- Freeradius-Users - lists.freeradius.org

LinOTP
by Sergii Bieliaievskyi 14 Aug '13

14 Aug '13

Hello. I am currently trying to install LinOTP with FreeRADIUS. I spent 3-4 hours to get to work perl script http://www.howtoforge.com/how-to-use-freeradius-with-linotp-2-to-do-two-fac… . There was a problem with LWP::UserAgent and ssl connection (Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/radius.pl , func = authenticate exit status= Error at https://172.16.17.18/validate/simplecheck 500 Can't connect to 172.16.17.18:443) But i change script a little bit and faced other problem that concern Useridresolving. Is it OK that Comunity Edition reports that "Error saving sql configuration: No module named useridresolveree.SQLIdResolver"? I want to have single username database and want to connect LinOTP to radius mysql database. Is it possible? -- ------------------------------ PRIVILEGED AND CONFIDENTIAL COMMUNICATION This e-mail transmission, and any documents, files or previous e-mail messages attached to it, may contain confidential information that is legally privileged. If you are not the intended recipient or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is strictly prohibited. If you have received this transmission in error, please: (1) immediately notify me by reply e-mail, or by collect telephone call; and (2) destroy the original transmission and its attachments without reading or saving in any manner.

3 3

RLM_PERL mysql disconnect : what is the preferred handling ?
by itquestioner 13 Aug '13

13 Aug '13

Hi, First question from beginners We've found in the freeradius wiki, that the correct way to manage connection to mysql is to initiate the connection in the CLONE function. But where should we put $dbh->disconnect() to be sure that any connection will also be closed ? Whatever the result of the request treatment, and the stage in which the module may exit. Thank you best regards

2 1

Re: sql_counter module doesn't count
by Alan Buxey 13 Aug '13

13 Aug '13

If your NAS can't send accounting then there's nothing you can do at the freeradius end to make it do accounting alan

1 0

Re: sql_counter module doesn't count
by Alan Buxey 12 Aug '13

12 Aug '13

Hi That's just an authentication request.... accounting packets is what you need. Is your kit configured to send accounting to this RADIUS server? alan

