > proxy_rate_limit { > max_entries = 2048 > idle_timeout = 10 > num_subtables = 256 > window = 1 > } > # Loaded module rlm_files > # Loading module "files" from file > /etc/freeradius/mods-enabled/files > files { > filename = "/etc/freeradius/mods-config/files/authorize" > acctusersfile = "/etc/freeradius/mods-config/files/accounting" > preproxy_usersfile = > "/etc/freeradius/mods-config/files/pre-proxy" > } > # Loaded module rlm_date > # Loading module "date" from file /etc/freeradius/mods-enabled/date > date { > format = "%b %e %Y %H:%M:%S %Z" > utc = no > } > # Loading module "wispr2date" from file > /etc/freeradius/mods-enabled/date > date wispr2date { > format = "%Y-%m-%dT%H:%M:%S" > utc = no > } > # Loaded module rlm_digest > # Loading module "digest" from file > /etc/freeradius/mods-enabled/digest > # Loaded module rlm_realm > # Loading module "IPASS" from file > /etc/freeradius/mods-enabled/realm > realm IPASS { > format = "prefix" > delimiter = "/" > ignore_default = no > ignore_null = no > } > # Loading module "suffix" from file > /etc/freeradius/mods-enabled/realm > realm suffix { > format = "suffix" > delimiter = "@" > ignore_default = no > ignore_null = no > } > # Loading module "bangpath" from file > /etc/freeradius/mods-enabled/realm > realm bangpath { > format = "prefix" > delimiter = "!" > ignore_default = no > ignore_null = no > } > # Loading module "realmpercent" from file > /etc/freeradius/mods-enabled/realm > realm realmpercent { > format = "suffix" > delimiter = "%" > ignore_default = no > ignore_null = no > } > # Loading module "ntdomain" from file > /etc/freeradius/mods-enabled/realm > realm ntdomain { > format = "prefix" > delimiter = "\" > ignore_default = no > ignore_null = no > } > # Loaded module rlm_cache > # Loading module "cache_auth_accept" from file > /etc/freeradius/mods-enabled/cache_auth > cache cache_auth_accept { > driver = "rlm_cache_rbtree" > key = > "%{md5:%{%{Stripped-User-Name}:-%{User-Name}}%{User-Password}}" > ttl = 7200 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loading module "cache_auth_reject" from file > /etc/freeradius/mods-enabled/cache_auth > cache cache_auth_reject { > driver = "rlm_cache_rbtree" > key = > "%{md5:%{Calling-Station-Id}%{Stripped-User-Name}%{User-Password}}" > ttl = 3600 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loading module "cache_ldap_user_dn" from file > /etc/freeradius/mods-enabled/cache_auth > cache cache_ldap_user_dn { > driver = "rlm_cache_rbtree" > key = "%{Stripped-User-Name}" > ttl = 86400 > max_entries = 0 > epoch = 0 > add_stats = no > } > # Loaded module rlm_attr_filter > # Loading module "attr_filter.post-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.post-proxy { > filename = "/etc/freeradius/mods-config/attr_filter/post-proxy" > key = "%{Realm}" > relaxed = no > } > # Loading module "attr_filter.pre-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.pre-proxy { > filename = "/etc/freeradius/mods-config/attr_filter/pre-proxy" > key = "%{Realm}" > relaxed = no > } > # Loading module "attr_filter.access_reject" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.access_reject { > filename = > "/etc/freeradius/mods-config/attr_filter/access_reject" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.access_challenge" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.access_challenge { > filename = > "/etc/freeradius/mods-config/attr_filter/access_challenge" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.accounting_response" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.accounting_response { > filename = > "/etc/freeradius/mods-config/attr_filter/accounting_response" > key = "%{User-Name}" > relaxed = no > } > # Loading module "attr_filter.coa" from file > /etc/freeradius/mods-enabled/attr_filter > attr_filter attr_filter.coa { > filename = "/etc/freeradius/mods-config/attr_filter/coa" > key = "%{User-Name}" > relaxed = no > } > # Loaded module rlm_exec > # Loading module "exec" from file /etc/freeradius/mods-enabled/exec > exec { > wait = no > input_pairs = "request" > shell_escape = yes > timeout = 10 > } > # Loaded module rlm_preprocess > # Loading module "preprocess" from file > /etc/freeradius/mods-enabled/preprocess > preprocess { > huntgroups = "/etc/freeradius/mods-config/preprocess/huntgroups" > hints = "/etc/freeradius/mods-config/preprocess/hints" > with_ascend_hack = no > ascend_channels_per_line = 23 > with_ntdomain_hack = no > with_specialix_jetstream_hack = no > with_cisco_vsa_hack = no > with_alvarion_vsa_hack = no > } > # Loaded module rlm_radutmp > # Loading module "radutmp" from file > /etc/freeradius/mods-enabled/radutmp > radutmp { > filename = "/var/log/freeradius/radutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > permissions = 384 > caller_id = yes > } > # Loading module "sradutmp" from file > /etc/freeradius/mods-enabled/sradutmp > radutmp sradutmp { > filename = "/var/log/freeradius/sradutmp" > username = "%{User-Name}" > case_sensitive = yes > check_with_nas = yes > permissions = 420 > caller_id = no > } > # Loaded module rlm_utf8 > # Loading module "utf8" from file /etc/freeradius/mods-enabled/utf8 > # Loading module "ntlm_auth" from file > /etc/freeradius/mods-enabled/ntlm_auth > exec ntlm_auth { > wait = yes > program = "/path/to/ntlm_auth --request-nt-key > --domain=MYDOMAIN --username=%{mschap:User-Name} > --password=%{User-Password}" > shell_escape = yes > } > # Loaded module rlm_mschap > # Loading module "mschap" from file > /etc/freeradius/mods-enabled/mschap > mschap { > use_mppe = yes > require_encryption = yes > require_strong = yes > with_ntdomain_hack = yes > passchange { > } > allow_retry = yes > winbind_retry_with_normalised_username = no > } > # Loaded module rlm_unpack > # Loading module "unpack" from file > /etc/freeradius/mods-enabled/unpack > # Loaded module rlm_ldap > # Loading module "ldap" from file /etc/freeradius/mods-enabled/ldap > ldap { > server = <<< secret >>> > identity = <<< secret >>> > password = <<< secret >>> > sasl { > } > user_dn = "LDAP-UserDn" > user { > scope = "sub" > access_positive = yes > sasl { > } > } > group { > filter = "(objectClass=posixGroup)" > scope = "sub" > name_attribute = "cn" > membership_attribute = "memberOf" > cacheable_name = yes > cacheable_dn = yes > allow_dangling_group_ref = no > } > client { > filter = "(objectClass=radiusClient)" > scope = "sub" > base_dn = <<< secret >>> > } > profile { > } > options { > ldap_debug = 40 > chase_referrals = yes > rebind = yes > net_timeout = 1 > res_timeout = 10 > srv_timelimit = 3 > idle = 60 > probes = 3 > interval = 3 > } > tls { > cipher_list = "DEFAULT" > check_crl = no > start_tls = no > } > } > Creating attribute LDAP-Group > # Loaded module rlm_soh > # Loading module "soh" from file /etc/freeradius/mods-enabled/soh > soh { > dhcp = yes > } > # Loaded module rlm_logintime > # Loading module "logintime" from file > /etc/freeradius/mods-enabled/logintime > logintime { > minimum_timeout = 60 > } > # Loaded module rlm_passwd > # Loading module "etc_passwd" from file > /etc/freeradius/mods-enabled/passwd > passwd etc_passwd { > filename = "/etc/passwd" > format = "*User-Name:Crypt-Password:" > delimiter = ":" > ignore_nislike = no > ignore_empty = yes > allow_multiple_keys = no > hash_size = 100 > } > # Loaded module rlm_always > # Loading module "reject" from file > /etc/freeradius/mods-enabled/always > always reject { > rcode = "reject" > simulcount = 0 > mpp = no > } > # Loading module "fail" from file > /etc/freeradius/mods-enabled/always > always fail { > rcode = "fail" > simulcount = 0 > mpp = no > } > # Loading module "ok" from file /etc/freeradius/mods-enabled/always > always ok { > rcode = "ok" > simulcount = 0 > mpp = no > } > # Loading module "handled" from file > /etc/freeradius/mods-enabled/always > always handled { > rcode = "handled" > simulcount = 0 > mpp = no > } > # Loading module "invalid" from file > /etc/freeradius/mods-enabled/always > always invalid { > rcode = "invalid" > simulcount = 0 > mpp = no > } > # Loading module "userlock" from file > /etc/freeradius/mods-enabled/always > always userlock { > rcode = "userlock" > simulcount = 0 > mpp = no > } > # Loading module "notfound" from file > /etc/freeradius/mods-enabled/always > always notfound { > rcode = "notfound" > simulcount = 0 > mpp = no > } > # Loading module "noop" from file > /etc/freeradius/mods-enabled/always > always noop { > rcode = "noop" > simulcount = 0 > mpp = no > } > # Loading module "updated" from file > /etc/freeradius/mods-enabled/always > always updated { > rcode = "updated" > simulcount = 0 > mpp = no > } > # Loading module "echo" from file /etc/freeradius/mods-enabled/echo > exec echo { > wait = yes > program = "/bin/echo %{User-Name}" > input_pairs = "request" > output_pairs = "reply" > shell_escape = yes > } > # Loaded module rlm_expiration > # Loading module "expiration" from file > /etc/freeradius/mods-enabled/expiration > # Loaded module rlm_unix > # Loading module "unix" from file /etc/freeradius/mods-enabled/unix > unix { > radwtmp = "/var/log/freeradius/radwtmp" > } > Creating attribute Unix-Group > # Loaded module rlm_dynamic_clients > # Loading module "dynamic_clients" from file > /etc/freeradius/mods-enabled/dynamic_clients > # Loaded module rlm_linelog > # Loading module "linelog" from file > /etc/freeradius/mods-enabled/linelog > linelog { > filename = "/var/log/freeradius/linelog" > escape_filenames = no > syslog_severity = "info" > permissions = 384 > format = "This is a log message for %{User-Name}" > reference = "messages.%{%{reply:Packet-Type}:-default}" > } > # Loading module "log_accounting" from file > /etc/freeradius/mods-enabled/linelog > linelog log_accounting { > filename = "/var/log/freeradius/linelog-accounting" > escape_filenames = no > syslog_severity = "info" > permissions = 384 > format = "" > reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" > } > # Loaded module rlm_expr > # Loading module "expr" from file /etc/freeradius/mods-enabled/expr > expr { > safe_characters = > "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: > /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" > } > # Loaded module rlm_replicate > # Loading module "replicate" from file > /etc/freeradius/mods-enabled/replicate > # Loaded module rlm_totp > # Loading module "totp" from file /etc/freeradius/mods-enabled/totp > totp { > time_step = 30 > otp_length = 6 > lookback_steps = 1 > lookback_interval = 30 > lookforward_steps = 0 > } > # Loaded module rlm_chap > # Loading module "chap" from file /etc/freeradius/mods-enabled/chap > instantiate { > } > # Instantiating module "detail" from file > /etc/freeradius/mods-enabled/detail > # Instantiating module "pap" from file > /etc/freeradius/mods-enabled/pap > # Instantiating module "auth_log" from file > /etc/freeradius/mods-enabled/detail.log > rlm_detail (auth_log): 'User-Password' suppressed, will not appear > in detail output > # Instantiating module "reply_log" from file > /etc/freeradius/mods-enabled/detail.log > # Instantiating module "pre_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > # Instantiating module "post_proxy_log" from file > /etc/freeradius/mods-enabled/detail.log > # Instantiating module "eap" from file > /etc/freeradius/mods-enabled/eap > # Linked to sub-module rlm_eap_md5 > # Linked to sub-module rlm_eap_gtc > gtc { > challenge = "Password: " > auth_type = "PAP" > } > # Linked to sub-module rlm_eap_tls > tls { > tls = "tls-common" > } > tls-config tls-common { > verify_depth = 0 > ca_path = "/etc/freeradius/certs" > pem_file_type = yes > private_key_file = "/etc/freeradius/certs/server.key" > certificate_file = "/etc/freeradius/certs/server.pem" > ca_file = "/etc/freeradius/certs/ca.pem" > private_key_password = <<< secret >>> > fragment_size = 1024 > include_length = yes > auto_chain = yes > check_crl = no > check_all_crl = no > ca_path_reload_interval = 0 > cipher_list = "DEFAULT" > cipher_server_preference = no > reject_unknown_intermediate_ca = no > ecdh_curve = "" > tls_max_version = "1.2" > tls_min_version = "1.2" > cache { > enable = yes > lifetime = 24 > max_entries = 255 > } > verify { > skip_if_ocsp_ok = no > } > ocsp { > enable = no > override_cert_url = yes > url = "http://127.0.0.1/ocsp/" > use_nonce = yes > timeout = 0 > softfail = no > } > } > # Linked to sub-module rlm_eap_ttls > ttls { > tls = "tls-common" > default_eap_type = "md5" > copy_request_to_tunnel = yes > use_tunneled_reply = no > virtual_server = "inner-tunnel" > include_length = yes > require_client_cert = no > } > tls: Using cached TLS configuration from previous invocation > # Linked to sub-module rlm_eap_peap > peap { > tls = "tls-common" > default_eap_type = "mschapv2" > copy_request_to_tunnel = yes > use_tunneled_reply = no > proxy_tunneled_request_as_eap = yes > virtual_server = "inner-tunnel" > soh = no > require_client_cert = no > } > tls: Using cached TLS configuration from previous invocation > # Linked to sub-module rlm_eap_mschapv2 > mschapv2 { > with_ntdomain_hack = no > send_error = no > identity = "CMSD-AAA" > } > # Instantiating module "proxy_rate_limit" from file > /etc/freeradius/mods-enabled/proxy_rate_limit > # Instantiating module "files" from file > /etc/freeradius/mods-enabled/files > reading pairlist file /etc/freeradius/mods-config/files/authorize > reading pairlist file /etc/freeradius/mods-config/files/accounting > reading pairlist file /etc/freeradius/mods-config/files/pre-proxy > # Instantiating module "IPASS" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "suffix" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "bangpath" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "realmpercent" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "ntdomain" from file > /etc/freeradius/mods-enabled/realm > # Instantiating module "cache_auth_accept" from file > /etc/freeradius/mods-enabled/cache_auth > rlm_cache (cache_auth_accept): Driver rlm_cache_rbtree (module > rlm_cache_rbtree) loaded and linked > # Instantiating module "cache_auth_reject" from file > /etc/freeradius/mods-enabled/cache_auth > rlm_cache (cache_auth_reject): Driver rlm_cache_rbtree (module > rlm_cache_rbtree) loaded and linked > # Instantiating module "cache_ldap_user_dn" from file > /etc/freeradius/mods-enabled/cache_auth > rlm_cache (cache_ldap_user_dn): Driver rlm_cache_rbtree (module > rlm_cache_rbtree) loaded and linked > # Instantiating module "attr_filter.post-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/post-proxy > # Instantiating module "attr_filter.pre-proxy" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/pre-proxy > # Instantiating module "attr_filter.access_reject" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/access_reject > # Instantiating module "attr_filter.access_challenge" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/access_challenge > # Instantiating module "attr_filter.accounting_response" from > file /etc/freeradius/mods-enabled/attr_filter > reading pairlist file > /etc/freeradius/mods-config/attr_filter/accounting_response > # Instantiating module "attr_filter.coa" from file > /etc/freeradius/mods-enabled/attr_filter > reading pairlist file /etc/freeradius/mods-config/attr_filter/coa > # Instantiating module "preprocess" from file > /etc/freeradius/mods-enabled/preprocess > reading pairlist file > /etc/freeradius/mods-config/preprocess/huntgroups > reading pairlist file /etc/freeradius/mods-config/preprocess/hints > # Instantiating module "mschap" from file > /etc/freeradius/mods-enabled/mschap > rlm_mschap (mschap): Initialising connection pool > pool { > start = 5 > min = 3 > max = 32 > spare = 10 > uses = 0 > lifetime = 86400 > cleanup_interval = 300 > idle_timeout = 600 > retry_delay = 30 > max_retries = 5 > spread = no > } > rlm_mschap (mschap): authenticating directly to winbind > # Instantiating module "ldap" from file > /etc/freeradius/mods-enabled/ldap > rlm_ldap: libldap vendor: OpenLDAP, version: 20607 > accounting { > reference = "%{tolower:type.%{Acct-Status-Type}}" > } > post-auth { > reference = "." > } > rlm_ldap (ldap): Initialising connection pool > pool { > start = 5 > min = 3 > max = 32 > spare = 10 > uses = 0 > lifetime = 0 > cleanup_interval = 30 > idle_timeout = 60 > retry_delay = 30 > max_retries = 5 > spread = no > } > # Instantiating module "logintime" from file > /etc/freeradius/mods-enabled/logintime > # Instantiating module "etc_passwd" from file > /etc/freeradius/mods-enabled/passwd > rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no > # Instantiating module "reject" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "fail" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "ok" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "handled" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "invalid" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "userlock" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "notfound" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "noop" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "updated" from file > /etc/freeradius/mods-enabled/always > # Instantiating module "expiration" from file > /etc/freeradius/mods-enabled/expiration > # Instantiating module "linelog" from file > /etc/freeradius/mods-enabled/linelog > # Instantiating module "log_accounting" from file > /etc/freeradius/mods-enabled/linelog > # Instantiating module "totp" from file > /etc/freeradius/mods-enabled/totp > } # modules > radiusd: #### Loading Virtual Servers #### > server { # from file /etc/freeradius/radiusd.conf > } # server > server inner-tunnel { # from file > /etc/freeradius/sites-enabled/inner-tunnel > # Loading authenticate {...} > Compiling Auth-Type PAP for attr Auth-Type > Compiling Auth-Type CHAP for attr Auth-Type > Compiling Auth-Type MS-CHAP for attr Auth-Type > # Loading authorize {...} > Ignoring "sql" (see raddb/mods-available/README.rst) > # Loading post-proxy {...} > # Loading post-auth {...} > # Skipping contents of 'if' as it is always 'false' -- > /etc/freeradius/sites-enabled/inner-tunnel:389 > Compiling Post-Auth-Type REJECT for attr Post-Auth-Type > } # server inner-tunnel > server default { # from file /etc/freeradius/sites-enabled/default > # Loading authenticate {...} > Compiling Auth-Type PAP for attr Auth-Type > Compiling Auth-Type CHAP for attr Auth-Type > Compiling Auth-Type MS-CHAP for attr Auth-Type > # Loading authorize {...} > Compiling Autz-Type New-TLS-Connection for attr Autz-Type > # Loading preacct {...} > # Loading accounting {...} > # Loading post-auth {...} > Compiling Post-Auth-Type REJECT for attr Post-Auth-Type > Compiling Post-Auth-Type Challenge for attr Post-Auth-Type > Compiling Post-Auth-Type Client-Lost for attr Post-Auth-Type > } # server default > radiusd: #### Skipping IP addresses and Ports #### > listen { > type = "auth" > ipaddr = 127.0.0.1 > port = 18120 > } > listen { > type = "auth" > ipaddr = * > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 900 > } > } > listen { > type = "acct" > ipaddr = * > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > listen { > type = "auth" > ipv6addr = :: > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > listen { > type = "acct" > ipv6addr = :: > port = 0 > limit { > max_connections = 16 > lifetime = 0 > idle_timeout = 30 > } > } > Configuration appears to be OK

2 2

debug tls connection
by Jim Shi 20 Jan '26

20 Jan '26

I am trying to figure out tls connection is failing. Here is freeradius server log:can someone please provide come clue? 6) session-state: No cached attributes (6) # Executing section authorize from file /ngs/app/idmspp/freeradius/etc/raddb/sites-enabled/default (6) authorize { (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 1276 (6) eap: No EAP Start, assuming it's an on-going EAP conversation (6) [eap] = updated (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = noop (6) } # authorize = updated (6) Found Auth-Type = eap (6) # Executing group from file /ngs/app/idmspp/freeradius/etc/raddb/sites-enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x39f46d743cf36072 (6) eap: Finished EAP session with state 0x39f46d743cf36072 (6) eap: Previous EAP request found for state 0x39f46d743cf36072, released from the list (6) eap: Peer sent packet with method EAP TLS (13) (6) eap: Calling submodule eap_tls to process data (6) eap_tls: Continuing EAP-TLS (6) eap_tls: Peer indicated complete TLS record size will be 3550 bytes (6) eap_tls: Expecting 3 TLS record fragments (6) eap_tls: Got first TLS record fragment (1266 bytes). Peer indicated more fragments to follow (6) eap_tls: [eaptls verify] = first fragment (6) eap_tls: ACKing Peer's TLS record fragment (6) eap_tls: [eaptls process] = handled (6) eap: Sending EAP Request (code 1) ID 8 length 6 (6) eap: EAP session adding &reply:State = 0x39f46d743ffc6072 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge

2 1

FreeRADIUS 3.2.8 with EAP-FAST: MS-CHAP2-Response is incorrect
by Dennis Bland 16 Jan '26

16 Jan '26

Hi FreeRADIUS: I've compiled/installed FreeRADIUS 3.2.8 on Ubuntu 24.04 (Linux 6.8.0 and OpenSSL 3.0.13), and it gives the attached "MS-CHAP2 Response is incorrect" error during inner tunnel negotiation in Phase 0 (PAC file creation) of EAP-FAST. Upgrading the Linux kernel to 6.16 and OpenSSL 3.0.16 gives the same result. Compiling the latest FreeRADIUS 3.2.x branch head (3.2.9 dev) as of a few days ago also gives the same result. Note that EAP-PEAP/MSCHAPV2 works fine (log also attached) on the identical supplicant / authenticator / authentication server platform. The supplicant is also on a Ubuntu 24.04 platform (OpenSSL 3.0.13), running the latest snapshot of wpa_supplicant, and TLS 1.3 has been confirmed working with EAP-PEAP when tls_max is set to 1.3 in FreeRADIUS on the authentication server. Supplicant version: dbland@NUC13-Linux2:~$ wpa_supplicant -v wpa_supplicant v2.12-devel-20251221-hostap_2_11-1307-g3ea5c0df5+ Copyright (c) 2003-2024, Jouni Malinen <j(a)w1.fi> and contributors dbland@NUC13-Linux2:~$ Supplicant EAP-FAST configuration: network={ ssid="asus6e_5" proto=RSN key_mgmt=WPA-EAP bgscan="simple:5:-70:60" eap=FAST identity="bob_loblaw" anonymous_identity="FAST-123456789012" password="password" phase1="fast_provisioning=1" phase2="auth=MSCHAPV2" pac_file="/home/dbland/certs_nuc13/bob_loblaw.pac" } Background: Recent Ubuntu versions have forcibly disabled TLS 1.0 and TLS 1.1, and EAP-FAST support with TLS 1.2 was first introduced in FreeRADIUS 3.2.8. However, the FreeRADIUS package version bundled with Ubuntu 24.04 is version 3.2.5, and version 3.2.7 with Ubuntu 25.10. This unfortunately leaves a gap in EAP-FAST support. Until a newer FreeRADIUS package is available on Ubuntu, compiling the 3.2.8 source seems to be the only option in order to support BOTH TLS 1.3 with EAP-PEAP and TLS 1.2 with EAP-FAST. Any further troubleshooting suggestions? From reading the mailing list archives, I've seen this EAP-FAST issue pop up a few times in the past on earlier 3.0.x versions, but with no resolution. Best regards, Dennis Bland

2 7

Fw: Subscriber session limit
by Filip Nikolić 15 Jan '26

15 Jan '26

Dear, Freeradius Team I need your support in order to help me to achieve the challenge. I am trying to run more then 30000 sessions but every time I run the sessions I am reaching the 28232. Do you know maybe where it can be issue? Thanks, Filip

2 3

new connection problem
by Can Paçacı 15 Jan '26

15 Jan '26

Hi, In FR 3.0, in the NAS network link interruptions, I receive the error *"rlm_sql (sql): Cannot open new connection, already at max"*. What should I pay attention to when increasing the *max_requests* value? Is increasing this value sufficient, or are there any parameters in the SQL pool settings that I also need to increase? Regards

2 5

Decoupling RADIUS Auth/Acct and Moving Toward SQL-less Accounting
by Erdal Emlik 14 Jan '26

14 Jan '26

Hi, I would like to get your input on a structural change we are planning. In our current setup, we have 8 RADIUS instances handling both Authentication (Auth) and Accounting (Acct) on the same server, utilizing PostgreSQL as the storage backend. We are planning to migrate to a scenario where we decouple these responsibilities into dedicated RADIUS instances for Auth and Acct. Currently, we store only the latest sessions in RadAcct to support functions like simultaneous-use. The rest of the accounting data is generally forwarded through RADIUS to a Kafka server. My goal is to eliminate SQL from the accounting process entirely. Ideally, I want to forward incoming accounting packets directly to Kafka and immediately return a response. I can find a workaround for maintaining session states without writing them to SQL, but I am stuck on how to manage IP pool (ippool) operations efficiently. It seems there might be no way to avoid using a database for IP management, and it might not even be logical to do so, but I wanted to hear your perspective on this. Looking forward to your thoughts. Best regards,

3 2

Authentication with rlm_python module failes for iphone, works for android, windows, linux
by The2nd 13 Jan '26