2 1

sql_counter module doesn't count
by lucia 12 Aug '13

12 Aug '13

Hi , I want to use the sql_counter module in my radius server. The SQL module seems to work correct, but the calculating of the connection time does not return any result because there is no entry at all in the radius database table "radacct" after a test user has logged in or stays logged in. I have no idea where I have to look next. The FreeRadius runs on a Synology NAS and I'm also not sure if all modules are precompiled and usable. My User table radcheck looks like this: username: attribute: op: value: tee Cleartext-Password := abc tee Max-All-Session := 120 the radusergroup is empty. Attached is the radius -X debug message after one test-user has connected. Any hints ? Thanks and Regards Lu FreeRADIUS Version 2.1.10, for host armle-unknown-linux-gnu, built on Mar 14 2013 at 11:55:30 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /var/packages/RadiusServer/target//etc/raddb/radiusd.conf including configuration file /usr/local/synoradius/rad_listen including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /usr/local/synoradius/rad_port_auth including configuration file /var/packages/RadiusServer/target//etc/raddb/clients.conf including configuration file /usr/local/synoradius/rad_clients including files in directory /var/packages/RadiusServer/target//etc/raddb/modules/ including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/counter including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/checkval including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/logintime including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/perl including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/detail.log including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/linelog including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/attr_rewrite including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/inner-eap including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/sradutmp including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/preprocess including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/dynamic_clients including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/chap including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/unix including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/realm including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/digest including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/files including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/etc_group including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/wimax including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/ippool including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/radutmp including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/expiration including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/echo including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/sqlcounter_expire_on_login including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/expr including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/mac2vlan including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/krb5 including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/exec including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/always including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/smbpasswd including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/cui including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/pam including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/passwd including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/opendirectory including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/mschap_ad including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/ldap including configuration file /usr/local/synoradius/rad_ldap including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/detail including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/policy including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/mschap including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/detail.example.com including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/attr_filter including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/smsotp including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/acct_unique including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/pap including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/otp including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/mac2ip including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/sql_log including configuration file /var/packages/RadiusServer/target//etc/raddb/modules/ntlm_auth including configuration file /usr/local/synoradius/rad_ntlm_auth including configuration file /var/packages/RadiusServer/target//etc/raddb/eap.conf including configuration file /var/packages/RadiusServer/target//etc/raddb/sql.conf including configuration file /var/packages/RadiusServer/target//etc/raddb/sql/mysql/dialup.conf including configuration file /var/packages/RadiusServer/target//etc/raddb/./counter.conf including configuration file /var/packages/RadiusServer/target//etc/raddb/counter.conf including configuration file /var/packages/RadiusServer/target//etc/raddb/policy.conf including files in directory /var/packages/RadiusServer/target//etc/raddb/sites-enabled/ including configuration file /var/packages/RadiusServer/target//etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/synoradius/rad_site_inn including configuration file /usr/local/synoradius/rad_site_inn_local including configuration file /usr/local/synoradius/rad_port_inner including configuration file /var/packages/RadiusServer/target//etc/raddb/sites-enabled/control-socket including configuration file /var/packages/RadiusServer/target//etc/raddb/sites-enabled/default including configuration file /usr/local/synoradius/rad_site_def including configuration file /usr/local/synoradius/rad_site_def_local main { allow_core_dumps = no } including dictionary file /var/packages/RadiusServer/target//etc/raddb/dictionary main { prefix = "/var/packages/RadiusServer/target/" localstatedir = "/var/packages/RadiusServer/target//var" logdir = "/var/packages/RadiusServer/target//var/log/radius" libdir = "/var/packages/RadiusServer/target//lib" radacctdir = "/var/packages/RadiusServer/target//var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/packages/RadiusServer/target//var/run/radiusd/radiusd.pid" checkrad = "/var/packages/RadiusServer/target//sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### client 192.168.178.25/24 { require_message_authenticator = no secret = "xxxx" shortname = "EASYBOX" } client 127.0.0.1/24 { require_message_authenticator = no secret = "xxxx" shortname = "Localhost" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /var/packages/RadiusServer/target//etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /var/packages/RadiusServer/target//etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /var/packages/RadiusServer/target//etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /var/packages/RadiusServer/target//etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /var/packages/RadiusServer/target//etc/raddb/sql.conf sql { driver = "rlm_sql_mysql" server = "localhost" port = "3306" login = "radius" password = "xxxx" radius_db = "radius" read_groups = yes sqltrace = yes sqltracefile = "/var/packages/RadiusServer/target//var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 6 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /usr/local/synoradius/rad_site_inn_local modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /var/packages/RadiusServer/target//etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /var/packages/RadiusServer/target//etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /var/packages/RadiusServer/target//etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /var/packages/RadiusServer/target//etc/raddb/modules/unix unix { radwtmp = "/var/packages/RadiusServer/target//var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /var/packages/RadiusServer/target//etc/raddb/eap.conf eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/usr/syno/etc/ssl/ssl.crt" pem_file_type = yes private_key_file = "/usr/syno/etc/ssl/ssl.key/server.key" certificate_file = "/usr/syno/etc/ssl/ssl.crt/server.crt" CA_file = "/usr/syno/etc/ssl/ssl.crt/ca.crt" private_key_password = "12345" dh_file = "/var/packages/RadiusServer/target//etc/raddb/certs/dh" random_file = "/var/packages/RadiusServer/target//etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /var/packages/RadiusServer/target//etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /var/packages/RadiusServer/target//etc/raddb/modules/files files { usersfile = "/var/packages/RadiusServer/target//etc/raddb/users" acctusersfile = "/var/packages/RadiusServer/target//etc/raddb/acct_users" preproxy_usersfile = "/var/packages/RadiusServer/target//etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_passwd Module: Instantiating module "smbpasswd" from file /var/packages/RadiusServer/target//etc/raddb/modules/smbpasswd passwd smbpasswd { filename = "/usr/syno/etc/private/smbpasswd" format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" delimiter = ":" ignorenislike = no ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /var/packages/RadiusServer/target//etc/raddb/modules/radutmp radutmp { filename = "/var/packages/RadiusServer/target//var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /var/packages/RadiusServer/target//etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/var/packages/RadiusServer/target//etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /var/packages/RadiusServer/target//etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /var/packages/RadiusServer/target//etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /var/packages/RadiusServer/target//etc/raddb/modules/preprocess preprocess { huntgroups = "/var/packages/RadiusServer/target//etc/raddb/huntgroups" hints = "/var/packages/RadiusServer/target//etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sqlcounter Module: Instantiating module "noresetcounter" from file /var/packages/RadiusServer/target//etc/raddb/counter.conf sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" key = "User-Name" sqlmod-inst = "sql" query = "SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{%k}'" reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute Max-All-Session is number 11274 rlm_sqlcounter: Current Time: 1376339087 [2013-08-12 23:24:47], Next reset 0 [2013-08-12 23:00:00] rlm_sqlcounter: Current Time: 1376339087 [2013-08-12 23:24:47], Prev reset 0 [2013-08-12 23:00:00] Module: Instantiating module "dailycounter" from file /var/packages/RadiusServer/target//etc/raddb/counter.conf sqlcounter dailycounter { counter-name = "Daily-Session-Time" check-name = "Max-Daily-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username = '%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "daily" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Daily-Session-Time is number 11275 rlm_sqlcounter: Check attribute Max-Daily-Session is number 11276 rlm_sqlcounter: Current Time: 1376339087 [2013-08-12 23:24:47], Next reset 1376341200 [2013-08-13 00:00:00] rlm_sqlcounter: Current Time: 1376339087 [2013-08-12 23:24:47], Prev reset 1376254800 [2013-08-12 00:00:00] Module: Instantiating module "monthlycounter" from file /var/packages/RadiusServer/target//etc/raddb/counter.conf sqlcounter monthlycounter { counter-name = "Monthly-Session-Time" check-name = "Max-Monthly-Session" reply-name = "Session-Timeout" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(acctsessiontime - GREATEST((%b - UNIX_TIMESTAMP(acctstarttime)), 0)) FROM radacct WHERE username='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" reset = "monthly" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sqlcounter: Reply attribute Session-Timeout is number 27 rlm_sqlcounter: Counter attribute Monthly-Session-Time is number 11277 rlm_sqlcounter: Check attribute Max-Monthly-Session is number 11278 rlm_sqlcounter: Current Time: 1376339087 [2013-08-12 23:24:47], Next reset 1377982800 [2013-09-01 00:00:00] rlm_sqlcounter: Current Time: 1376339087 [2013-08-12 23:24:47], Prev reset 1375304400 [2013-08-01 00:00:00] Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /var/packages/RadiusServer/target//etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /var/packages/RadiusServer/target//etc/raddb/modules/detail detail { detailfile = "/var/packages/RadiusServer/target//var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /var/packages/RadiusServer/target//etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/var/packages/RadiusServer/target//etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.178.24 port = 1812 } listen { type = "auth" ipaddr = 127.0.0.1 port = 1812 } listen { type = "auth" ipaddr = 10.8.0.1 port = 1812 } listen { type = "control" listen { socket = "/var/packages/RadiusServer/target//var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 192.168.178.24 port 1812 Listening on authentication address 127.0.0.1 port 1812 Listening on authentication address 10.8.0.1 port 1812 Listening on command file /var/packages/RadiusServer/target//var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 192.168.178.25 port 32888, id=2, length=148 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000801746565 Message-Authenticator = 0xf59055370165c1ac3839db5f8195752c SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[smbpasswd] returns notfound ++[expiration] returns noop ++[logintime] returns noop [sql] expand: %{User-Name} -> tee [sql] sql_set_user escaped user --> 'tee' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' sqlcounter_expand: '%{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> tee [noresetcounter] sql_set_user escaped user --> 'tee' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' [noresetcounter] expand: /var/packages/RadiusServer/target//var/log/radius/sqltrace.sql -> /var/packages/RadiusServer/target//var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 3 [noresetcounter] expand: %{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee'} -> 0 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user tee, check_item=10, counter=0 rlm_sqlcounter: Sent Reply-Item for user tee, Type=Session-Timeout, value=10 ++[noresetcounter] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 2 to 192.168.178.25 port 32888 Session-Timeout = 10 EAP-Message = 0x0103001d1a01030018102526be8601cef6396823d8998c0b6b83746565 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878580f59d56ed034e3134225de2 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32889, id=3, length=164 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878580f59d56ed034e3134225de2 EAP-Message = 0x020300060319 Message-Authenticator = 0xee84edb24a2bb9a12f35e3a403393663 SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[smbpasswd] returns notfound ++[expiration] returns noop ++[logintime] returns noop [sql] expand: %{User-Name} -> tee [sql] sql_set_user escaped user --> 'tee' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}'' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='%{User-Name}' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' sqlcounter_expand: '%{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee'}' [noresetcounter] sql_xlat [noresetcounter] expand: %{User-Name} -> tee [noresetcounter] sql_set_user escaped user --> 'tee' [noresetcounter] expand: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' -> SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' [noresetcounter] expand: /var/packages/RadiusServer/target//var/log/radius/sqltrace.sql -> /var/packages/RadiusServer/target//var/log/radius/sqltrace.sql rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee' [noresetcounter] sql_xlat finished rlm_sql (sql): Released sql socket id: 1 [noresetcounter] expand: %{sql:SELECT IFNULL(SUM(AcctSessionTime),0) FROM radacct WHERE UserName='tee'} -> 0 rlm_sqlcounter: Check item is greater than query result rlm_sqlcounter: Authorized user tee, check_item=10, counter=0 rlm_sqlcounter: Sent Reply-Item for user tee, Type=Session-Timeout, value=10 ++[noresetcounter] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.178.25 port 32889 Session-Timeout = 10 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878581f29e56ed034e3134225de2 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32890, id=4, length=358 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878581f29e56ed034e3134225de2 EAP-Message = 0x020400c81980000000be16030100b9010000b503015209453a90c3ad1dc68b3867c87da1c17aca3b3104bd3f8411b2f706669db885000048c014c00a00390038c00fc0050035c012c00800160013c00dc003000ac013c00900330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000044000b000403000102000a00340032000100020003000400050006000700080009000a000b000c000d000e000f001000110012001300140015001600170018001900230000 Message-Authenticator = 0xa061bb8038b36017614af4150749eb45 SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 200 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 190 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 00b9], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 068d], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 018d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.178.25 port 32890 EAP-Message = 0x0105040019c00000086316030100310200002d0301520944b6b2e68061e8cb6e0810d75b046a7fc240531e641cc6ca21bd7fe212ae000039000005ff01000100160301068d0b00068900068600032f3082032b30820294a00302010202051132211a60300d06092a864886f70d01010505003081a7310b3009060355040613025457310f300d0603550408130654616977616e310f300d0603550407130654616970656931163014060355040a130d53796e6f6c6f677920496e632e311e301c060355040b1315436572746966696361746520417574686f72697479311930170603550403131053796e6f6c6f677920496e632e204341312330210609 EAP-Message = 0x2a864886f70d010901161470726f647563744073796e6f6c6f67792e636f6d301e170d3133303733313136313431335a170d3333303431373136313431335a308196310b3009060355040613025457310f300d0603550408130654616977616e310f300d0603550407130654616970656931163014060355040a130d53796e6f6c6f677920496e632e3111300f060355040b1308465450205465616d311530130603550403130c73796e6f6c6f67792e636f6d3123302106092a864886f70d010901161470726f647563744073796e6f6c6f67792e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100cb8bd49b3ff39917 EAP-Message = 0x1a0e21017d6b4d5c453d099ea419d8b6936d113e108f35aa2479645bd2b9c1f41759efd7c4386c4db0a2931e9d55d3bb8592c9861a56eca4080d40ba4b1854f9d754d076c1a73293c1f80ef990d1c4f115a9a3b2911f16af46cb894772f166323ae0b863d88a1b2a234c5f94ce518875b461fab3ee875a850203010001a3723070301f0603551d1104183016811470726f647563744073796e6f6c6f67792e636f6d303a06096086480186f842010d042d162b6d6f645f73736c2067656e65726174656420637573746f6d20736572766572206365727469666963617465301106096086480186f8420101040403020640300d06092a864886f70d0101 EAP-Message = 0x050500038181009215bcd8253932c648f6a14119b66f48438125886dcbc96eeee7b4cb3e56389c9b6ff5932a9b184e913aacc14408d82f7fe5eb371080139aa50d28326d4bd535f95bb3fd2de3dcb48a9b0d1a7c341e803bf4a76250883d716dca25f0821889a9363896f788462613e51e705dc112cfbb830d4f2b4a92939fa38a47d5c08ed6070003513082034d308202b6a0030201020209009fd19fa01a036ca5300d06092a864886f70d01010505003081a7310b3009060355040613025457310f300d0603550408130654616977616e310f300d0603550407130654616970656931163014060355040a130d53796e6f6c6f677920496e632e311e EAP-Message = 0x301c060355040b1315436572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878582f39e56ed034e3134225de2 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32891, id=5, length=164 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878582f39e56ed034e3134225de2 EAP-Message = 0x020500061900 Message-Authenticator = 0xafa2dd19e749573ebea82436d5b89cad SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 192.168.178.25 port 32891 EAP-Message = 0x010603fc1940746966696361746520417574686f72697479311930170603550403131053796e6f6c6f677920496e632e2043413123302106092a864886f70d010901161470726f647563744073796e6f6c6f67792e636f6d301e170d3133303733313136313431325a170d3333303431373136313431325a3081a7310b3009060355040613025457310f300d0603550408130654616977616e310f300d0603550407130654616970656931163014060355040a130d53796e6f6c6f677920496e632e311e301c060355040b1315436572746966696361746520417574686f72697479311930170603550403131053796e6f6c6f677920496e632e204341 EAP-Message = 0x3123302106092a864886f70d010901161470726f647563744073796e6f6c6f67792e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100b5b133c2343ee72c325b5567566e16984e3ad4f964f71d5c676cada2e7a55a8957fd5aa30f7647f72d58206bfd7f13d65be2f1252a12a8dbfa999bc4bfced5676e0604bce97bc997c7c464be66d45af768e05e44dd0f03d4f6e53031c14e078637e764e161ac6b2f90047b7afa8c277c9520ae95491517d552aca0841f3215b10203010001a37f307d301f0603551d1104183016811470726f647563744073796e6f6c6f67792e636f6d300f0603551d13040830060101ff020100 EAP-Message = 0x303606096086480186f842010d042916276d6f645f73736c2067656e65726174656420637573746f6d204341206365727469666963617465301106096086480186f8420101040403020204300d06092a864886f70d0101050500038181002456f5d7e49a3cf41f5cd5b7f785e9880ad4748e80a614f20b311b44b38e3473b057088573cf4c4b4a78c0447b290964bf09c31f9f7aba5135f3afec170ebd75d978971ede94fd8790ab4e1cf34044f6e5b81cf3d50043195de029497756df668ab2f30b9eb59b32eaddd5cc8ac37e0dafdf87c13f976a1d9557e56f1e703315160301018d0c0001890080ba686466df6626c54cb03b6bbb2eb1522c8d2c8b EAP-Message = 0xcdec316e5dceff84790a957f998ba7f1f109022e0e0c1f488cf51205d0d52a037fd93eb516aa86077df28d768f06c9a5538c860e17447be3d586bd2eba6930a1f07bd0b6abf3411783100e25d2b072097153a03081a6ced3e1ba10949d76a45c7e45f7a21ffe9ebc356bf2db00010200806b20fdffec6f7616b1ac0792a9ee1f111049b7f8071650e56d23fcdd7f3415fc04dc2f5be34de147b3b0ac318d0417ffe53e92f66712f1cafcebe3f1393b90563d5efd20a07ce8bc537cb002dd9ecc8d8cc638d0e4f489af364445e2dabee94c19213b4b64a28ce00d2ef4e6b73a50635d7287f0a7320a8ca7c1d5e244f8d72e00803f5fca5ed430815840c6 