13 Jan '26

Hello list, i hope this is the right list for this question. I've written a python module to be used with freeradius and it works for wlan authentication (mschapv2) with windows, linux and android devices. But it fails with iphone/ios. With iOS is see the request in my python module and it authenticates against my server successfully but the iPhone always tells me "Unable to join the network <ssid>". My python module can be found here: https://github.com/the2nd/otpme/blob/main/otpme/lib/freeradius/otpme.py As it works with linux, windows and android i think its not completely wrong. Debug log of a successful authentication with my android device: FreeRADIUS Version 3.2.6 Copyright (C) 1999-2023 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /var/run/otpme/freeradius/radiusd.conf including configuration file /var/run/otpme/freeradius/clients.conf main { security { user = "otpme" group = "otpme" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/otpme" run_dir = "/var/run/otpme" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/otpme" run_dir = "/var/run/otpme" libdir = "/usr/lib" radacctdir = "/var/log/otpme/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/var/run/otpme/pidfiles/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### Debugger not attached # Creating Auth-Type = python_otpme # Creating Auth-Type = EAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_mschap # Loading module "mschap" from file /var/run/otpme/freeradius/radiusd.conf mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_eap # Loading module "eap" from file /var/run/otpme/freeradius/radiusd.conf eap { default_eap_type = "mschapv2" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 dedup_key = "" } # Loading module "mschap_otp" from file /var/run/otpme/freeradius/radiusd.conf mschap mschap_otp { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/otpme-auth verify_mschap --socket '%{%{Stripped-User-Name}:-%{%{User-Name}:-None}}' '%{%{mschap_otp:Challenge}:-00}' '%{%{mschap_otp:NT-Response}:-00}' '%{NAS-Identifier}' '%{Client-IP-Address}'" passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_python3 # Loading module "python_otpme" from file /var/run/otpme/freeradius/radiusd.conf python3 python_otpme { mod_instantiate = "otpme.lib.freeradius.otpme" func_instantiate = "instantiate" mod_authorize = "otpme.lib.freeradius.otpme" func_authorize = "authorize" mod_authenticate = "otpme.lib.freeradius.otpme" func_authenticate = "authenticate" python_path = "/var/run/otpme/freeradius/mods-config/python3:/opt/otpme/lib/python3.11/site-packages" cext_compat = yes pass_all_vps = no pass_all_vps_dict = no } # Instantiating module "mschap" from file /var/run/otpme/freeradius/radiusd.conf rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /var/run/otpme/freeradius/radiusd.conf # Linked to sub-module rlm_eap_md5 rlm_eap (EAP): Ignoring EAP method 'leap', because it is no longer supported # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 pem_file_type = yes private_key_file = "/var/run/otpme/freeradius/key.pem" certificate_file = "/var/run/otpme/freeradius/cert.pem" ca_file = "/var/run/otpme/freeradius/ca.pem" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } tls: Please use 'tls_min_version' and 'tls_max_version' instead of 'disable_tlsv1' tls: Please use 'tls_min_version' and 'tls_max_version' instead of 'disable_tlsv1_1' # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "otpme" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "otpme" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap_otp" from file /var/run/otpme/freeradius/radiusd.conf rlm_mschap (mschap_otp): authenticating by calling 'ntlm_auth' # Instantiating module "python_otpme" from file /var/run/otpme/freeradius/radiusd.conf Python version: 3.11.13 (main, Jul 3 2025, 11:31:00) [GCC 12.2.1 20230428] otpme.py: OTPme config verfied successful. otpme.py: Instantiated OTPme module. } # modules radiusd: #### Loading Virtual Servers #### server { # from file /var/run/otpme/freeradius/radiusd.conf } # server server otpme { # from file /var/run/otpme/freeradius/radiusd.conf # Loading authenticate {...} Compiling Auth-Type EAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} } # server otpme radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 client 10.219.195.225 { ipv4addr = 10.219.195.225 secret = <<< secret >>> shortname = "ap01-hbap-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.219.195.223 { ipv4addr = 10.219.195.223 secret = <<< secret >>> shortname = "cloudix-nextcloud-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 127.0.0.1 { ipv4addr = 127.0.0.1 secret = <<< secret >>> shortname = "localhost-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.219.195.100 { ipv4addr = 10.219.195.100 secret = <<< secret >>> shortname = "sharewatcher-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.219.195.254 { ipv4addr = 10.219.195.254 secret = <<< secret >>> shortname = "smtp-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address * port 1812 bound to server otpme Ready to process requests (0) Received Access-Request Id 162 from 10.219.195.225:38276 to 10.219.195.1:1812 length 204 (0) User-Name = "anonymous" (0) NAS-Identifier = "ap01-hbap" (0) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) NAS-Port = 1 (0) Calling-Station-Id = "42-33-75-43-BE-2D" (0) Connect-Info = "CONNECT 54Mbps 802.11a" (0) Acct-Session-Id = "BF0C189E956F9999" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027073 (0) Framed-MTU = 1400 (0) EAP-Message = 0x0277000e01616e6f6e796d6f7573 (0) Message-Authenticator = 0xe8db3a835195304aa1c2e8655f6cea44 (0) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (0) authorize { (0) eap: Peer sent EAP Response (code 2) ID 119 length 14 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) if (!control:Auth-Type) { (0) if (!control:Auth-Type) -> FALSE (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (0) Auth-Type EAP { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_mschapv2 to process data (0) eap_mschapv2: Issuing Challenge (0) eap: Sending EAP Request (code 1) ID 120 length 42 (0) eap: EAP session adding &reply:State = 0x64b8ac1d64c0b641 (0) [eap] = handled (0) } # Auth-Type EAP = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) Sent Access-Challenge Id 162 from 10.219.195.1:1812 to 10.219.195.225:38276 length 100 (0) EAP-Message = 0x0178002a1a0178002510784b2270bd2bafab1ed5f5a37c9ae5e8667265657261646975732d332e322e36 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x64b8ac1d64c0b641aa9dae41afb34712 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 163 from 10.219.195.225:38276 to 10.219.195.1:1812 length 214 (1) User-Name = "anonymous" (1) NAS-Identifier = "ap01-hbap" (1) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 1 (1) Calling-Station-Id = "42-33-75-43-BE-2D" (1) Connect-Info = "CONNECT 54Mbps 802.11a" (1) Acct-Session-Id = "BF0C189E956F9999" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x027800060319 (1) State = 0x64b8ac1d64c0b641aa9dae41afb34712 (1) Message-Authenticator = 0x2bd3281b58e070552d01366780334918 (1) session-state: No cached attributes (1) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (1) authorize { (1) eap: Peer sent EAP Response (code 2) ID 120 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) if (!control:Auth-Type) { (1) if (!control:Auth-Type) -> FALSE (1) } # authorize = updated (1) Found Auth-Type = EAP (1) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (1) Auth-Type EAP { (1) eap: Removing EAP session with state 0x64b8ac1d64c0b641 (1) eap: Previous EAP request found for state 0x64b8ac1d64c0b641, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: (TLS) PEAP -Initiating new session (1) eap: Sending EAP Request (code 1) ID 121 length 6 (1) eap: EAP session adding &reply:State = 0x64b8ac1d65c1b541 (1) [eap] = handled (1) } # Auth-Type EAP = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) session-state: Saving cached attributes (1) Framed-MTU = 994 (1) Sent Access-Challenge Id 163 from 10.219.195.1:1812 to 10.219.195.225:38276 length 64 (1) EAP-Message = 0x017900061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x64b8ac1d65c1b541aa9dae41afb34712 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 164 from 10.219.195.225:38276 to 10.219.195.1:1812 length 446 (2) User-Name = "anonymous" (2) NAS-Identifier = "ap01-hbap" (2) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) NAS-Port = 1 (2) Calling-Station-Id = "42-33-75-43-BE-2D" (2) Connect-Info = "CONNECT 54Mbps 802.11a" (2) Acct-Session-Id = "BF0C189E956F9999" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027076 (2) WLAN-AKM-Suite = 1027073 (2) Framed-MTU = 1400 (2) EAP-Message = 0x027900ee1980000000e416030100df010000db0303204b82994ddeede4b1efd09220705397da7cefa712c268070e9c45dd100931cd20e74544c9e44528171eb11e711a721ac7bce002642c974be41e1cbc3625b7f02d0022130113021303c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f00350100007000170000ff01000100000a00080006001d00170018000b00020100000d00140012040308040401050308050501080606010201003300260024001d002032c7b45122c64b455fb50da767a2cc4ce59b726e3cd9bd403abba61c883ac722002d00020101002b0009080304030303020301 (2) State = 0x64b8ac1d65c1b541aa9dae41afb34712 (2) Message-Authenticator = 0xcc735b6b3bf60fe0d35655caee8b130a (2) Restoring &session-state (2) &session-state:Framed-MTU = 994 (2) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (2) authorize { (2) eap: Peer sent EAP Response (code 2) ID 121 length 238 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) if (!control:Auth-Type) { (2) if (!control:Auth-Type) -> FALSE (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (2) Auth-Type EAP { (2) eap: Removing EAP session with state 0x64b8ac1d65c1b541 (2) eap: Previous EAP request found for state 0x64b8ac1d65c1b541, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: (TLS) EAP Peer says that the final record size will be 228 bytes (2) eap_peap: (TLS) EAP Got all data (228 bytes) (2) eap_peap: (TLS) PEAP - Handshake state - before SSL initialization (2) eap_peap: (TLS) PEAP - Handshake state - Server before SSL initialization (2) eap_peap: (TLS) PEAP - Handshake state - Server before SSL initialization (2) eap_peap: (TLS) PEAP - recv TLS 1.3 Handshake, ClientHello (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read client hello (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerHello (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server hello (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, Certificate (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write certificate (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write key exchange (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server done (2) eap_peap: (TLS) PEAP - Server : Need to read more data: SSLv3/TLS write server done (2) eap_peap: (TLS) PEAP - In Handshake Phase (2) eap: Sending EAP Request (code 1) ID 122 length 1004 (2) eap: EAP session adding &reply:State = 0x64b8ac1d66c2b541 (2) [eap] = handled (2) } # Auth-Type EAP = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (2) Sent Access-Challenge Id 164 from 10.219.195.1:1812 to 10.219.195.225:38276 length 1068 (2) EAP-Message = 0x017a03ec19c000000bd7160303003d020000390303406d024d9f92625990729dd1d0d2b54f155819983be5efc77c0843cfd0c7410400c02f000011ff01000100000b000403000102001700001603030a350b000a31000a2e000499308204953082027da003020102020705fea02d221361300d06092a864886f70d01010b05003076312a302806035504030c212f68626f73732e696e7465726e2f6b6f626c656e7a2f6361732f534954455f4341310b3009060355040613024445310c300a06035504080c03524c503110300e06035504070c074b6f626c656e7a310e300c060355040a0c0548424f5353310b3009060355040b0c024954301e170d3233303632313039313330395a170d3338303631373039313330395a3069311d301b06035504030c146b6f626c656e7a2e68626f73732e696e7465726e310b3009060355040613024445310c300a06035504080c03524c503110300e06035504070c074b6f626c656e7a310e300c060355040a0c0548424f535331 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x64b8ac1d66c2b541aa9dae41afb34712 (2) Finished request Waking up in 4.8 seconds. (3) Received Access-Request Id 165 from 10.219.195.225:38276 to 10.219.195.1:1812 length 214 (3) User-Name = "anonymous" (3) NAS-Identifier = "ap01-hbap" (3) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) NAS-Port = 1 (3) Calling-Station-Id = "42-33-75-43-BE-2D" (3) Connect-Info = "CONNECT 54Mbps 802.11a" (3) Acct-Session-Id = "BF0C189E956F9999" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027076 (3) WLAN-AKM-Suite = 1027073 (3) Framed-MTU = 1400 (3) EAP-Message = 0x027a00061900 (3) State = 0x64b8ac1d66c2b541aa9dae41afb34712 (3) Message-Authenticator = 0xeb39f94920377984aec242aa3813e06a (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (3) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (3) authorize { (3) eap: Peer sent EAP Response (code 2) ID 122 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) if (!control:Auth-Type) { (3) if (!control:Auth-Type) -> FALSE (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (3) Auth-Type EAP { (3) eap: Removing EAP session with state 0x64b8ac1d66c2b541 (3) eap: Previous EAP request found for state 0x64b8ac1d66c2b541, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: (TLS) Peer ACKed our handshake fragment (3) eap: Sending EAP Request (code 1) ID 123 length 1000 (3) eap: EAP session adding &reply:State = 0x64b8ac1d67c3b541 (3) [eap] = handled (3) } # Auth-Type EAP = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) session-state: Saving cached attributes (3) Framed-MTU = 994 (3) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (3) Sent Access-Challenge Id 165 from 10.219.195.1:1812 to 10.219.195.225:38276 length 1064 (3) EAP-Message = 0x017b03e819406729c41ca39fed55f40b0703e590f4ef3fe75165ed505d0e8e33187c7f82a4fa97311282257e3dca08d5818a76cee90d8aea88403b1d62eda2f8ed0e7cc7d72ce4f25e3497d7cbb88d5fb3e76fd5eb2cb7c29126896e5cf175ca9a6b177812f14e4ad1acc69c7a07a33ad3e880179c3971584f08442b7bfe40153886a8e68f88b2ebd088522f0214474a905d560fa04a8f20a966b67e072e644b106f92e95d3fc468afe1b60ff5b30eabfd9eb217f1847f6a24ab5f922365ecc2bb16be43951cbf4cf33735cd9fc4a0337c1632c68690fb8748b78e6f1fe6534e092fc9b9f25123a0a3ed26215dc6b0b765bbe2272058c9bf0935cb8ac47c5b1f7bd20e474f71a760f1db1b8a45da00058f3082058b30820373a003020102020705fea02cf10b27300d06092a864886f70d01010b05003077312b302906035504030c222f68626f73732e696e7465726e2f6b6f626c656e7a2f6361732f5245414c4d5f4341310b3009060355040613024445310c300a06 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x64b8ac1d67c3b541aa9dae41afb34712 (3) Finished request Waking up in 4.8 seconds. (4) Received Access-Request Id 166 from 10.219.195.225:38276 to 10.219.195.1:1812 length 214 (4) User-Name = "anonymous" (4) NAS-Identifier = "ap01-hbap" (4) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) NAS-Port = 1 (4) Calling-Station-Id = "42-33-75-43-BE-2D" (4) Connect-Info = "CONNECT 54Mbps 802.11a" (4) Acct-Session-Id = "BF0C189E956F9999" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027076 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) EAP-Message = 0x027b00061900 (4) State = 0x64b8ac1d67c3b541aa9dae41afb34712 (4) Message-Authenticator = 0xed6b5266742723e30e700e8b4f75739f (4) Restoring &session-state (4) &session-state:Framed-MTU = 994 (4) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (4) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (4) authorize { (4) eap: Peer sent EAP Response (code 2) ID 123 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) if (!control:Auth-Type) { (4) if (!control:Auth-Type) -> FALSE (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (4) Auth-Type EAP { (4) eap: Removing EAP session with state 0x64b8ac1d67c3b541 (4) eap: Previous EAP request found for state 0x64b8ac1d67c3b541, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: (TLS) Peer ACKed our handshake fragment (4) eap: Sending EAP Request (code 1) ID 124 length 1000 (4) eap: EAP session adding &reply:State = 0x64b8ac1d60c4b541 (4) [eap] = handled (4) } # Auth-Type EAP = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (4) Sent Access-Challenge Id 166 from 10.219.195.1:1812 to 10.219.195.225:38276 length 1064 (4) EAP-Message = 0x017c03e81940603ef2f2884b299ace212671ea16a0df8d30640875c03aaef2ac1e4cd0b45487fcb99234083e915ecded1171c41b3eb10b7c736e781a97f17e3aa3b85d0f5b5f35d09ce1570d621b9dc5be4b4f9ecae899a6d0949b7eed4ebcbf64a48aa40d41d3c07d33da2e8d816dd2eba719a8b75d53dfa7ecb5a35b7cec093710efea7ff30203010001a31d301b300c0603551d13040530030101ff300b0603551d0f040403020106300d06092a864886f70d01010b0500038202010048ed80b6b8d9f45c988d3a8c439f33112acf5a1a90a3e79a8622a919c7fa078d6bcfcb743a26ddd8bc1bc56f9071c89b8a986b33eeb0c6defe6f99834b9a90da8089c002815951b451f4b9d4ed8225888e5b77b04f9131487a830c71082209525143b143d9335eb02b382660f462e5b6d5e4dd2991b894148e23f6ce2be12f76406890fe48dba3e0c97b33089c20f7466a37daa34eb110f7d9cf47553fae6f7453ad44e48fa154f1db59066d3250216bde12320eed158d5197 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x64b8ac1d60c4b541aa9dae41afb34712 (4) Finished request Waking up in 4.8 seconds. (5) Received Access-Request Id 167 from 10.219.195.225:38276 to 10.219.195.1:1812 length 214 (5) User-Name = "anonymous" (5) NAS-Identifier = "ap01-hbap" (5) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) NAS-Port = 1 (5) Calling-Station-Id = "42-33-75-43-BE-2D" (5) Connect-Info = "CONNECT 54Mbps 802.11a" (5) Acct-Session-Id = "BF0C189E956F9999" (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027076 (5) WLAN-AKM-Suite = 1027073 (5) Framed-MTU = 1400 (5) EAP-Message = 0x027c00061900 (5) State = 0x64b8ac1d60c4b541aa9dae41afb34712 (5) Message-Authenticator = 0xd495f330c78e196eb11dc3995b88a242 (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (5) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (5) authorize { (5) eap: Peer sent EAP Response (code 2) ID 124 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) if (!control:Auth-Type) { (5) if (!control:Auth-Type) -> FALSE (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (5) Auth-Type EAP { (5) eap: Removing EAP session with state 0x64b8ac1d60c4b541 (5) eap: Previous EAP request found for state 0x64b8ac1d60c4b541, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: (TLS) Peer ACKed our handshake fragment (5) eap: Sending EAP Request (code 1) ID 125 length 55 (5) eap: EAP session adding &reply:State = 0x64b8ac1d61c5b541 (5) [eap] = handled (5) } # Auth-Type EAP = handled (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) session-state: Saving cached attributes (5) Framed-MTU = 994 (5) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (5) Sent Access-Challenge Id 167 from 10.219.195.1:1812 to 10.219.195.225:38276 length 113 (5) EAP-Message = 0x017d00371900501263aad1ec47677b3c48e295891733e13224af67d346d25d68f13a27dd1b6060701aa6f7a4003816030300040e000000 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x64b8ac1d61c5b541aa9dae41afb34712 (5) Finished request Waking up in 4.8 seconds. (6) Received Access-Request Id 168 from 10.219.195.225:38276 to 10.219.195.1:1812 length 344 (6) User-Name = "anonymous" (6) NAS-Identifier = "ap01-hbap" (6) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) NAS-Port = 1 (6) Calling-Station-Id = "42-33-75-43-BE-2D" (6) Connect-Info = "CONNECT 54Mbps 802.11a" (6) Acct-Session-Id = "BF0C189E956F9999" (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027076 (6) WLAN-AKM-Suite = 1027073 (6) Framed-MTU = 1400 (6) EAP-Message = 0x027d008819800000007e1603030046100000424104d03773246fb4ee58f2b210f0d7e78f044a507dfb457b56f714c4f99379b7b54a81c78f01ba73c7a855d726a53e8e06b20bcdd4e9ff3eb63d2aab0e6075f697e114030300010116030300280000000000000000eb102ea08ec0ea6bf3ef1493251569d7fb91064e446e30581e1839c200c0883c (6) State = 0x64b8ac1d61c5b541aa9dae41afb34712 (6) Message-Authenticator = 0x06debe813bbb88b569740faf21dbdcb9 (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (6) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (6) authorize { (6) eap: Peer sent EAP Response (code 2) ID 125 length 136 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) if (!control:Auth-Type) { (6) if (!control:Auth-Type) -> FALSE (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (6) Auth-Type EAP { (6) eap: Removing EAP session with state 0x64b8ac1d61c5b541 (6) eap: Previous EAP request found for state 0x64b8ac1d61c5b541, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Peer says that the final record size will be 126 bytes (6) eap_peap: (TLS) EAP Got all data (126 bytes) (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server done (6) eap_peap: (TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read client key exchange (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read change cipher spec (6) eap_peap: (TLS) PEAP - recv TLS 1.2 Handshake, Finished (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read finished (6) eap_peap: (TLS) PEAP - send TLS 1.2 ChangeCipherSpec (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write change cipher spec (6) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, Finished (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write finished (6) eap_peap: (TLS) PEAP - Handshake state - SSL negotiation finished successfully (6) eap_peap: (TLS) PEAP - Connection Established (6) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (6) eap_peap: TLS-Session-Version = "TLS 1.2" (6) eap: Sending EAP Request (code 1) ID 126 length 57 (6) eap: EAP session adding &reply:State = 0x64b8ac1d62c6b541 (6) [eap] = handled (6) } # Auth-Type EAP = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) session-state: Saving cached attributes (6) Framed-MTU = 994 (6) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (6) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (6) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (6) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 168 from 10.219.195.1:1812 to 10.219.195.225:38276 length 115 (6) EAP-Message = 0x017e0039190014030300010116030300283fbfcc47e7ff15335d94fe3f3b7f1d2683dbacec358f9dfdd26341970bf6679ebf855cd4a6aafe17 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x64b8ac1d62c6b541aa9dae41afb34712 (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 169 from 10.219.195.225:38276 to 10.219.195.1:1812 length 214 (7) User-Name = "anonymous" (7) NAS-Identifier = "ap01-hbap" (7) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) NAS-Port = 1 (7) Calling-Station-Id = "42-33-75-43-BE-2D" (7) Connect-Info = "CONNECT 54Mbps 802.11a" (7) Acct-Session-Id = "BF0C189E956F9999" (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027076 (7) WLAN-AKM-Suite = 1027073 (7) Framed-MTU = 1400 (7) EAP-Message = 0x027e00061900 (7) State = 0x64b8ac1d62c6b541aa9dae41afb34712 (7) Message-Authenticator = 0xe942008c55e4659b864a6a49b1848ae5 (7) Restoring &session-state (7) &session-state:Framed-MTU = 994 (7) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (7) authorize { (7) eap: Peer sent EAP Response (code 2) ID 126 length 6 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) if (!control:Auth-Type) { (7) if (!control:Auth-Type) -> FALSE (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (7) Auth-Type EAP { (7) eap: Removing EAP session with state 0x64b8ac1d62c6b541 (7) eap: Previous EAP request found for state 0x64b8ac1d62c6b541, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: (TLS) Peer ACKed our handshake fragment. handshake is finished (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state TUNNEL ESTABLISHED (7) eap: Sending EAP Request (code 1) ID 127 length 40 (7) eap: EAP session adding &reply:State = 0x64b8ac1d63c7b541 (7) [eap] = handled (7) } # Auth-Type EAP = handled (7) Using Post-Auth-Type Challenge (7) Post-Auth-Type sub-section not found. Ignoring. (7) session-state: Saving cached attributes (7) Framed-MTU = 994 (7) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (7) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (7) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (7) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (7) TLS-Session-Version = "TLS 1.2" (7) Sent Access-Challenge Id 169 from 10.219.195.1:1812 to 10.219.195.225:38276 length 98 (7) EAP-Message = 0x017f00281900170303001d3fbfcc47e7ff15344cfac04ed63722fa13bff21b90d93b042ce8c29282 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x64b8ac1d63c7b541aa9dae41afb34712 (7) Finished request Waking up in 4.8 seconds. (8) Received Access-Request Id 170 from 10.219.195.225:38276 to 10.219.195.1:1812 length 257 (8) User-Name = "anonymous" (8) NAS-Identifier = "ap01-hbap" (8) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) NAS-Port = 1 (8) Calling-Station-Id = "42-33-75-43-BE-2D" (8) Connect-Info = "CONNECT 54Mbps 802.11a" (8) Acct-Session-Id = "BF0C189E956F9999" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027076 (8) WLAN-AKM-Suite = 1027073 (8) Framed-MTU = 1400 (8) EAP-Message = 0x027f0031190017030300260000000000000001c658b8d37ccad3ed1c1cb348b9a92784ffb1c57cf6dfcd328673aaf30788 (8) State = 0x64b8ac1d63c7b541aa9dae41afb34712 (8) Message-Authenticator = 0x4db29f5f022a1b50adf137196caea97c (8) Restoring &session-state (8) &session-state:Framed-MTU = 994 (8) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (8) &session-state:TLS-Session-Version = "TLS 1.2" (8) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (8) authorize { (8) eap: Peer sent EAP Response (code 2) ID 127 length 49 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) if (!control:Auth-Type) { (8) if (!control:Auth-Type) -> FALSE (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (8) Auth-Type EAP { (8) eap: Removing EAP session with state 0x64b8ac1d63c7b541 (8) eap: Previous EAP request found for state 0x64b8ac1d63c7b541, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: (TLS) EAP Done initial handshake (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state WAITING FOR INNER IDENTITY (8) eap_peap: Identity - heiko.baumann (8) eap_peap: Got inner identity 'heiko.baumann' (8) eap_peap: Setting default EAP type for tunneled EAP session (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x027f0012016865696b6f2e6261756d616e6e (8) eap_peap: Setting User-Name to heiko.baumann (8) eap_peap: Sending tunneled request to otpme (8) eap_peap: EAP-Message = 0x027f0012016865696b6f2e6261756d616e6e (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "heiko.baumann" (8) eap_peap: NAS-Identifier = "ap01-hbap" (8) eap_peap: Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (8) eap_peap: NAS-Port-Type = Wireless-802.11 (8) eap_peap: Service-Type = Framed-User (8) eap_peap: NAS-Port = 1 (8) eap_peap: Calling-Station-Id = "42-33-75-43-BE-2D" (8) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11a" (8) eap_peap: Acct-Session-Id = "BF0C189E956F9999" (8) eap_peap: WLAN-Pairwise-Cipher = 1027076 (8) eap_peap: WLAN-Group-Cipher = 1027076 (8) eap_peap: WLAN-AKM-Suite = 1027073 (8) eap_peap: Framed-MTU = 1400 (8) Virtual server otpme received request (8) EAP-Message = 0x027f0012016865696b6f2e6261756d616e6e (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "heiko.baumann" (8) NAS-Identifier = "ap01-hbap" (8) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) NAS-Port = 1 (8) Calling-Station-Id = "42-33-75-43-BE-2D" (8) Connect-Info = "CONNECT 54Mbps 802.11a" (8) Acct-Session-Id = "BF0C189E956F9999" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027076 (8) WLAN-AKM-Suite = 1027073 (8) Framed-MTU = 1400 (8) server otpme { (8) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (8) authorize { (8) eap: Peer sent EAP Response (code 2) ID 127 length 18 (8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (8) [eap] = ok (8) if (!control:Auth-Type) { (8) if (!control:Auth-Type) -> FALSE (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (8) Auth-Type EAP { (8) eap: Peer sent packet with method EAP Identity (1) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: Issuing Challenge (8) eap: Sending EAP Request (code 1) ID 128 length 42 (8) eap: EAP session adding &reply:State = 0xfae70ce5fa67161a (8) [eap] = handled (8) } # Auth-Type EAP = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) } # server otpme (8) Virtual server sending reply (8) EAP-Message = 0x0180002a1a0180002510920798cb42b9ebd036cf4ec5f867de88667265657261646975732d332e322e36 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xfae70ce5fa67161a0a330e080f4ac17b (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: EAP-Message = 0x0180002a1a0180002510920798cb42b9ebd036cf4ec5f867de88667265657261646975732d332e322e36 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0xfae70ce5fa67161a0a330e080f4ac17b (8) eap_peap: Got tunneled reply RADIUS code 11 (8) eap_peap: EAP-Message = 0x0180002a1a0180002510920798cb42b9ebd036cf4ec5f867de88667265657261646975732d332e322e36 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0xfae70ce5fa67161a0a330e080f4ac17b (8) eap_peap: Got tunneled Access-Challenge (8) eap: Sending EAP Request (code 1) ID 128 length 73 (8) eap: EAP session adding &reply:State = 0x64b8ac1d6c38b541 (8) [eap] = handled (8) } # Auth-Type EAP = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) session-state: Saving cached attributes (8) Framed-MTU = 994 (8) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (8) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (8) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (8) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (8) TLS-Session-Version = "TLS 1.2" (8) Sent Access-Challenge Id 170 from 10.219.195.1:1812 to 10.219.195.225:38276 length 131 (8) EAP-Message = 0x018000491900170303003e3fbfcc47e7ff15357d447a7f7984baab3d24cc5e608d3e9b1f1732d6a0ca80dc81cb5017596f1ecb3eb7dab2ad8c55187f67c2271843c3645767e378659b (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x64b8ac1d6c38b541aa9dae41afb34712 (8) Finished request Waking up in 4.8 seconds. (9) Received Access-Request Id 171 from 10.219.195.225:38276 to 10.219.195.1:1812 length 311 (9) User-Name = "anonymous" (9) NAS-Identifier = "ap01-hbap" (9) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (9) NAS-Port-Type = Wireless-802.11 (9) Service-Type = Framed-User (9) NAS-Port = 1 (9) Calling-Station-Id = "42-33-75-43-BE-2D" (9) Connect-Info = "CONNECT 54Mbps 802.11a" (9) Acct-Session-Id = "BF0C189E956F9999" (9) WLAN-Pairwise-Cipher = 1027076 (9) WLAN-Group-Cipher = 1027076 (9) WLAN-AKM-Suite = 1027073 (9) Framed-MTU = 1400 (9) EAP-Message = 0x028000671900170303005c00000000000000020b045bbce75f04f16e2985586e3d8ddbb45c4e798479b6033a504fc6a1cb4e043e8039b454a3da869b72d32d72c5c2654d8c11604829788b46e22513ff41d8a0e6b4d9fcd835b3c3cdfe90e8d4b22b911d2c7298 (9) State = 0x64b8ac1d6c38b541aa9dae41afb34712 (9) Message-Authenticator = 0x3118fa5cac060f01aad3516f4dfc5902 (9) Restoring &session-state (9) &session-state:Framed-MTU = 994 (9) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (9) &session-state:TLS-Session-Version = "TLS 1.2" (9) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (9) authorize { (9) eap: Peer sent EAP Response (code 2) ID 128 length 103 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) if (!control:Auth-Type) { (9) if (!control:Auth-Type) -> FALSE (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (9) Auth-Type EAP { (9) eap: Removing EAP session with state 0x64b8ac1d6c38b541 (9) eap: Previous EAP request found for state 0x64b8ac1d6c38b541, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: (TLS) EAP Done initial handshake (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x028000481a028000433172039eb9ff06e5540b22dd821eaa1c9d0000000000000000f106b113ed0eb2328181e98bcff722c56cee58e54f33ca1c006865696b6f2e6261756d616e6e (9) eap_peap: Setting User-Name to heiko.baumann (9) eap_peap: Sending tunneled request to otpme (9) eap_peap: EAP-Message = 0x028000481a028000433172039eb9ff06e5540b22dd821eaa1c9d0000000000000000f106b113ed0eb2328181e98bcff722c56cee58e54f33ca1c006865696b6f2e6261756d616e6e (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "heiko.baumann" (9) eap_peap: State = 0xfae70ce5fa67161a0a330e080f4ac17b (9) eap_peap: NAS-Identifier = "ap01-hbap" (9) eap_peap: Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (9) eap_peap: NAS-Port-Type = Wireless-802.11 (9) eap_peap: Service-Type = Framed-User (9) eap_peap: NAS-Port = 1 (9) eap_peap: Calling-Station-Id = "42-33-75-43-BE-2D" (9) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11a" (9) eap_peap: Acct-Session-Id = "BF0C189E956F9999" (9) eap_peap: WLAN-Pairwise-Cipher = 1027076 (9) eap_peap: WLAN-Group-Cipher = 1027076 (9) eap_peap: WLAN-AKM-Suite = 1027073 (9) eap_peap: Framed-MTU = 1400 (9) Virtual server otpme received request (9) EAP-Message = 0x028000481a028000433172039eb9ff06e5540b22dd821eaa1c9d0000000000000000f106b113ed0eb2328181e98bcff722c56cee58e54f33ca1c006865696b6f2e6261756d616e6e (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "heiko.baumann" (9) State = 0xfae70ce5fa67161a0a330e080f4ac17b (9) NAS-Identifier = "ap01-hbap" (9) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (9) NAS-Port-Type = Wireless-802.11 (9) Service-Type = Framed-User (9) NAS-Port = 1 (9) Calling-Station-Id = "42-33-75-43-BE-2D" (9) Connect-Info = "CONNECT 54Mbps 802.11a" (9) Acct-Session-Id = "BF0C189E956F9999" (9) WLAN-Pairwise-Cipher = 1027076 (9) WLAN-Group-Cipher = 1027076 (9) WLAN-AKM-Suite = 1027073 (9) Framed-MTU = 1400 (9) server otpme { (9) session-state: No cached attributes (9) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (9) authorize { (9) eap: Peer sent EAP Response (code 2) ID 128 length 72 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) if (!control:Auth-Type) { (9) if (!control:Auth-Type) -> FALSE (9) } # authorize = updated (9) Found Auth-Type = EAP (9) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (9) Auth-Type EAP { (9) eap: Removing EAP session with state 0xfae70ce5fa67161a (9) eap: Previous EAP request found for state 0xfae70ce5fa67161a, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /var/run/otpme/freeradius/radiusd.conf (9) eap_mschapv2: Auth-Type MS-CHAP { otpme.py: adding MS-CHAP2-Success: '3S=44f6bccdca0cf8377cbd06122065d7f895050076' otpme.py: adding MS-MPPE-Send-Key: '99420b0d55925232c6c62e7e8b913301' otpme.py: adding MS-MPPE-Recv-Key: '1114b25f146360e67f9bad689e3e9c88' otpme.py: adding MS-MPPE-Encryption-Policy: '0x00000001' otpme.py: adding MS-MPPE-Encryption-Types: '0x00000006' otpme.py: adding Auth-Type: 'MS-CHAP' authenticate - 'reply:Reply-Message' = 'Authentication successful' authenticate - 'reply:MS-CHAP2-Success' = '0x33533d34346636626363646361306366383337376362643036313232303635643766383935303530303736' authenticate - 'reply:MS-MPPE-Encryption-Policy' = '0x00000001' authenticate - 'reply:MS-MPPE-Encryption-Types' = '0x00000006' authenticate - 'reply:MS-MPPE-Send-Key' = '0x99420b0d55925232c6c62e7e8b913301' authenticate - 'reply:MS-MPPE-Recv-Key' = '0x1114b25f146360e67f9bad689e3e9c88' authenticate - 'config:Auth-Type' = 'MS-CHAP' (9) eap_mschapv2: [python_otpme] = ok (9) eap_mschapv2: } # Auth-Type MS-CHAP = ok (9) eap_mschapv2: MSCHAP Success (9) eap: Sending EAP Request (code 1) ID 129 length 51 (9) eap: EAP session adding &reply:State = 0xfae70ce5fb66161a (9) [eap] = handled (9) } # Auth-Type EAP = handled (9) Using Post-Auth-Type Challenge (9) Post-Auth-Type sub-section not found. Ignoring. (9) } # server otpme (9) Virtual server sending reply (9) Reply-Message = "Authentication successful" (9) EAP-Message = 0x018100331a0380002e533d34346636626363646361306366383337376362643036313232303635643766383935303530303736 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0xfae70ce5fb66161a0a330e080f4ac17b (9) eap_peap: Got tunneled reply code 11 (9) eap_peap: Reply-Message = "Authentication successful" (9) eap_peap: EAP-Message = 0x018100331a0380002e533d34346636626363646361306366383337376362643036313232303635643766383935303530303736 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: State = 0xfae70ce5fb66161a0a330e080f4ac17b (9) eap_peap: Got tunneled reply RADIUS code 11 (9) eap_peap: Reply-Message = "Authentication successful" (9) eap_peap: EAP-Message = 0x018100331a0380002e533d34346636626363646361306366383337376362643036313232303635643766383935303530303736 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: State = 0xfae70ce5fb66161a0a330e080f4ac17b (9) eap_peap: Got tunneled Access-Challenge (9) eap: Sending EAP Request (code 1) ID 129 length 82 (9) eap: EAP session adding &reply:State = 0x64b8ac1d6d39b541 (9) [eap] = handled (9) } # Auth-Type EAP = handled (9) Using Post-Auth-Type Challenge (9) Post-Auth-Type sub-section not found. Ignoring. (9) session-state: Saving cached attributes (9) Framed-MTU = 994 (9) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (9) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (9) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (9) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (9) TLS-Session-Version = "TLS 1.2" (9) Sent Access-Challenge Id 171 from 10.219.195.1:1812 to 10.219.195.225:38276 length 140 (9) EAP-Message = 0x01810052190017030300473fbfcc47e7ff153625de7e663dc1113d94046a6050434ba068b90ab3a11c1d9f82ea1de4187ef8e19cf8f9fbc5dbf084c02faa214014b226b04d2f410be0964a728ea31d7d7d6d (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x64b8ac1d6d39b541aa9dae41afb34712 (9) Finished request Waking up in 3.4 seconds. (10) Received Access-Request Id 172 from 10.219.195.225:38276 to 10.219.195.1:1812 length 245 (10) User-Name = "anonymous" (10) NAS-Identifier = "ap01-hbap" (10) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (10) NAS-Port-Type = Wireless-802.11 (10) Service-Type = Framed-User (10) NAS-Port = 1 (10) Calling-Station-Id = "42-33-75-43-BE-2D" (10) Connect-Info = "CONNECT 54Mbps 802.11a" (10) Acct-Session-Id = "BF0C189E956F9999" (10) WLAN-Pairwise-Cipher = 1027076 (10) WLAN-Group-Cipher = 1027076 (10) WLAN-AKM-Suite = 1027073 (10) Framed-MTU = 1400 (10) EAP-Message = 0x028100251900170303001a00000000000000031685834550dd6a5554a79de46d67b072c3cb (10) State = 0x64b8ac1d6d39b541aa9dae41afb34712 (10) Message-Authenticator = 0xce20e30f4de7c6a5a7563cd6ac38935f (10) Restoring &session-state (10) &session-state:Framed-MTU = 994 (10) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (10) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (10) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (10) &session-state:TLS-Session-Version = "TLS 1.2" (10) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (10) authorize { (10) eap: Peer sent EAP Response (code 2) ID 129 length 37 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) if (!control:Auth-Type) { (10) if (!control:Auth-Type) -> FALSE (10) } # authorize = ok (10) Found Auth-Type = EAP (10) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (10) Auth-Type EAP { (10) eap: Removing EAP session with state 0x64b8ac1d6d39b541 (10) eap: Previous EAP request found for state 0x64b8ac1d6d39b541, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: (TLS) EAP Done initial handshake (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state phase2 (10) eap_peap: EAP method MSCHAPv2 (26) (10) eap_peap: Got tunneled request (10) eap_peap: EAP-Message = 0x028100061a03 (10) eap_peap: Setting User-Name to heiko.baumann (10) eap_peap: Sending tunneled request to otpme (10) eap_peap: EAP-Message = 0x028100061a03 (10) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (10) eap_peap: User-Name = "heiko.baumann" (10) eap_peap: State = 0xfae70ce5fb66161a0a330e080f4ac17b (10) eap_peap: NAS-Identifier = "ap01-hbap" (10) eap_peap: Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (10) eap_peap: NAS-Port-Type = Wireless-802.11 (10) eap_peap: Service-Type = Framed-User (10) eap_peap: NAS-Port = 1 (10) eap_peap: Calling-Station-Id = "42-33-75-43-BE-2D" (10) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11a" (10) eap_peap: Acct-Session-Id = "BF0C189E956F9999" (10) eap_peap: WLAN-Pairwise-Cipher = 1027076 (10) eap_peap: WLAN-Group-Cipher = 1027076 (10) eap_peap: WLAN-AKM-Suite = 1027073 (10) eap_peap: Framed-MTU = 1400 (10) Virtual server otpme received request (10) EAP-Message = 0x028100061a03 (10) FreeRADIUS-Proxied-To = 127.0.0.1 (10) User-Name = "heiko.baumann" (10) State = 0xfae70ce5fb66161a0a330e080f4ac17b (10) NAS-Identifier = "ap01-hbap" (10) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (10) NAS-Port-Type = Wireless-802.11 (10) Service-Type = Framed-User (10) NAS-Port = 1 (10) Calling-Station-Id = "42-33-75-43-BE-2D" (10) Connect-Info = "CONNECT 54Mbps 802.11a" (10) Acct-Session-Id = "BF0C189E956F9999" (10) WLAN-Pairwise-Cipher = 1027076 (10) WLAN-Group-Cipher = 1027076 (10) WLAN-AKM-Suite = 1027073 (10) Framed-MTU = 1400 (10) server otpme { (10) session-state: No cached attributes (10) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (10) authorize { (10) eap: Peer sent EAP Response (code 2) ID 129 length 6 (10) eap: No EAP Start, assuming it's an on-going EAP conversation (10) [eap] = updated (10) if (!control:Auth-Type) { (10) if (!control:Auth-Type) -> FALSE (10) } # authorize = updated (10) Found Auth-Type = EAP (10) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (10) Auth-Type EAP { (10) eap: Removing EAP session with state 0xfae70ce5fb66161a (10) eap: Previous EAP request found for state 0xfae70ce5fb66161a, released from the list (10) eap: Peer sent packet with method EAP MSCHAPv2 (26) (10) eap: Calling submodule eap_mschapv2 to process data (10) eap: Sending EAP Success (code 3) ID 129 length 4 (10) eap: Freeing handler (10) [eap] = ok (10) } # Auth-Type EAP = ok (10) } # server otpme (10) Virtual server sending reply (10) MS-MPPE-Encryption-Policy = Encryption-Allowed (10) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (10) MS-MPPE-Send-Key = 0x99420b0d55925232c6c62e7e8b913301 (10) MS-MPPE-Recv-Key = 0x1114b25f146360e67f9bad689e3e9c88 (10) EAP-Message = 0x03810004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "heiko.baumann" (10) eap_peap: Got tunneled reply code 2 (10) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (10) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (10) eap_peap: MS-MPPE-Send-Key = 0x99420b0d55925232c6c62e7e8b913301 (10) eap_peap: MS-MPPE-Recv-Key = 0x1114b25f146360e67f9bad689e3e9c88 (10) eap_peap: EAP-Message = 0x03810004 (10) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (10) eap_peap: User-Name = "heiko.baumann" (10) eap_peap: Got tunneled reply RADIUS code 2 (10) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (10) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (10) eap_peap: MS-MPPE-Send-Key = 0x99420b0d55925232c6c62e7e8b913301 (10) eap_peap: MS-MPPE-Recv-Key = 0x1114b25f146360e67f9bad689e3e9c88 (10) eap_peap: EAP-Message = 0x03810004 (10) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (10) eap_peap: User-Name = "heiko.baumann" (10) eap_peap: Tunneled authentication was successful (10) eap_peap: SUCCESS (10) eap_peap: Saving tunneled attributes for later (10) eap: Sending EAP Request (code 1) ID 130 length 46 (10) eap: EAP session adding &reply:State = 0x64b8ac1d6e3ab541 (10) [eap] = handled (10) } # Auth-Type EAP = handled (10) Using Post-Auth-Type Challenge (10) Post-Auth-Type sub-section not found. Ignoring. (10) session-state: Saving cached attributes (10) Framed-MTU = 994 (10) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (10) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (10) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (10) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (10) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (10) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (10) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (10) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (10) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (10) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (10) TLS-Session-Version = "TLS 1.2" (10) Sent Access-Challenge Id 172 from 10.219.195.1:1812 to 10.219.195.225:38276 length 104 (10) EAP-Message = 0x0182002e190017030300233fbfcc47e7ff153753fdd6108d64e215a21d55da7ef02d5dee925bc76d6a4e6392574b (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) State = 0x64b8ac1d6e3ab541aa9dae41afb34712 (10) Finished request Waking up in 3.4 seconds. (11) Received Access-Request Id 173 from 10.219.195.225:38276 to 10.219.195.1:1812 length 254 (11) User-Name = "anonymous" (11) NAS-Identifier = "ap01-hbap" (11) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (11) NAS-Port-Type = Wireless-802.11 (11) Service-Type = Framed-User (11) NAS-Port = 1 (11) Calling-Station-Id = "42-33-75-43-BE-2D" (11) Connect-Info = "CONNECT 54Mbps 802.11a" (11) Acct-Session-Id = "BF0C189E956F9999" (11) WLAN-Pairwise-Cipher = 1027076 (11) WLAN-Group-Cipher = 1027076 (11) WLAN-AKM-Suite = 1027073 (11) Framed-MTU = 1400 (11) EAP-Message = 0x0282002e190017030300230000000000000004f4cfa29e4ec86e3245b7e5cbd0fb74dea5e8ff12c7bc2100be801a (11) State = 0x64b8ac1d6e3ab541aa9dae41afb34712 (11) Message-Authenticator = 0x8353375023b7e469efb93d9e282cd1a3 (11) Restoring &session-state (11) &session-state:Framed-MTU = 994 (11) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (11) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (11) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES128-GCM-SHA256" (11) &session-state:TLS-Session-Version = "TLS 1.2" (11) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (11) authorize { (11) eap: Peer sent EAP Response (code 2) ID 130 length 46 (11) eap: Continuing tunnel setup (11) [eap] = ok (11) if (!control:Auth-Type) { (11) if (!control:Auth-Type) -> FALSE (11) } # authorize = ok (11) Found Auth-Type = EAP (11) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (11) Auth-Type EAP { (11) eap: Removing EAP session with state 0x64b8ac1d6e3ab541 (11) eap: Previous EAP request found for state 0x64b8ac1d6e3ab541, released from the list (11) eap: Peer sent packet with method EAP PEAP (25) (11) eap: Calling submodule eap_peap to process data (11) eap_peap: (TLS) EAP Done initial handshake (11) eap_peap: Session established. Decoding tunneled attributes (11) eap_peap: PEAP state send tlv success (11) eap_peap: Received EAP-TLV response (11) eap_peap: Success (11) eap_peap: Using saved attributes from the original Access-Accept (11) eap_peap: User-Name = "heiko.baumann" (11) eap: Sending EAP Success (code 3) ID 130 length 4 (11) eap: Freeing handler (11) [eap] = ok (11) } # Auth-Type EAP = ok (11) Sent Access-Accept Id 173 from 10.219.195.1:1812 to 10.219.195.225:38276 length 175 (11) User-Name = "heiko.baumann" (11) MS-MPPE-Recv-Key = 0x7fd1806ac0bae3a4dce0733ee3ba2285ec93eb01ffaa19010f48e0bdabebb623 (11) MS-MPPE-Send-Key = 0x833cfac00c66d42a0bcbc62e008e5591890e585ae00c8d3b56707e5b49a140f5 (11) EAP-Message = 0x03820004 (11) Message-Authenticator = 0x00000000000000000000000000000000 (11) Finished request Waking up in 3.4 seconds. Debug output of a failed request with an iPhone: FreeRADIUS Version 3.2.6 Copyright (C) 1999-2023 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including configuration file /var/run/otpme/freeradius/radiusd.conf including configuration file /var/run/otpme/freeradius/clients.conf main { security { user = "otpme" group = "otpme" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/otpme" run_dir = "/var/run/otpme" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/otpme" run_dir = "/var/run/otpme" libdir = "/usr/lib" radacctdir = "/var/log/otpme/radacct" hostname_lookups = no max_request_time = 30 proxy_dedup_window = 1 cleanup_delay = 5 max_requests = 16384 max_fds = 512 postauth_client_lost = no pidfile = "/var/run/otpme/pidfiles/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes require_message_authenticator = "auto" limit_proxy_state = "auto" } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### Debugger not attached # Creating Auth-Type = python_otpme # Creating Auth-Type = EAP # Creating Auth-Type = MS-CHAP radiusd: #### Instantiating modules #### modules { # Loaded module rlm_mschap # Loading module "mschap" from file /var/run/otpme/freeradius/radiusd.conf mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_eap # Loading module "eap" from file /var/run/otpme/freeradius/radiusd.conf eap { default_eap_type = "mschapv2" timer_expire = 60 max_eap_type = 52 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 dedup_key = "" } # Loading module "mschap_otp" from file /var/run/otpme/freeradius/radiusd.conf mschap mschap_otp { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/local/bin/otpme-auth verify_mschap --socket '%{%{Stripped-User-Name}:-%{%{User-Name}:-None}}' '%{%{mschap_otp:Challenge}:-00}' '%{%{mschap_otp:NT-Response}:-00}' '%{NAS-Identifier}' '%{Client-IP-Address}'" passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_python3 # Loading module "python_otpme" from file /var/run/otpme/freeradius/radiusd.conf python3 python_otpme { mod_instantiate = "otpme.lib.freeradius.otpme" func_instantiate = "instantiate" mod_authorize = "otpme.lib.freeradius.otpme" func_authorize = "authorize" mod_authenticate = "otpme.lib.freeradius.otpme" func_authenticate = "authenticate" python_path = "/var/run/otpme/freeradius/mods-config/python3:/opt/otpme/lib/python3.11/site-packages" cext_compat = yes pass_all_vps = no pass_all_vps_dict = no } # Instantiating module "mschap" from file /var/run/otpme/freeradius/radiusd.conf rlm_mschap (mschap): using internal authentication # Instantiating module "eap" from file /var/run/otpme/freeradius/radiusd.conf # Linked to sub-module rlm_eap_md5 rlm_eap (EAP): Ignoring EAP method 'leap', because it is no longer supported # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 pem_file_type = yes private_key_file = "/var/run/otpme/freeradius/key.pem" certificate_file = "/var/run/otpme/freeradius/cert.pem" ca_file = "/var/run/otpme/freeradius/ca.pem" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no ca_path_reload_interval = 0 cipher_list = "DEFAULT" cipher_server_preference = no reject_unknown_intermediate_ca = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = no use_nonce = yes timeout = 0 softfail = no } } tls: Please use 'tls_min_version' and 'tls_max_version' instead of 'disable_tlsv1' tls: Please use 'tls_min_version' and 'tls_max_version' instead of 'disable_tlsv1_1' # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "otpme" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "otpme" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "mschap_otp" from file /var/run/otpme/freeradius/radiusd.conf rlm_mschap (mschap_otp): authenticating by calling 'ntlm_auth' # Instantiating module "python_otpme" from file /var/run/otpme/freeradius/radiusd.conf Python version: 3.11.13 (main, Jul 3 2025, 11:31:00) [GCC 12.2.1 20230428] otpme.py: OTPme config verfied successful. otpme.py: Instantiated OTPme module. } # modules radiusd: #### Loading Virtual Servers #### server { # from file /var/run/otpme/freeradius/radiusd.conf } # server server otpme { # from file /var/run/otpme/freeradius/radiusd.conf # Loading authenticate {...} Compiling Auth-Type EAP for attr Auth-Type Compiling Auth-Type MS-CHAP for attr Auth-Type # Loading authorize {...