EAP-Message = 0xca51c8a72b134129 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878583f09e56ed034e3134225de2 Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32892, id=6, length=164 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878583f09e56ed034e3134225de2 EAP-Message = 0x020600061900 Message-Authenticator = 0xad5cb37a135449788276514fb81fb9fd SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.178.25 port 32892 EAP-Message = 0x0107007d19005de838683537a84f610da2c4f9a1369bd6e9ca9fd0aa2b44cd7d84186e925f4c2db27fb7d62b54caa6830c26a0160954a854648dc84a6205ad79d9cceafae9732b8d41d72935baeff7ce5c37dc82b4574ffe9cca9d7c460e1a15badc88c75a6d43f843c3108256f4ade50967559816030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878584f19e56ed034e3134225de2 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32893, id=7, length=366 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878584f19e56ed034e3134225de2 EAP-Message = 0x020700d01980000000c616030100861000008200808bdd91a9487dccff09234e723cee7ba21725e2a670592009c304699865f930e253859f4b20ba934f14dda2549b720816e2b91162a41e36ed46e0a1959e7072400110121bfee72de20d31145db146f527147ebecd9c1f454c025b5d023b689ab64afba2ad9f20924f18a392ebaf2c0a5130b5f9fa444c25f817f7ecfa4972f192140301000101160301003060d9a90b7ed3fd213a43238d564c566728df397a55a7eee655ddb648c1740bd72181631eb7261cc0eceb52424e8fbfc8 Message-Authenticator = 0x256730f0831061eae27cb1af7157bfe9 SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 7 to 192.168.178.25 port 32893 EAP-Message = 0x0108004119001403010001011603010030b8d1cdfe3b2fe4ea114acf6db4bc356e3985ce457b3a1149c84cbfcb02ac65bc4d33d0eb2f8a6e950401633ce4600303 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878585fe9e56ed034e3134225de2 Finished request 5. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32894, id=8, length=164 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878585fe9e56ed034e3134225de2 EAP-Message = 0x020800061900 Message-Authenticator = 0xd8b885a775bd422295146389e760a062 SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 8 to 192.168.178.25 port 32894 EAP-Message = 0x0109002b190017030100200fd631ca65f225634251679efe7524102e6ad544f576ef00a2f996ac9c4dad67 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878586ff9e56ed034e3134225de2 Finished request 6. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32895, id=9, length=238 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878586ff9e56ed034e3134225de2 EAP-Message = 0x0209005019001703010020a08078622a79e75a566a35e37ef4bf984a4bb904335403eadcdc445bc7bd908a1703010020b0718794786e96045ed88030e9a94236d4ad1672637efb413176da2c3ad27586 Message-Authenticator = 0xf5b1df8093a72c9530258fe6969a9fc2 SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - tee [peap] Got inner identity 'tee' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x0209000801746565 server { PEAP: Setting User-Name to tee Sending tunneled request EAP-Message = 0x0209000801746565 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tee" server inner-tunnel { SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_inn_local +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 9 length 8 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[smbpasswd] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop [sql] expand: %{User-Name} -> tee [sql] sql_set_user escaped user --> 'tee' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_inn_local +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a001d1a010a001810d3f23e8332d772ee6ed7d8e7e96aa314746565 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84e0dc4b84eac6443eb91adc9df1aaf2 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a001d1a010a001810d3f23e8332d772ee6ed7d8e7e96aa314746565 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84e0dc4b84eac6443eb91adc9df1aaf2 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 9 to 192.168.178.25 port 32895 EAP-Message = 0x010a003b19001703010030712667073febde764e5f2c9db3f756e283ff2180010ab6ce8279b275dd91f1dab7b11915d8ee1b08d53646ca76c74294 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878587fc9e56ed034e3134225de2 Finished request 7. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32896, id=10, length=286 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878587fc9e56ed034e3134225de2 EAP-Message = 0x020a00801900170301002003b67ac299e85321ff1f02a3fc4882edd957bc03194e8c379bb77f1c79dd009f1703010050b262cbf37cc08590f1736c2e90141e8457f4b7af8e7abbfaef9060ff03a5a2ada76be693ba95f5a159215119aaab21924173f17ec2dbe6d6da2cb99804725379fbd6272198e5cab8587acceaea7dda0b Message-Authenticator = 0x44e004b74fa78cf01a38d274530d7614 SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 10 length 128 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a003e1a020a003931d5f758f1aeada35c250ccbf62fdedb1200000000000000001d3c61fd341515c0c945528dc1af927b453748b44030955400746565 server { PEAP: Setting User-Name to tee Sending tunneled request EAP-Message = 0x020a003e1a020a003931d5f758f1aeada35c250ccbf62fdedb1200000000000000001d3c61fd341515c0c945528dc1af927b453748b44030955400746565 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tee" State = 0x84e0dc4b84eac6443eb91adc9df1aaf2 server inner-tunnel { SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_inn_local +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 10 length 62 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[smbpasswd] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop [sql] expand: %{User-Name} -> tee [sql] sql_set_user escaped user --> 'tee' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_inn_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/synoradius/rad_site_inn_local [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: tee [mschap] Told to do MS-CHAPv2 for tee with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010b00331a030a002e533d32454434413437374342463839453230343834304331374634463043353430354332304645444245 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84e0dc4b85ebc6443eb91adc9df1aaf2 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010b00331a030a002e533d32454434413437374342463839453230343834304331374634463043353430354332304645444245 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84e0dc4b85ebc6443eb91adc9df1aaf2 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 10 to 192.168.178.25 port 32896 EAP-Message = 0x010b005b1900170301005020edf875c62bb996bc491fcb19c1123e1096f555e9ba6ee0f34c057c5c4c3e2211b14d6c3a1ee5d7ab2640d0745727308bcfd4cfdfa2e35da333788efc3c56999be2ef703b63f5c41dc1fb594803acf6 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878588fd9e56ed034e3134225de2 Finished request 8. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32897, id=11, length=238 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878588fd9e56ed034e3134225de2 EAP-Message = 0x020b0050190017030100207d3776e8c3c71e5d5abf3b53d0169beea9e8992f69e2e0bcd672964a460e841617030100206780143ad9c9892791d2440461e354dc14baf8e535682315095dfea3ecd6b3a1 Message-Authenticator = 0x4977fb9bef33eaa2d73876471b3a527c SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020b00061a03 server { PEAP: Setting User-Name to tee Sending tunneled request EAP-Message = 0x020b00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "tee" State = 0x84e0dc4b85ebc6443eb91adc9df1aaf2 server inner-tunnel { SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_inn_local +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 11 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[smbpasswd] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop [sql] expand: %{User-Name} -> tee [sql] sql_set_user escaped user --> 'tee' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'tee' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'tee' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'tee' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_inn_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok Login OK: [tee] (from client EASYBOX port 0 via TLS tunnel) WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /usr/local/synoradius/rad_site_inn_local } # server inner-tunnel [peap] Got tunneled reply code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x40d8b3413d25f4013c2a3ae154c437ac MS-MPPE-Recv-Key = 0xf5a477c13c1244e08cd8f0d853c4865e EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tee" [peap] Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x40d8b3413d25f4013c2a3ae154c437ac MS-MPPE-Recv-Key = 0xf5a477c13c1244e08cd8f0d853c4865e EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tee" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 11 to 192.168.178.25 port 32897 EAP-Message = 0x010c002b190017030100209b99f254f989d6a0e266af1df740bfd7f858aa9be34ded07ca32eea655c957d9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x80f6878589fa9e56ed034e3134225de2 Finished request 9. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.178.25 port 32898, id=12, length=238 User-Name = "tee" NAS-IP-Address = 0.0.0.0 Called-Station-Id = "7C-4F-B5-FE-BD-14:SEHR_GEHEIM" Calling-Station-Id = "14-89-FD-DA-ED-19" NAS-Identifier = "BOSS-SYNOLOGY" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x80f6878589fa9e56ed034e3134225de2 EAP-Message = 0x020c0050190017030100203457dd4974e320f48bb2ea9959f91a702adc65898bb24317aca624fc47854c43170301002011476f7edc9a493c77d431caf59a5d613cf8bfc339c4c150ca2381ca5e7191ba Message-Authenticator = 0x00f7c3ad38840def38f7aa0c62632bbc SYNOUserGet failed. [0x1D00 user_db_get.c:63] # Executing section authorize from file /usr/local/synoradius/rad_site_def_local +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tee", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 12 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/synoradius/rad_site_def_local +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [tee] (from client EASYBOX port 29 cli 14-89-FD-DA-ED-19) # Executing section post-auth from file /usr/local/synoradius/rad_site_def_local +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 12 to 192.168.178.25 port 32898 MS-MPPE-Recv-Key = 0xe3cd1d3d8847bb78c279ac58d6e6c42cdaebdc4c82cb41b506ee08c319b6b748 MS-MPPE-Send-Key = 0x24cef9cb1a537db7be194b7dd4465ad0a374a79a30926c05f1e8e549b0ca92d9 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tee" Finished request 10. Going to the next request Waking up in 4.6 seconds. Cleaning up request 0 ID 2 with timestamp +39 Cleaning up request 1 ID 3 with timestamp +39 Cleaning up request 2 ID 4 with timestamp +39 Cleaning up request 3 ID 5 with timestamp +39 Cleaning up request 4 ID 6 with timestamp +39 Cleaning up request 5 ID 7 with timestamp +39 Cleaning up request 6 ID 8 with timestamp +39 Cleaning up request 7 ID 9 with timestamp +39 Cleaning up request 8 ID 10 with timestamp +39 Cleaning up request 9 ID 11 with timestamp +39 Cleaning up request 10 ID 12 with timestamp +40 Ready to process requests.