} } # server otpme radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 client 10.219.195.225 { ipv4addr = 10.219.195.225 secret = <<< secret >>> shortname = "ap01-hbap-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.219.195.223 { ipv4addr = 10.219.195.223 secret = <<< secret >>> shortname = "cloudix-nextcloud-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 127.0.0.1 { ipv4addr = 127.0.0.1 secret = <<< secret >>> shortname = "localhost-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.219.195.100 { ipv4addr = 10.219.195.100 secret = <<< secret >>> shortname = "sharewatcher-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client 10.219.195.254 { ipv4addr = 10.219.195.254 secret = <<< secret >>> shortname = "smtp-1" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } } Listening on auth address * port 1812 bound to server otpme Ready to process requests (0) Received Access-Request Id 204 from 10.219.195.225:38276 to 10.219.195.1:1812 length 194 (0) User-Name = "test" (0) NAS-Identifier = "ap01-hbap" (0) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (0) NAS-Port-Type = Wireless-802.11 (0) Service-Type = Framed-User (0) NAS-Port = 3 (0) Calling-Station-Id = "A6-5F-75-98-A5-06" (0) Connect-Info = "CONNECT 54Mbps 802.11a" (0) Acct-Session-Id = "EEFF590BE3BB6A1C" (0) WLAN-Pairwise-Cipher = 1027076 (0) WLAN-Group-Cipher = 1027076 (0) WLAN-AKM-Suite = 1027073 (0) Framed-MTU = 1400 (0) EAP-Message = 0x022200090174657374 (0) Message-Authenticator = 0x7dfcffdfd9fbf339765f6ac0c092a78d (0) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (0) authorize { (0) eap: Peer sent EAP Response (code 2) ID 34 length 9 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) if (!control:Auth-Type) { (0) if (!control:Auth-Type) -> FALSE (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (0) Auth-Type EAP { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_mschapv2 to process data (0) eap_mschapv2: Issuing Challenge (0) eap: Sending EAP Request (code 1) ID 35 length 42 (0) eap: EAP session adding &reply:State = 0xac2b487aac085271 (0) [eap] = handled (0) } # Auth-Type EAP = handled (0) Using Post-Auth-Type Challenge (0) Post-Auth-Type sub-section not found. Ignoring. (0) Sent Access-Challenge Id 204 from 10.219.195.1:1812 to 10.219.195.225:38276 length 100 (0) EAP-Message = 0x0123002a1a0123002510807cf25a7f0593f308104a2a7f1bbe28667265657261646975732d332e322e36 (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0xac2b487aac0852714e974a6b4baa7cab (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 205 from 10.219.195.225:38276 to 10.219.195.1:1812 length 211 (1) User-Name = "test" (1) NAS-Identifier = "ap01-hbap" (1) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (1) NAS-Port-Type = Wireless-802.11 (1) Service-Type = Framed-User (1) NAS-Port = 3 (1) Calling-Station-Id = "A6-5F-75-98-A5-06" (1) Connect-Info = "CONNECT 54Mbps 802.11a" (1) Acct-Session-Id = "EEFF590BE3BB6A1C" (1) WLAN-Pairwise-Cipher = 1027076 (1) WLAN-Group-Cipher = 1027076 (1) WLAN-AKM-Suite = 1027073 (1) Framed-MTU = 1400 (1) EAP-Message = 0x022300080319152b (1) State = 0xac2b487aac0852714e974a6b4baa7cab (1) Message-Authenticator = 0x87e934652733a17be1765b4b6f4f24c4 (1) session-state: No cached attributes (1) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (1) authorize { (1) eap: Peer sent EAP Response (code 2) ID 35 length 8 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) if (!control:Auth-Type) { (1) if (!control:Auth-Type) -> FALSE (1) } # authorize = updated (1) Found Auth-Type = EAP (1) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (1) Auth-Type EAP { (1) eap: Removing EAP session with state 0xac2b487aac085271 (1) eap: Previous EAP request found for state 0xac2b487aac085271, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: (TLS) PEAP -Initiating new session (1) eap: Sending EAP Request (code 1) ID 36 length 6 (1) eap: EAP session adding &reply:State = 0xac2b487aad0f5171 (1) [eap] = handled (1) } # Auth-Type EAP = handled (1) Using Post-Auth-Type Challenge (1) Post-Auth-Type sub-section not found. Ignoring. (1) session-state: Saving cached attributes (1) Framed-MTU = 994 (1) Sent Access-Challenge Id 205 from 10.219.195.1:1812 to 10.219.195.225:38276 length 64 (1) EAP-Message = 0x012400061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0xac2b487aad0f51714e974a6b4baa7cab (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 206 from 10.219.195.225:38276 to 10.219.195.1:1812 length 364 (2) User-Name = "test" (2) NAS-Identifier = "ap01-hbap" (2) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (2) NAS-Port-Type = Wireless-802.11 (2) Service-Type = Framed-User (2) NAS-Port = 3 (2) Calling-Station-Id = "A6-5F-75-98-A5-06" (2) Connect-Info = "CONNECT 54Mbps 802.11a" (2) Acct-Session-Id = "EEFF590BE3BB6A1C" (2) WLAN-Pairwise-Cipher = 1027076 (2) WLAN-Group-Cipher = 1027076 (2) WLAN-AKM-Suite = 1027073 (2) Framed-MTU = 1400 (2) EAP-Message = 0x022400a119800000009716030100920100008e0303696381086bafdecf86b47ad4c93e56a3b253ab52e8d2d1935c21005877f5eeb700002c00ffc02cc02bc024c023c00ac009c008c030c02fc028c027c014c013c012009d009c003d003c0035002f000a01000039000a00080006001700180019000b00020100000d00120010040102010501060104030203050306030005000501000000000012000000170000 (2) State = 0xac2b487aad0f51714e974a6b4baa7cab (2) Message-Authenticator = 0x8d8adccff2d8071b49b73e04caacb294 (2) Restoring &session-state (2) &session-state:Framed-MTU = 994 (2) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (2) authorize { (2) eap: Peer sent EAP Response (code 2) ID 36 length 161 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) if (!control:Auth-Type) { (2) if (!control:Auth-Type) -> FALSE (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (2) Auth-Type EAP { (2) eap: Removing EAP session with state 0xac2b487aad0f5171 (2) eap: Previous EAP request found for state 0xac2b487aad0f5171, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: (TLS) EAP Peer says that the final record size will be 151 bytes (2) eap_peap: (TLS) EAP Got all data (151 bytes) (2) eap_peap: (TLS) PEAP - Handshake state - before SSL initialization (2) eap_peap: (TLS) PEAP - Handshake state - Server before SSL initialization (2) eap_peap: (TLS) PEAP - Handshake state - Server before SSL initialization (2) eap_peap: (TLS) PEAP - recv TLS 1.3 Handshake, ClientHello (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read client hello (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerHello (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server hello (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, Certificate (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write certificate (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write key exchange (2) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone (2) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server done (2) eap_peap: (TLS) PEAP - Server : Need to read more data: SSLv3/TLS write server done (2) eap_peap: (TLS) PEAP - In Handshake Phase (2) eap: Sending EAP Request (code 1) ID 37 length 1004 (2) eap: EAP session adding &reply:State = 0xac2b487aae0e5171 (2) [eap] = handled (2) } # Auth-Type EAP = handled (2) Using Post-Auth-Type Challenge (2) Post-Auth-Type sub-section not found. Ignoring. (2) session-state: Saving cached attributes (2) Framed-MTU = 994 (2) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (2) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (2) Sent Access-Challenge Id 206 from 10.219.195.1:1812 to 10.219.195.225:38276 length 1068 (2) EAP-Message = 0x012503ec19c000000bd7160303003d0200003903037d9615ce8191f6cead070312ee58c68647bb340519841c210fc1a6f586ebbff400c030000011ff01000100000b000403000102001700001603030a350b000a31000a2e000499308204953082027da003020102020705fea02d221361300d06092a864886f70d01010b05003076312a302806035504030c212f68626f73732e696e7465726e2f6b6f626c656e7a2f6361732f534954455f4341310b3009060355040613024445310c300a06035504080c03524c503110300e06035504070c074b6f626c656e7a310e300c060355040a0c0548424f5353310b3009060355040b0c024954301e170d3233303632313039313330395a170d3338303631373039313330395a3069311d301b06035504030c146b6f626c656e7a2e68626f73732e696e7465726e310b3009060355040613024445310c300a06035504080c03524c503110300e06035504070c074b6f626c656e7a310e300c060355040a0c0548424f535331 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0xac2b487aae0e51714e974a6b4baa7cab (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 207 from 10.219.195.225:38276 to 10.219.195.1:1812 length 209 (3) User-Name = "test" (3) NAS-Identifier = "ap01-hbap" (3) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (3) NAS-Port-Type = Wireless-802.11 (3) Service-Type = Framed-User (3) NAS-Port = 3 (3) Calling-Station-Id = "A6-5F-75-98-A5-06" (3) Connect-Info = "CONNECT 54Mbps 802.11a" (3) Acct-Session-Id = "EEFF590BE3BB6A1C" (3) WLAN-Pairwise-Cipher = 1027076 (3) WLAN-Group-Cipher = 1027076 (3) WLAN-AKM-Suite = 1027073 (3) Framed-MTU = 1400 (3) EAP-Message = 0x022500061900 (3) State = 0xac2b487aae0e51714e974a6b4baa7cab (3) Message-Authenticator = 0xbfa1456c3a23563d3ae031e3ab7b871c (3) Restoring &session-state (3) &session-state:Framed-MTU = 994 (3) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (3) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (3) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (3) authorize { (3) eap: Peer sent EAP Response (code 2) ID 37 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) if (!control:Auth-Type) { (3) if (!control:Auth-Type) -> FALSE (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (3) Auth-Type EAP { (3) eap: Removing EAP session with state 0xac2b487aae0e5171 (3) eap: Previous EAP request found for state 0xac2b487aae0e5171, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: (TLS) Peer ACKed our handshake fragment (3) eap: Sending EAP Request (code 1) ID 38 length 1000 (3) eap: EAP session adding &reply:State = 0xac2b487aaf0d5171 (3) [eap] = handled (3) } # Auth-Type EAP = handled (3) Using Post-Auth-Type Challenge (3) Post-Auth-Type sub-section not found. Ignoring. (3) session-state: Saving cached attributes (3) Framed-MTU = 994 (3) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (3) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (3) Sent Access-Challenge Id 207 from 10.219.195.1:1812 to 10.219.195.225:38276 length 1064 (3) EAP-Message = 0x012603e819406729c41ca39fed55f40b0703e590f4ef3fe75165ed505d0e8e33187c7f82a4fa97311282257e3dca08d5818a76cee90d8aea88403b1d62eda2f8ed0e7cc7d72ce4f25e3497d7cbb88d5fb3e76fd5eb2cb7c29126896e5cf175ca9a6b177812f14e4ad1acc69c7a07a33ad3e880179c3971584f08442b7bfe40153886a8e68f88b2ebd088522f0214474a905d560fa04a8f20a966b67e072e644b106f92e95d3fc468afe1b60ff5b30eabfd9eb217f1847f6a24ab5f922365ecc2bb16be43951cbf4cf33735cd9fc4a0337c1632c68690fb8748b78e6f1fe6534e092fc9b9f25123a0a3ed26215dc6b0b765bbe2272058c9bf0935cb8ac47c5b1f7bd20e474f71a760f1db1b8a45da00058f3082058b30820373a003020102020705fea02cf10b27300d06092a864886f70d01010b05003077312b302906035504030c222f68626f73732e696e7465726e2f6b6f626c656e7a2f6361732f5245414c4d5f4341310b3009060355040613024445310c300a06 (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0xac2b487aaf0d51714e974a6b4baa7cab (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 208 from 10.219.195.225:38276 to 10.219.195.1:1812 length 209 (4) User-Name = "test" (4) NAS-Identifier = "ap01-hbap" (4) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (4) NAS-Port-Type = Wireless-802.11 (4) Service-Type = Framed-User (4) NAS-Port = 3 (4) Calling-Station-Id = "A6-5F-75-98-A5-06" (4) Connect-Info = "CONNECT 54Mbps 802.11a" (4) Acct-Session-Id = "EEFF590BE3BB6A1C" (4) WLAN-Pairwise-Cipher = 1027076 (4) WLAN-Group-Cipher = 1027076 (4) WLAN-AKM-Suite = 1027073 (4) Framed-MTU = 1400 (4) EAP-Message = 0x022600061900 (4) State = 0xac2b487aaf0d51714e974a6b4baa7cab (4) Message-Authenticator = 0x5cb8800c3a7ed09d207a2ef341573028 (4) Restoring &session-state (4) &session-state:Framed-MTU = 994 (4) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (4) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (4) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (4) authorize { (4) eap: Peer sent EAP Response (code 2) ID 38 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) if (!control:Auth-Type) { (4) if (!control:Auth-Type) -> FALSE (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (4) Auth-Type EAP { (4) eap: Removing EAP session with state 0xac2b487aaf0d5171 (4) eap: Previous EAP request found for state 0xac2b487aaf0d5171, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: (TLS) Peer ACKed our handshake fragment (4) eap: Sending EAP Request (code 1) ID 39 length 1000 (4) eap: EAP session adding &reply:State = 0xac2b487aa80c5171 (4) [eap] = handled (4) } # Auth-Type EAP = handled (4) Using Post-Auth-Type Challenge (4) Post-Auth-Type sub-section not found. Ignoring. (4) session-state: Saving cached attributes (4) Framed-MTU = 994 (4) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (4) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (4) Sent Access-Challenge Id 208 from 10.219.195.1:1812 to 10.219.195.225:38276 length 1064 (4) EAP-Message = 0x012703e81940603ef2f2884b299ace212671ea16a0df8d30640875c03aaef2ac1e4cd0b45487fcb99234083e915ecded1171c41b3eb10b7c736e781a97f17e3aa3b85d0f5b5f35d09ce1570d621b9dc5be4b4f9ecae899a6d0949b7eed4ebcbf64a48aa40d41d3c07d33da2e8d816dd2eba719a8b75d53dfa7ecb5a35b7cec093710efea7ff30203010001a31d301b300c0603551d13040530030101ff300b0603551d0f040403020106300d06092a864886f70d01010b0500038202010048ed80b6b8d9f45c988d3a8c439f33112acf5a1a90a3e79a8622a919c7fa078d6bcfcb743a26ddd8bc1bc56f9071c89b8a986b33eeb0c6defe6f99834b9a90da8089c002815951b451f4b9d4ed8225888e5b77b04f9131487a830c71082209525143b143d9335eb02b382660f462e5b6d5e4dd2991b894148e23f6ce2be12f76406890fe48dba3e0c97b33089c20f7466a37daa34eb110f7d9cf47553fae6f7453ad44e48fa154f1db59066d3250216bde12320eed158d5197 (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0xac2b487aa80c51714e974a6b4baa7cab (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 209 from 10.219.195.225:38276 to 10.219.195.1:1812 length 209 (5) User-Name = "test" (5) NAS-Identifier = "ap01-hbap" (5) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (5) NAS-Port-Type = Wireless-802.11 (5) Service-Type = Framed-User (5) NAS-Port = 3 (5) Calling-Station-Id = "A6-5F-75-98-A5-06" (5) Connect-Info = "CONNECT 54Mbps 802.11a" (5) Acct-Session-Id = "EEFF590BE3BB6A1C" (5) WLAN-Pairwise-Cipher = 1027076 (5) WLAN-Group-Cipher = 1027076 (5) WLAN-AKM-Suite = 1027073 (5) Framed-MTU = 1400 (5) EAP-Message = 0x022700061900 (5) State = 0xac2b487aa80c51714e974a6b4baa7cab (5) Message-Authenticator = 0x4904b50139129c9ee3d149be137fb45e (5) Restoring &session-state (5) &session-state:Framed-MTU = 994 (5) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (5) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (5) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (5) authorize { (5) eap: Peer sent EAP Response (code 2) ID 39 length 6 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) if (!control:Auth-Type) { (5) if (!control:Auth-Type) -> FALSE (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (5) Auth-Type EAP { (5) eap: Removing EAP session with state 0xac2b487aa80c5171 (5) eap: Previous EAP request found for state 0xac2b487aa80c5171, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: (TLS) Peer ACKed our handshake fragment (5) eap: Sending EAP Request (code 1) ID 40 length 55 (5) eap: EAP session adding &reply:State = 0xac2b487aa9035171 (5) [eap] = handled (5) } # Auth-Type EAP = handled (5) Using Post-Auth-Type Challenge (5) Post-Auth-Type sub-section not found. Ignoring. (5) session-state: Saving cached attributes (5) Framed-MTU = 994 (5) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (5) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (5) Sent Access-Challenge Id 209 from 10.219.195.1:1812 to 10.219.195.225:38276 length 113 (5) EAP-Message = 0x012800371900b048c07ac17f86f9c727014f0cc6a508653ff99a95e6e84a4829d48058b9132be05c9c1b68de733316030300040e000000 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0xac2b487aa90351714e974a6b4baa7cab (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 210 from 10.219.195.225:38276 to 10.219.195.1:1812 length 339 (6) User-Name = "test" (6) NAS-Identifier = "ap01-hbap" (6) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (6) NAS-Port-Type = Wireless-802.11 (6) Service-Type = Framed-User (6) NAS-Port = 3 (6) Calling-Station-Id = "A6-5F-75-98-A5-06" (6) Connect-Info = "CONNECT 54Mbps 802.11a" (6) Acct-Session-Id = "EEFF590BE3BB6A1C" (6) WLAN-Pairwise-Cipher = 1027076 (6) WLAN-Group-Cipher = 1027076 (6) WLAN-AKM-Suite = 1027073 (6) Framed-MTU = 1400 (6) EAP-Message = 0x0228008819800000007e16030300461000004241041914318456c90b3eed960cc0f427749a4a58dea1c45b04d88e0d4aa358aa753149db3707404dba0da11104816db305bfb16c221d10d02ca05f66f05e90868b1914030300010116030300284ae33342f449b98c815966dbee60f4bfb147c6898c284415f0f4f449d2ff033a5ec9027ddb4ce85f (6) State = 0xac2b487aa90351714e974a6b4baa7cab (6) Message-Authenticator = 0x4765ff00e4d57c7b8098fe86dc4fa440 (6) Restoring &session-state (6) &session-state:Framed-MTU = 994 (6) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (6) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (6) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (6) authorize { (6) eap: Peer sent EAP Response (code 2) ID 40 length 136 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) if (!control:Auth-Type) { (6) if (!control:Auth-Type) -> FALSE (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (6) Auth-Type EAP { (6) eap: Removing EAP session with state 0xac2b487aa9035171 (6) eap: Previous EAP request found for state 0xac2b487aa9035171, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: (TLS) EAP Peer says that the final record size will be 126 bytes (6) eap_peap: (TLS) EAP Got all data (126 bytes) (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server done (6) eap_peap: (TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read client key exchange (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read change cipher spec (6) eap_peap: (TLS) PEAP - recv TLS 1.2 Handshake, Finished (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read finished (6) eap_peap: (TLS) PEAP - send TLS 1.2 ChangeCipherSpec (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write change cipher spec (6) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, Finished (6) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write finished (6) eap_peap: (TLS) PEAP - Handshake state - SSL negotiation finished successfully (6) eap_peap: (TLS) PEAP - Connection Established (6) eap_peap: TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) eap_peap: TLS-Session-Version = "TLS 1.2" (6) eap: Sending EAP Request (code 1) ID 41 length 57 (6) eap: EAP session adding &reply:State = 0xac2b487aaa025171 (6) [eap] = handled (6) } # Auth-Type EAP = handled (6) Using Post-Auth-Type Challenge (6) Post-Auth-Type sub-section not found. Ignoring. (6) session-state: Saving cached attributes (6) Framed-MTU = 994 (6) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (6) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (6) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (6) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (6) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (6) TLS-Session-Version = "TLS 1.2" (6) Sent Access-Challenge Id 210 from 10.219.195.1:1812 to 10.219.195.225:38276 length 115 (6) EAP-Message = 0x01290039190014030300010116030300282209ea55626d5fee2bc36d1a8a06ba29ee44eb2847cffb3da18d6d212b1f8b681bddb7d42c7dc10a (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0xac2b487aaa0251714e974a6b4baa7cab (6) Finished request Waking up in 4.8 seconds. (7) Received Access-Request Id 211 from 10.219.195.225:38276 to 10.219.195.1:1812 length 209 (7) User-Name = "test" (7) NAS-Identifier = "ap01-hbap" (7) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (7) NAS-Port-Type = Wireless-802.11 (7) Service-Type = Framed-User (7) NAS-Port = 3 (7) Calling-Station-Id = "A6-5F-75-98-A5-06" (7) Connect-Info = "CONNECT 54Mbps 802.11a" (7) Acct-Session-Id = "EEFF590BE3BB6A1C" (7) WLAN-Pairwise-Cipher = 1027076 (7) WLAN-Group-Cipher = 1027076 (7) WLAN-AKM-Suite = 1027073 (7) Framed-MTU = 1400 (7) EAP-Message = 0x022900061900 (7) State = 0xac2b487aaa0251714e974a6b4baa7cab (7) Message-Authenticator = 0xb01820edd9de0eb9ebd79cea4c818884 (7) Restoring &session-state (7) &session-state:Framed-MTU = 994 (7) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (7) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (7) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) &session-state:TLS-Session-Version = "TLS 1.2" (7) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (7) authorize { (7) eap: Peer sent EAP Response (code 2) ID 41 length 6 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) if (!control:Auth-Type) { (7) if (!control:Auth-Type) -> FALSE (7) } # authorize = ok (7) Found Auth-Type = EAP (7) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (7) Auth-Type EAP { (7) eap: Removing EAP session with state 0xac2b487aaa025171 (7) eap: Previous EAP request found for state 0xac2b487aaa025171, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: (TLS) Peer ACKed our handshake fragment. handshake is finished (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state TUNNEL ESTABLISHED (7) eap: Sending EAP Request (code 1) ID 42 length 40 (7) eap: EAP session adding &reply:State = 0xac2b487aab015171 (7) [eap] = handled (7) } # Auth-Type EAP = handled (7) Using Post-Auth-Type Challenge (7) Post-Auth-Type sub-section not found. Ignoring. (7) session-state: Saving cached attributes (7) Framed-MTU = 994 (7) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (7) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (7) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (7) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (7) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (7) TLS-Session-Version = "TLS 1.2" (7) Sent Access-Challenge Id 211 from 10.219.195.1:1812 to 10.219.195.225:38276 length 98 (7) EAP-Message = 0x012a00281900170303001d2209ea55626d5fef324c805c6b28f660cb29d8bd4026022faedaf16c29 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0xac2b487aab0151714e974a6b4baa7cab (7) Finished request Waking up in 4.8 seconds. (8) Received Access-Request Id 212 from 10.219.195.225:38276 to 10.219.195.1:1812 length 243 (8) User-Name = "test" (8) NAS-Identifier = "ap01-hbap" (8) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) NAS-Port = 3 (8) Calling-Station-Id = "A6-5F-75-98-A5-06" (8) Connect-Info = "CONNECT 54Mbps 802.11a" (8) Acct-Session-Id = "EEFF590BE3BB6A1C" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027076 (8) WLAN-AKM-Suite = 1027073 (8) Framed-MTU = 1400 (8) EAP-Message = 0x022a00281900170303001d4ae33342f449b98d13c961f594f00dcb253fa40f83e7aec02fab3fb55a (8) State = 0xac2b487aab0151714e974a6b4baa7cab (8) Message-Authenticator = 0xcea0cff4f6afbee50b7007acbe9993a1 (8) Restoring &session-state (8) &session-state:Framed-MTU = 994 (8) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (8) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (8) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) &session-state:TLS-Session-Version = "TLS 1.2" (8) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (8) authorize { (8) eap: Peer sent EAP Response (code 2) ID 42 length 40 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) if (!control:Auth-Type) { (8) if (!control:Auth-Type) -> FALSE (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (8) Auth-Type EAP { (8) eap: Removing EAP session with state 0xac2b487aab015171 (8) eap: Previous EAP request found for state 0xac2b487aab015171, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: (TLS) EAP Done initial handshake (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state WAITING FOR INNER IDENTITY (8) eap_peap: Identity - test (8) eap_peap: Got inner identity 'test' (8) eap_peap: Setting default EAP type for tunneled EAP session (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x022a00090174657374 (8) eap_peap: Setting User-Name to test (8) eap_peap: Sending tunneled request to otpme (8) eap_peap: EAP-Message = 0x022a00090174657374 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "test" (8) eap_peap: NAS-Identifier = "ap01-hbap" (8) eap_peap: Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (8) eap_peap: NAS-Port-Type = Wireless-802.11 (8) eap_peap: Service-Type = Framed-User (8) eap_peap: NAS-Port = 3 (8) eap_peap: Calling-Station-Id = "A6-5F-75-98-A5-06" (8) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11a" (8) eap_peap: Acct-Session-Id = "EEFF590BE3BB6A1C" (8) eap_peap: WLAN-Pairwise-Cipher = 1027076 (8) eap_peap: WLAN-Group-Cipher = 1027076 (8) eap_peap: WLAN-AKM-Suite = 1027073 (8) eap_peap: Framed-MTU = 1400 (8) Virtual server otpme received request (8) EAP-Message = 0x022a00090174657374 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "test" (8) NAS-Identifier = "ap01-hbap" (8) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (8) NAS-Port-Type = Wireless-802.11 (8) Service-Type = Framed-User (8) NAS-Port = 3 (8) Calling-Station-Id = "A6-5F-75-98-A5-06" (8) Connect-Info = "CONNECT 54Mbps 802.11a" (8) Acct-Session-Id = "EEFF590BE3BB6A1C" (8) WLAN-Pairwise-Cipher = 1027076 (8) WLAN-Group-Cipher = 1027076 (8) WLAN-AKM-Suite = 1027073 (8) Framed-MTU = 1400 (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server otpme { (8) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (8) authorize { (8) eap: Peer sent EAP Response (code 2) ID 42 length 9 (8) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (8) [eap] = ok (8) if (!control:Auth-Type) { (8) if (!control:Auth-Type) -> FALSE (8) } # authorize = ok (8) Found Auth-Type = EAP (8) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (8) Auth-Type EAP { (8) eap: Peer sent packet with method EAP Identity (1) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: Issuing Challenge (8) eap: Sending EAP Request (code 1) ID 43 length 42 (8) eap: EAP session adding &reply:State = 0x4d7ab8054d51a258 (8) [eap] = handled (8) } # Auth-Type EAP = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) } # server otpme (8) Virtual server sending reply (8) EAP-Message = 0x012b002a1a012b002510b158d692e01e55d324fba4bd46d9b3a1667265657261646975732d332e322e36 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x4d7ab8054d51a258be49ba37bb208c58 (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: EAP-Message = 0x012b002a1a012b002510b158d692e01e55d324fba4bd46d9b3a1667265657261646975732d332e322e36 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x4d7ab8054d51a258be49ba37bb208c58 (8) eap_peap: Got tunneled reply RADIUS code 11 (8) eap_peap: EAP-Message = 0x012b002a1a012b002510b158d692e01e55d324fba4bd46d9b3a1667265657261646975732d332e322e36 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x4d7ab8054d51a258be49ba37bb208c58 (8) eap_peap: Got tunneled Access-Challenge (8) eap: Sending EAP Request (code 1) ID 43 length 73 (8) eap: EAP session adding &reply:State = 0xac2b487aa4005171 (8) [eap] = handled (8) } # Auth-Type EAP = handled (8) Using Post-Auth-Type Challenge (8) Post-Auth-Type sub-section not found. Ignoring. (8) session-state: Saving cached attributes (8) Framed-MTU = 994 (8) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (8) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (8) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (8) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (8) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (8) TLS-Session-Version = "TLS 1.2" (8) Sent Access-Challenge Id 212 from 10.219.195.1:1812 to 10.219.195.225:38276 length 131 (8) EAP-Message = 0x012b00491900170303003e2209ea55626d5ff0baf80a2c42ec6788dd5d4663e3245c6aaaef10c2c1deb1d2ad96fab8a4438ea319ff3f70d6d27ae2c8a9d4aa8dc68429000232767ded (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0xac2b487aa40051714e974a6b4baa7cab (8) Finished request Waking up in 4.8 seconds. (9) Received Access-Request Id 213 from 10.219.195.225:38276 to 10.219.195.1:1812 length 297 (9) User-Name = "test" (9) NAS-Identifier = "ap01-hbap" (9) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (9) NAS-Port-Type = Wireless-802.11 (9) Service-Type = Framed-User (9) NAS-Port = 3 (9) Calling-Station-Id = "A6-5F-75-98-A5-06" (9) Connect-Info = "CONNECT 54Mbps 802.11a" (9) Acct-Session-Id = "EEFF590BE3BB6A1C" (9) WLAN-Pairwise-Cipher = 1027076 (9) WLAN-Group-Cipher = 1027076 (9) WLAN-AKM-Suite = 1027073 (9) Framed-MTU = 1400 (9) EAP-Message = 0x022b005e190017030300534ae33342f449b98e94136a54fa9773216317d2ebacdd3c8cea4603265909a0054c9dbb0bc8083fe2bd3ff8548dde3574e03c15d2b5a9ba2568d6711d69a8859b8fe148f477919afc4ccdbd64664e50b2cf5a5f (9) State = 0xac2b487aa40051714e974a6b4baa7cab (9) Message-Authenticator = 0x70ed0ad4ec446ceb8871e3c49ec3026a (9) Restoring &session-state (9) &session-state:Framed-MTU = 994 (9) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (9) &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (9) &session-state:TLS-Session-Version = "TLS 1.2" (9) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (9) authorize { (9) eap: Peer sent EAP Response (code 2) ID 43 length 94 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) if (!control:Auth-Type) { (9) if (!control:Auth-Type) -> FALSE (9) } # authorize = ok (9) Found Auth-Type = EAP (9) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (9) Auth-Type EAP { (9) eap: Removing EAP session with state 0xac2b487aa4005171 (9) eap: Previous EAP request found for state 0xac2b487aa4005171, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: (TLS) EAP Done initial handshake (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x022b003f1a022b003a3106a05c6e463eb6c51b322211d9918db400000000000000002d5a72c8ea7f1462f326cb9167cd3ef55e1d254c2141aafa0074657374 (9) eap_peap: Setting User-Name to test (9) eap_peap: Sending tunneled request to otpme (9) eap_peap: EAP-Message = 0x022b003f1a022b003a3106a05c6e463eb6c51b322211d9918db400000000000000002d5a72c8ea7f1462f326cb9167cd3ef55e1d254c2141aafa0074657374 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "test" (9) eap_peap: State = 0x4d7ab8054d51a258be49ba37bb208c58 (9) eap_peap: NAS-Identifier = "ap01-hbap" (9) eap_peap: Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (9) eap_peap: NAS-Port-Type = Wireless-802.11 (9) eap_peap: Service-Type = Framed-User (9) eap_peap: NAS-Port = 3 (9) eap_peap: Calling-Station-Id = "A6-5F-75-98-A5-06" (9) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11a" (9) eap_peap: Acct-Session-Id = "EEFF590BE3BB6A1C" (9) eap_peap: WLAN-Pairwise-Cipher = 1027076 (9) eap_peap: WLAN-Group-Cipher = 1027076 (9) eap_peap: WLAN-AKM-Suite = 1027073 (9) eap_peap: Framed-MTU = 1400 (9) Virtual server otpme received request (9) EAP-Message = 0x022b003f1a022b003a3106a05c6e463eb6c51b322211d9918db400000000000000002d5a72c8ea7f1462f326cb9167cd3ef55e1d254c2141aafa0074657374 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "test" (9) State = 0x4d7ab8054d51a258be49ba37bb208c58 (9) NAS-Identifier = "ap01-hbap" (9) Called-Station-Id = "B4-4B-D6-26-BA-86:hboss" (9) NAS-Port-Type = Wireless-802.11 (9) Service-Type = Framed-User (9) NAS-Port = 3 (9) Calling-Station-Id = "A6-5F-75-98-A5-06" (9) Connect-Info = "CONNECT 54Mbps 802.11a" (9) Acct-Session-Id = "EEFF590BE3BB6A1C" (9) WLAN-Pairwise-Cipher = 1027076 (9) WLAN-Group-Cipher = 1027076 (9) WLAN-AKM-Suite = 1027073 (9) Framed-MTU = 1400 (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server otpme { (9) session-state: No cached attributes (9) # Executing section authorize from file /var/run/otpme/freeradius/radiusd.conf (9) authorize { (9) eap: Peer sent EAP Response (code 2) ID 43 length 63 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) if (!control:Auth-Type) { (9) if (!control:Auth-Type) -> FALSE (9) } # authorize = updated (9) Found Auth-Type = EAP (9) # Executing group from file /var/run/otpme/freeradius/radiusd.conf (9) Auth-Type EAP { (9) eap: Removing EAP session with state 0x4d7ab8054d51a258 (9) eap: Previous EAP request found for state 0x4d7ab8054d51a258, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap_mschapv2: # Executing group from file /var/run/otpme/freeradius/radiusd.conf (9) eap_mschapv2: Auth-Type MS-CHAP { otpme.py: adding MS-CHAP2-Success: '3S=c3971529e7869293a9a388ede7e667182aeaa22c' otpme.py: adding MS-MPPE-Send-Key: 'c7726ce0b854c17314668bc50df88203' otpme.py: adding MS-MPPE-Recv-Key: '7019a1e6577898bd8acfecd45e55a41d' otpme.py: adding MS-MPPE-Encryption-Policy: '0x00000001' otpme.py: adding MS-MPPE-Encryption-Types: '0x00000006' otpme.py: adding Auth-Type: 'MS-CHAP' authenticate - 'reply:Reply-Message' = 'Authentication successful' authenticate - 'reply:MS-CHAP2-Success' = '0x33533d63333937313532396537383639323933613961333838656465376536363731383261656161323263' authenticate - 'reply:MS-MPPE-Encryption-Policy' = '0x00000001' authenticate - 'reply:MS-MPPE-Encryption-Types' = '0x00000006' authenticate - 'reply:MS-MPPE-Send-Key' = '0xc7726ce0b854c17314668bc50df88203' authenticate - 'reply:MS-MPPE-Recv-Key' = '0x7019a1e6577898bd8acfecd45e55a41d' authenticate - 'config:Auth-Type' = 'MS-CHAP' (9) eap_mschapv2: [python_otpme] = ok (9) eap_mschapv2: } # Auth-Type MS-CHAP = ok (9) eap_mschapv2: MSCHAP Success (9) eap: Sending EAP Request (code 1) ID 44 length 51 (9) eap: EAP session adding &reply:State = 0x4d7ab8054c56a258 (9) [eap] = handled (9) } # Auth-Type EAP = handled (9) Using Post-Auth-Type Challenge (9) Post-Auth-Type sub-section not found. Ignoring. (9) } # server otpme (9) Virtual server sending reply (9) Reply-Message = "Authentication successful" (9) EAP-Message = 0x012c00331a032b002e533d63333937313532396537383639323933613961333838656465376536363731383261656161323263 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x4d7ab8054c56a258be49ba37bb208c58 (9) eap_peap: Got tunneled reply code 11 (9) eap_peap: Reply-Message = "Authentication successful" (9) eap_peap: EAP-Message = 0x012c00331a032b002e533d63333937313532396537383639323933613961333838656465376536363731383261656161323263 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: State = 0x4d7ab8054c56a258be49ba37bb208c58 (9) eap_peap: Got tunneled reply RADIUS code 11 (9) eap_peap: Reply-Message = "Authentication successful" (9) eap_peap: EAP-Message = 0x012c00331a032b002e533d63333937313532396537383639323933613961333838656465376536363731383261656161323263 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: State = 0x4d7ab8054c56a258be49ba37bb208c58 (9) eap_peap: Got tunneled Access-Challenge (9) eap: Sending EAP Request (code 1) ID 44 length 82 (9) eap: EAP session adding &reply:State = 0xac2b487aa5075171 (9) [eap] = handled (9) } # Auth-Type EAP = handled (9) Using Post-Auth-Type Challenge (9) Post-Auth-Type sub-section not found. Ignoring. (9) session-state: Saving cached attributes (9) Framed-MTU = 994 (9) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake, ClientHello" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHello" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Certificate" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone" (9) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange" (9) TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake, Finished" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 ChangeCipherSpec" (9) TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake, Finished" (9) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (9) TLS-Session-Version = "TLS 1.2" (9) Sent Access-Challenge Id 213 from 10.219.195.1:1812 to 10.219.195.225:38276 length 140 (9) EAP-Message = 0x012c0052190017030300472209ea55626d5ff1c5bfe6da41424c37ee71bb77118b8f1f51e7bdb050466709030848e8afe46e99cd47ef4337957aa870e14a5a42c006d97a017640d76c88fd54daf3585dae47 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0xac2b487aa50751714e974a6b4baa7cab (9) Finished request Waking up in 4.0 seconds.