1 0

Talloc sanity error (3.0 release branch, reproxying from PEAP inner tunnel)
by Brian Julin 12 Aug '13

12 Aug '13

I finally got around to trying some RC code (the release_branch_3.0.0 on github) on our production configurations, after a bit of massaging got them looking like they were working, but not so much the one that re-proxies the inner tunnel contents to an internal server after unwrapping EAP-PEAP: peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = yes copy_request_to_tunnel = no use_tunneled_reply = yes tls = eduroam-eap-tls } Any request that tries to go to the proxy causes this to happen: Wed Aug 7 11:57:35 2013 : Debug: (5) - entering if ("%{FreeRADIUS-Proxied-To}" == 127.0.0.1) {...} Wed Aug 7 11:57:35 2013 : Debug: (5) update control { Wed Aug 7 11:57:35 2013 : Debug: (5) Proxy-To-Realm := "idpi" ... Wed Aug 7 11:57:35 2013 : Debug: (5) } # update control = ok Wed Aug 7 11:57:35 2013 : Debug: (5) - if ("%{FreeRADIUS-Proxied-To}" == 127.0.0.1) returns ok Wed Aug 7 11:57:35 2013 : Debug: (5) ... skipping else for request 5: Preceding "if" was taken } # server eduroam_idp Wed Aug 7 11:57:35 2013 : Debug: (5) eap_peap : Got tunneled reply code 0 Wed Aug 7 11:57:35 2013 : Debug: PEAP: Tunneled authentication will be proxied to idpi Wed Aug 7 11:57:35 2013 : Info: talloc: access after free error - first free may be at src/main/util.c:230 Wed Aug 7 11:57:35 2013 : Info: Bad talloc magic value - access after free ... I don't know if this is of any use, being so far removed from the free(): Program received signal SIGABRT, Aborted. [Switching to Thread 0x7ffff5eb4700 (LWP 27579)] 0x0000003fe54328a5 in raise () from /lib64/libc.so.6 ... (gdb) bt #0 0x0000003fe54328a5 in raise () from /lib64/libc.so.6 #1 0x0000003fe5434085 in abort () from /lib64/libc.so.6 #2 0x00007ffff7782c3c in ?? () from /usr/lib64/libtalloc.so.2 #3 0x00007ffff7782dd8 in talloc_get_name () from /usr/lib64/libtalloc.so.2 #4 0x00007ffff77857eb in _talloc_get_type_abort () from /usr/lib64/libtalloc.so.2 #5 0x00007ffff7bb4d95 in pairnext (cursor=0x7ffff5eb2950) at src/lib/valuepair.c:290 #6 0x00007ffff7bb4b42 in pairfind (vp=0x7fffe8007d80, attr=80, vendor=0, tag=-128 '\200') at src/lib/valuepair.c:209 #7 0x00007ffff6f58d45 in mod_authenticate (instance=0x7f8b30, request=0x844e40) at src/modules/rlm_eap/rlm_eap.c:360 #8 0x0000000000421812 in call_modsingle (component=0, sp=0x81ce30, request=0x844e40) at src/main/modcall.c:311 #9 0x0000000000422f93 in modcall (component=0, c=0x81cf30, request=0x844e40) at src/main/modcall.c:782 #10 0x000000000041f4c6 in indexed_modcall (comp=0, idx=6, request=0x844e40) at src/main/modules.c:758 #11 0x0000000000421127 in process_authenticate (auth_type=6, request=0x844e40) at src/main/modules.c:1648 #12 0x000000000040c910 in rad_check_password (request=0x844e40) at src/main/auth.c:252 #13 0x000000000040cee4 in rad_authenticate (request=0x844e40) ---Type <return> to continue, or q <return> to quit--- at src/main/auth.c:490 #14 0x0000000000430b79 in request_running (request=0x844e40, action=1) at src/main/process.c:1185 #15 0x000000000042d02e in request_handler_thread (arg=0x8397c0) at src/main/threads.c:685 #16 0x0000003fe5c07851 in start_thread () from /lib64/libpthread.so.0 #17 0x0000003fe54e811d in clone () from /lib64/libc.so.6 (gdb) (gdb) up #1 0x0000003fe5434085 in abort () from /lib64/libc.so.6 (gdb) up #2 0x00007ffff7782c3c in ?? () from /usr/lib64/libtalloc.so.2 (gdb) up #3 0x00007ffff7782dd8 in talloc_get_name () from /usr/lib64/libtalloc.so.2 (gdb) up #4 0x00007ffff77857eb in _talloc_get_type_abort () from /usr/lib64/libtalloc.so.2 (gdb) up #5 0x00007ffff7bb4d95 in pairnext (cursor=0x7ffff5eb2950) at src/lib/valuepair.c:290 290 VERIFY_VP(cursor->current); (gdb) list 285 */ 286 VALUE_PAIR *pairnext(vp_cursor_t *cursor) 287 { 288 cursor->current = cursor->next; 289 if (cursor->current) { 290 VERIFY_VP(cursor->current); 291 292 /* 293 * Set this now in case 'current' gets freed before 294 * pairnext is called again. (gdb) print cursor->current $1 = (VALUE_PAIR *) 0x7fffe8007820 (gdb) print cursor->current->da $2 = (const DICT_ATTR *) 0x6c6c617420646142 (gdb) print *cursor->current->da Cannot access memory at address 0x6c6c617420646142 (gdb) up #6 0x00007ffff7bb4b42 in pairfind (vp=0x7fffe8007d80, attr=80, vendor=0, tag=-128 '\200') at src/lib/valuepair.c:209 209 i = pairnext(&cursor)) { (gdb) list 204 vp_cursor_t cursor; 205 VALUE_PAIR *i; 206 207 for (i = paircursor(&cursor, &vp); 208 i; 209 i = pairnext(&cursor)) { 210 VERIFY_VP(i); 211 if ((i->da->attr == attr) && (i->da->vendor == vendor) 212 && ((tag == TAG_ANY) || (i->da->flags.has_tag && 213 (i->tag == tag)))) { (gdb) print attr $3 = 80 (gdb) print vendor $4 = 0 (gdb) print tag $5 = -128 '\200' (gdb) print i->da->name $6 = "U" (gdb) print *(char *)i->da->name $7 = 85 'U' (gdb) print *(char *)i->da->name + 1 $8 = 86 (gdb) print *(char *)(i->da->name + 1) $9 = 115 's' (gdb) print *(char *)(i->da->name + 2) $10 = 101 'e' (gdb) print *(char *)(i->da->name + 3) $11 = 114 'r' (gdb) print *(char *)(i->da->name + 4) $12 = 45 '-' (gdb) print *(char *)(i->da->name + 5) $13 = 78 'N' (gdb) up #7 0x00007ffff6f58d45 in mod_authenticate (instance=0x7f8b30, request=0x844e40) at src/modules/rlm_eap/rlm_eap.c:360 360 vp = pairfind(request->proxy->vps, PW_MESSAGE_AUTHENTICATOR, 0, TAG_ANY); (gdb) print request $14 = (REQUEST *) 0x844e40 (gdb) print request->proxy $15 = (RADIUS_PACKET *) 0x7fffe8007bc0 (gdb) print request->proxy->vps $16 = (VALUE_PAIR *) 0x7fffe8007d80 (gdb) print request->proxy->vps->da $17 = (const DICT_ATTR *) 0x66dbf0 (gdb) print request->proxy->vps->da->name $18 = "E" (gdb) print (char *)request->proxy->vps->da->name $19 = 0x66dc00 "EAP-Message" (gdb) print (char *)request->proxy->vps->da->type $20 = 0x6 <Address 0x6 out of bounds> (gdb) print request->proxy->vps->da->type $21 = PW_TYPE_OCTETS (gdb) print (char *)request->proxy->vps->next->da->name $22 = 0x6d8b08 "FreeRADIUS-Proxied-To" (gdb) print (char *)request->proxy->vps->next->next->da->name $23 = 0x66c280 "User-Name" (gdb) print (char *)request->proxy->vps->next->next->next->da->name $24 = 0x6c6c617420646152 <Address 0x6c6c617420646152 out of bounds> (gdb) up #8 0x0000000000421812 in call_modsingle (component=0, sp=0x81ce30, request=0x844e40) at src/main/modcall.c:311 311 myresult = sp->modinst->entry->module->methods[component]( (gdb) list 306 /* 307 * For logging unresponsive children. 308 */ 309 request->module = sp->modinst->name; 310 311 myresult = sp->modinst->entry->module->methods[component]( 312 sp->modinst->insthandle, request); 313 314 request->module = ""; 315 safe_unlock(sp->modinst); (gdb) The good news is the outbound instance for RadSec proxy seems to be holding up so far. I've got another few weeks to test that before EDUROAM-US retracts RadSec service pending getting their PKI in order, so I'll try to bang on it a bit stress and endurance-wise before it goes away.

4 9

RE: VLAN assignment to HP Switch with 802.1x client
by Shaw, Colin M. 09 Aug '13

09 Aug '13

Thanks for the reply Phil. > > difference. Lastly, for testing purposes, if I insert the required > > attributes into the default post-auth then it all works and the wired > > client is assigned the correct vlan, so again the switch side must be > > ok and I also therefore presume all the dictionary entries are there > > as required. But I shouldn't need (or want) to do this. > > Yes you should. You should always aim to set these attributes in post-auth; > otherwise you'll see what you are seeing, the attributes getting set in access- > challenge. This is a function of how EAP is processed by the server. Ok, but the attribute values are going to be different for different clients (as matched & specified in the users file). Can I deal with that in post-auth? For this particular service we are simply matching the switch from a huntgroup and setting the vlan in the users file (so we are not even doing any of the LDAP lookups we do in some of our wireless services): So in users we have: DEFAULT Huntgroup-Name == "resnet-wired-auth-sw" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = resnet, Fall-Through = No > > Without a full debug, it's not obvious what you need to change, because it's > not obvious what you are doing. But it *might* be that you've missed > "use_tunneled_reply" in the "peap {}" section. My peap section in eap.conf is: peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" } > > > > Hopefully this sort of thing has been done enough times that someone out > > there has fallen into whatever trap I currently find myself in and can > > point me in the right direction I need to be looking. But if not, I can > > of course supply the output of radiusd -X and the switch debug if it's > > going to help any. > > Yes, it will. Ok. Below is an example of the output from the switch debug and radiusd -x (sorry it's not from the same attempt, but the outcomes seem identical regardless of the session). In this test to keep things a bit simpler I switched off the ldap authorization we normally have enabled - the debug output is big enough as it is and the ldap lookup is not needed for this (I've tried with it enabled as well though). Note that vlan 120 is the default vlan on the switch port, and is what the switch is wrongly putting the client on when authentication is successful with the new server - it's being put on the default vlan regardless of what vlan that is set as. radiusd -X: (Only thing I've removed is a lot of the repeated entries for [preprocess] expand: %{Client-IP-Address} ->) Ready to process requests. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=123, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" EAP-Message = 0x02010018017465737477696669406162646e2e61632e756b Message-Authenticator = 0x168dbbb1d5f0c6df099507e2a0b6f02f MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 24 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 20 ++[files] returns ok ++[expiration] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Flushing SSL sessions (of #0) [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 123 to x.x.x.x port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "resnet" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e74c686cb9198540381901eb Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=124, length=479 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e74c686cb9198540381901eb EAP-Message = 0x0202008919800000007f160301007a01000076030152010d5c1c755b6e7a70e2a637ee6144578d9cc2b51299984a3ebed45860c4c0205936d330d320b58435451ecbc1e0a851a243e1956163a 4fbd4f13713a176ae030018002f00350005000ac013c014c009c00a003200380013000401000015ff01000100000a0006000400170018000b00020100 Message-Authenticator = 0x506da8d0b547c788e7fdcc6228030b7a MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 137 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 127 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 007a], ClientHello SSL: Client requested nonexistent cached session 5936d330d320b58435451ecbc1e0a851a243e1956163a4fbd4f13713a176ae03 [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0051], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0d41], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 124 to x.x.x.x port 1812 EAP-Message = 0x0103040019c000000da516030100510200004d030152010d5c3210cd66496b25a43efe40e34aa5a48092009029aa4be30cbb89f896206165f84387d24004e04f4badfd6f5000bfacd09cad352 3e232e6cef6db3d9b5b002f000005ff010001001603010d410b000d3d000d3a000529308205253082040da0030201020212112162a61e0bc8aaffe89f2f89b3613bc788300d06092a864886f70d 0101050500305d310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361313330310603550403132a476c6f62616c5369676e204f7267616e697a617 4696f6e2056616c69646174696f6e204341202d2047 EAP-Message = 0x32301e170d3132303731313135343030325a170d3137303731313135333135315a3070310b30090603550406130247423111300f0603550408130853636f746c616e643111300f06035504071 308416265726465656e311f301d060355040a1316556e6976657273697479206f6620416265726465656e311a3018060355040313117261646975732e6162646e2e61632e756b30820122300d06 092a864886f70d01010105000382010f003082010a0282010100c006610261569828f6cd2239da8d6c8b2f32c14a4f3ddc14b00a2bbb458be49c292b00d6af16e913f9790fa3c0e5f9b1f482601 b7d53124297f3f115d827db4f992c78f8b73059a393 EAP-Message = 0x18b48ac15797b9b1877b28e5b306a5db2fcffc68a8e435c2e5c9db0caea5ca3bb8573aa29d76e4d461e9415243a67589829893b2734b8fb0a04f199639589049b511155dd15e2749f538b69fe f73a6f917a0f8998cb39785e4c3aa75d8fa35e578bbd80baa3494f0024573f95e3823cdbc7c6a1b663e3f7e643d2958ca0ae9f6be5e8891ad3a21f14727a2adaafd4979782173a6fb516018126a 91ada644b0f4355b227ead7fc041a761450e7087ee27f944266d225a430203010001a38201ca308201c6300e0603551d0f0101ff0404030205a0304c0603551d2004453043304106092b0601040 1a03201143034303206082b06010505070201162668 EAP-Message = 0x747470733a2f2f7777772e676c6f62616c7369676e2e636f6d2f7265706f7369746f72792f301c0603551d110415301382117261646975732e6162646e2e61632e756b30090603551d1304023 000301d0603551d250416301406082b0601050507030106082b0601050507030230450603551d1f043e303c303aa038a0368634687474703a2f2f63726c2e676c6f62616c7369676e2e636f6d2f 67732f67736f7267616e697a6174696f6e76616c67322e63726c30819606082b06010505070101048189308186304706082b06010505073002863b687474703a2f2f7365637572652e676c6f626 16c7369676e2e636f6d2f6361636572742f67736f72 EAP-Message = 0x67616e697a6174696f6e7661 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e64d686cb9198540381901eb Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=125, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e64d686cb9198540381901eb EAP-Message = 0x020300061900 Message-Authenticator = 0x116b1855c08cd970fefe2dd99b22651a MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 125 to x.x.x.x port 1812 EAP-Message = 0x010403fc19406c67322e637274303b06082b06010505073001862f687474703a2f2f6f637370322e676c6f62616c7369676e2e636f6d2f67736f7267616e697a6174696f6e76616c6732301d0 603551d0e04160414f78dde93afa8effe4fdbc4932e8d2029a5c06e8b301f0603551d230418301680145d46b28dc44b741cbbedf573b63ab7388f759e7e300d06092a864886f70d010105050003 8201010083c427e4c31f4af6d06897c2829aec0fd2a9d5cccb745effdf7f5a4cfcb28a29071f7e1a9bd5fd5fb9542ece1ebc2c91522c790e9990bf5107e05a59a9cd98874568285d8c667f4a461 f1c23edad40cdd9de0a830d173cb6faf7b0be14eccd EAP-Message = 0x78b860d3b5dfcac3e29122557abf70266ea30f5ff2b8a57c953cb60b7eeb7d9897e01a9bb9a8aac01ef96b63ec1075369ae9ad0f547621d4a4bec7d0a28afcb7e7b8d3104c02b8e273052b88b b0497fc17b07d11fa1759a730b4474ba52206dbc304dd1a52ce5c655e42169d486f301436001dffea9b20d1eeaaf74874475d8fc36413fbc47a5761e57745c90061603035ec9118cfceff1e2a08 1b5f63d9bb779400048f3082048b30820373a003020102020b0400000000012f4ee142f9300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a13104 76c6f62616c5369676e206e762d73613110300e0603 EAP-Message = 0x55040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3131303431333130303030305a170d3232303431333130303030305a305d310 b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d7361313330310603550403132a476c6f62616c5369676e204f7267616e697a6174696f6e2056616c69 