2 3

Accept in Accounting Section
by Erdal Emlik 27 Dec '25

27 Dec '25

Hi, I have a FreeRADIUS backend–proxy setup which I was previously running on FreeRADIUS 3.2.1 without any issues. After upgrading the backend-proxy to FreeRADIUS 3.2.8, I noticed a change in behavior: for users with static IP addresses, a Message-Authenticator attribute suddenly appears in Accounting-Response packets. This only happens for sessions where the IP address is not present in radippool (i.e. static IP users). Dynamic IP (CGNAT) users do not show this behavior. My configuration has always been the same, and the default behavior did not change on my side. Below is the debug output from the proxy side showing where the Message-Authenticator is added to the Accounting-Response: 56) Proxy-State = 0x323533 (56) Clearing existing &reply: attributes (56) Received Access-Accept Id 3 from 10.2.134.250:1813 to 172.18.0.2:50949 length 43 (56) Message-Authenticator = 0xcb7e447acd6eb189578d5ec25a844b36 (56) Proxy-State = 0x323533 (56) server default { (56) } (56) Sent Accounting-Response Id 253 from 172.18.0.2:1813 to 193.192.126.156:1646 length 38 (56) Message-Authenticator = 0xcb7e447acd6eb189578d5ec25a844b36 (56) Finished request (56) Cleaning up request packet ID 253 with timestamp +5 due to done Below is the relevant part of my accounting configuration. This has been in place for a long time, and I am not sure why accept was originally used here: ippoolv4 { fail = 1 noop = 2 notfound = 3 } if (fail) { accept } if (noop) { accept } if (notfound) { accept } I could not find clear documentation explaining what accept actually does in the accounting section, and how it affects the generated response. My questions are: Does using accept here cause FreeRADIUS to internally treat this as an Access-Accept, even though this is an Accounting-Request? Could this be the reason why an Access-Accept is received from the backend on the accounting port, and why a Message-Authenticator is added to the Accounting-Response? Has the behavior of accept in accounting changed between 3.2.1 and 3.2.8? Any clarification on the semantics of accept in accounting, or pointers to relevant documentation or changelogs, would be greatly appreciated. Thanks in advance.

3 2