646174696f6e204341202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100dd351df22054261ad0efa56f81765970dce7f4d403241f240e9d229fd4273 27a2b7cee8be361623817afb44b7a9f67211c2d9554 EAP-Message = 0xba79bab6c4f20d2174176774e2b16408996078fb67c24bf7278d6f3676cf318ce5f106d7dc570e5baceece2dabaaa9702f0286c8b1d0080795ea2aecd19ee4365c3ba636b5438babf78e3e001 bff85596b62018d82e84aba38b3e0c3f46d19a7ea05dd8467c266c72402735ab5eea419d9fc00ceb6a48ddf7ebd5fb23a9d84314fc8630ce4d80d52a37e011bd467a51828eb01a7823cd98e1de5 470dba8b5914a31f1f4beae2274686ce9d39c46641a7e215236b5647c1edc553e4d4801f6bfa804698b209a60f95be6688930203010001a38201503082014c300e0603551d0f0101ff040403020 10630120603551d130101ff040830060101ff020100 EAP-Message = 0x301d0603551d0e04 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e54a686cb9198540381901eb Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=126, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e54a686cb9198540381901eb EAP-Message = 0x020400061900 Message-Authenticator = 0xa39534ada4b4b62e8f39dbeb66b46a8c MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 126 to x.x.x.x port 1812 EAP-Message = 0x010503fc19401604145d46b28dc44b741cbbedf573b63ab7388f759e7e30470603551d200440303e303c0604551d20003034303206082b06010505070201162668747470733a2f2f7777772e6 76c6f62616c7369676e2e636f6d2f7265706f7369746f72792f30330603551d1f042c302a3028a026a0248622687474703a2f2f63726c2e676c6f62616c7369676e2e6e65742f726f6f742e6372 6c303d06082b060105050701010431302f302d06082b060105050730018621687474703a2f2f6f6373702e676c6f62616c7369676e2e636f6d2f726f6f74723130290603551d250422302006082 b0601050507030106082b06010505070302060a2b06 EAP-Message = 0x01040182370a0303301f0603551d23041830168014607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100737aec012c1722919acab16718a2bac 805899224de1fb8ab449ff7405565f2e0f42ec7deb03f99151f957082e99b4a64242016f07617d21bfeacfa06b477cf98d82aec5715d85e4edd8b96e153331991d5846e25ef0fcbadbfdb4b6b56 ccb5d4403e265eb659f4c590c909c484dfbc267d82e9ebf45bfcc815de09184586b38b4dc76b35279b60f6a45a2a5849b1d83543c632bb5e3bc44a21c1a03b5ec123a9cedbd5bafe5d6dfd007ef af1943761b900396696a99cb41e11ef55d8b4d8b0c4 EAP-Message = 0xa5ae320a2ff82df4a2a7ff36d35e638b4e12f7b5288075ee942f70a0567739aa399717fc00f3cf66e7a27192ab059b732e7ae7e72159098d30a1ac5cca197af8000379308203753082025da00 3020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e 060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a30573 10b300906035504061302424531193017060355040a EAP-Message = 0x1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a86488 6f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cb ab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123 c927896d6dc746e934461d18dc746b2750e86e8198a EAP-Message = 0xd56d6cd5781695a2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e44b686cb9198540381901eb Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=127, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e44b686cb9198540381901eb EAP-Message = 0x020500061900 Message-Authenticator = 0x021a9250c5747a74c8497726c945f15f MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 127 to x.x.x.x port 1812 EAP-Message = 0x010601c91900e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2 ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b 661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3c a3d614dd34609b33ec3a0e363551bf2baefad39e143 EAP-Message = 0xb938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b11 5b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f4 2be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e016030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e348686cb9198540381901eb Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=128, length=680 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e348686cb9198540381901eb EAP-Message = 000206015019800000014616030101061000010201008b00d78219cd2390d34f32fe9caeb4de7c4fe65a91e3c6763b22ba06096d4c7a4573faf0617fede564d7e691eaa7bad9d523f9a965793a7 50548db117f234a151c254d734acc5599387e6dee409410a4531b137887fe973f881c32ce652710b693f3c2e0251e967c19fe656bad3b6caa962a9095f2080b46417cad03e33571392fe6915b0c a36adf59987b461c291dcf319c707df307190ca927f98e9fe9e8b64e9022db6ee1c18939d6c41f6a59d89417a13cb4cd482b0a4bcc7826a92c92b31731df22488573087e789bb91c13952d0dff8 71cce3b0773c90b45c74e00c0005cf386b04504d3ff EAP-Message = 0xb0485b74f7956159fa1704e55ab4d31ed1625bfda2343b68140301000101160301003035585c69924c15007235b8e1e71b8a7827f96c9fd4093b32db8d10e9ea138d01e4e77662e37f6999e99 b96c9072d71d6 Message-Authenticator = 0x2dee2d2be7996467e6824f731ee3d14f MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 326 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data SSL: adding session 6165f84387d24004e04f4badfd6f5000bfacd09cad3523e232e6cef6db3d9b5b to cache [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 128 to x.x.x.x port 1812 EAP-Message = 0x0107004119001403010001011603010030eb16e53e55c7b54849272977678e0538dcd33f875800cee2a67eb292ad77e640e9ffec1733ebeccfcdc882168d9f40fa Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e249686cb9198540381901eb Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=129, length=348 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e249686cb9198540381901eb EAP-Message = 0x020700061900 Message-Authenticator = 0x562d796d691cd91c89ffb97581861286 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled Sending Access-Challenge of id 129 to x.x.x.x port 1812 EAP-Message = 0x0108002b19001703010020040fc44c91ba44f7bd9bddec59e6e31e17bde5d24d964b64d248b8ab55cfc6a2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e146686cb9198540381901eb Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=130, length=401 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e146686cb9198540381901eb EAP-Message = 0x0208003b1900170301003031effb5325043a7d60adabb9b8a0252e9be2e2b2ba985ed1f25fa50ec27fafefed984a3fe1c64d45ca9ddc29923e9100 Message-Authenticator = 0xbe72500ee8d8531d0fa47b4db221dba2 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 59 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state WAITING FOR INNER IDENTITY [peap] Identity - testx(a)abdn.ac.uk [peap] Got inner identity 'testx(a)abdn.ac.uk' [peap] Setting default EAP type for tunneled EAP session. [peap] Got tunneled request EAP-Message = 0x02080018017465737477696669406162646e2e61632e756b server { [peap] Setting User-Name to testx(a)abdn.ac.uk Sending tunneled request EAP-Message = 0x02080018017465737477696669406162646e2e61632e756b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testx(a)abdn.ac.uk" Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 8 length 24 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x ++[files] returns noop ++[expiration] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x0109002d1a0109002810003ab4b0ebafb4a77061274bf5668fda7465737477696669406162646e2e61632e756b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07e896ed096a9cd7911a48739 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0109002d1a0109002810003ab4b0ebafb4a77061274bf5668fda7465737477696669406162646e2e61632e756b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07e896ed096a9cd7911a48739 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 130 to x.x.x.x port 1812 EAP-Message = 0x0109004b19001703010040823a8435990e74e1a1008520cbd9b383a45fc84de1204f3fca3b1e7467552c2a36f3f9acc23692e15a93a6f5e8ba9727cf12d7879c4607dbe7dd36732fa935cc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e047686cb9198540381901eb Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=131, length=449 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176e047686cb9198540381901eb EAP-Message = 0x0209006b19001703010060182b591b778c6d6203f6eef6c5bb7ac1ed35cbd08d7c2c82b9ddad5d157d845f92dd071a9aa51150d8905464424e708e34fdb6d220256cac4a2010cb34958cd22b3 2e43538c2e9585bda432fc2238f2fdd4abc3bfd44fb24fe186342c37cbba4 Message-Authenticator = 0x704dc77781b14614a41ea8d814e1ee69 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 9 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x0209004e1a0209004931da2a4b19cf93e70067fa2ed835f0db300000000000000000a0825219da677f2a0f064a344431282f64d355292c323965007465737477696669406162646e2e61632e7 56b server { [peap] Setting User-Name to testx(a)abdn.ac.uk Sending tunneled request EAP-Message = 0x0209004e1a0209004931da2a4b19cf93e70067fa2ed835f0db300000000000000000a0825219da677f2a0f064a344431282f64d355292c323965007465737477696669406162646e2e61632e7 56b FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testx(a)abdn.ac.uk" State = 0x7e8074c07e896ed096a9cd7911a48739 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 9 length 78 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x ++[files] returns noop ++[expiration] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ((EAP-Type == 1) || (EAP-Message =~ /^0x02..00061a..$/)) [mschapv2] ?? Evaluating (EAP-Type == 1) -> FALSE [mschapv2] ?? Evaluating (EAP-Message =~ /^0x02..00061a..$/) -> FALSE [mschapv2] ++? if ((EAP-Type == 1) || (EAP-Message =~ /^0x02..00061a..$/)) -> FALSE [mschapv2] ++- entering else else {...} [mschap] Creating challenge hash with username: testx(a)abdn.ac.uk [mschap] Client is using MS-CHAPv2 for testx(a)abdn.ac.uk, we need NT-Password [mschap] expand: %{Stripped-User-Name} -> testx [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=testx [mschap] Creating challenge hash with username: testx(a)abdn.ac.uk [mschap] expand: %{mschap:Challenge} -> 8f7e12267adfef9c [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=8f7e12267adfef9c [mschap] expand: %{mschap:NT-Response} -> a0825219da677f2a0f064a344431282f64d355292c323965 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a0825219da677f2a0f064a344431282f64d355292c323965 Exec-Program output: NT_KEY: 84D49D39C55C2983830A96941BD1D7AA Exec-Program-Wait: plaintext: NT_KEY: 84D49D39C55C2983830A96941BD1D7AA Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys +++[mschap] returns ok ++- else else returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d41433336464635303544413032374234374543314237464433453631363144384246433334363936 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07f8a6ed096a9cd7911a48739 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d41433336464635303544413032374234374543314237464433453631363144384246433334363936 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7e8074c07f8a6ed096a9cd7911a48739 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 131 to x.x.x.x port 1812 EAP-Message = 0x010a005b19001703010050099889e745a0cb12423f5c7e64cb1a2f7723411b9adccd81fd40cc0dbfe9828ebdaa8c15412abe265e6c04100de5e9556a707bec78739d33822b2732d2ba050bdf6 40a6ca232a68dd52c4b2757f913af Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176ef44686cb9198540381901eb Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=132, length=385 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176ef44686cb9198540381901eb EAP-Message = 0x020a002b19001703010020d8caf6fd9d96650ff344d457d8a8412b78f5fe4dd966d1fae7485f2ed861a27d Message-Authenticator = 0x5deaf00357d43558e49095a3f6ca29bc MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00061a03 server { [peap] Setting User-Name to testx(a)abdn.ac.uk Sending tunneled request EAP-Message = 0x020a00061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "testx(a)abdn.ac.uk" State = 0x7e8074c07f8a6ed096a9cd7911a48739 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 server inner-tunnel { # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 10 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x [files] expand: %{Client-IP-Address} -> x.x.x.x ++[files] returns noop ++[expiration] returns noop ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel +- entering group post-auth {...} [reply_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [reply_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[reply_log] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xacbbc63ebd6b3c7e993938ca4acc15cb MS-MPPE-Recv-Key = 0xe37c54e02433c82a6f60d5a90b6eceaf EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testx" [peap] Got tunneled reply RADIUS code 2 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xacbbc63ebd6b3c7e993938ca4acc15cb MS-MPPE-Recv-Key = 0xe37c54e02433c82a6f60d5a90b6eceaf EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testx" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later ++[eap] returns handled Sending Access-Challenge of id 132 to x.x.x.x port 1812 EAP-Message = 0x010b002b190017030100209d098a2bb1a57dba1b3f00ca81dbcc3028ad018d6787771efbb8955ce1263b62 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176ee45686cb9198540381901eb Finished request 9. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=133, length=385 Framed-MTU = 1480 NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx(a)abdn.ac.uk" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 125 NAS-Port-Type = Ethernet NAS-Port-Id = "F5" Called-Station-Id = "xx-xx-xx-xx-xx-xx" Calling-Station-Id = "xx-xx-xx-xx-xx-xx" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "120" State = 0xe74e7176ee45686cb9198540381901eb EAP-Message = 0x020b002b190017030100209bc7ce2e9fc0caa38604cade411e3373e153471a8fb8113d5c51e1424baaf4b3 Message-Authenticator = 0xe48e296335f7379ea7170dee7dec4241 MS-RAS-Vendor = 11 HP-Capability-Advert = 0x011a0000000b28 HP-Capability-Advert = 0x011a0000000b2e HP-Capability-Advert = 0x011a0000000b30 HP-Capability-Advert = 0x011a0000000b3d HP-Capability-Advert = 0x0138 HP-Capability-Advert = 0x013a HP-Capability-Advert = 0x0140 HP-Capability-Advert = 0x0141 HP-Capability-Advert = 0x0151 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [auth_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/auth-detail-20130806 [auth_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "abdn.ac.uk" for User-Name = "testx(a)abdn.ac.uk" [suffix] Found realm "abdn.ac.uk" [suffix] Adding Stripped-User-Name = "testx" [suffix] Adding Realm = "abdn.ac.uk" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 11 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Using saved attributes from the original Access-Accept User-Name = "testx" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop [reply_log] expand: %{Packet-Src-IP-Address} -> x.x.x.x [reply_log] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/reply-detail-20130806 [reply_log] expand: %t -> Tue Aug 6 15:51:08 2013 ++[reply_log] returns ok Sending Access-Accept of id 133 to x.x.x.x port 1812 User-Name = "testx" MS-MPPE-Recv-Key = 0x828f7f8bcf286eae0e609f69762db9e7114a5eb5f2dc922a450d175c06f27e1e MS-MPPE-Send-Key = 0xe2972bc77c895a34b6bfaf07da5794995b97beeefbe3b12f934653dfa0662cc4 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 10. Going to the next request Waking up in 4.9 seconds. rad_recv: Accounting-Request packet from host x.x.x.x port 1813, id=134, length=118 Acct-Session-Id = "001200000030" Acct-Status-Type = Start Service-Type = Framed-User Acct-Authentic = RADIUS NAS-Port = 125 Calling-Station-Id = "xx-xx-xx-xx-xx-xx" NAS-IP-Address = x.x.x.x NAS-Identifier = "x.x.x.x" User-Name = "testx" MS-RAS-Vendor = 11 Acct-Delay-Time = 0 # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} [preprocess] expand: %{Client-IP-Address} -> x.x.x.x [preprocess] expand: %{Client-IP-Address} -> x.x.x.x . . [preprocess] expand: %{Client-IP-Address} -> x.x.x.x ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 125,NAS-Identifier = "x.x.x.x",NAS-IP-Address = x.x.x.x,Acct-Session-Id = "001200000030",User-Name = "testx"' [acct_unique] Acct-Unique-Session-ID = "9d892381f6e04dad". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "testx", looking up realm NULL [suffix] Found realm "DEFAULT" [suffix] Adding Realm = "DEFAULT" [suffix] Accounting realm is LOCAL. ++[suffix] returns ok ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: %{Packet-Src-IP-Address} -> x.x.x.x [detail] expand: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d -> /var/log/radius/radacct/x.x.x.x/detail-20130806 [detail] /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/x.x.x.x/detail-20130806 [detail] expand: %t -> Tue Aug 6 15:51:10 2013 ++[detail] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> testx attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 134 to x.x.x.x port 1813 Finished request 11. Cleaning up request 11 ID 134 with timestamp +23 Going to the next request "debug security" on HP switch: 0004:20:13:34.92 1X m8021xCtrl:Port F5: connection detected. 0004:20:13:34.92 1X m8021xCtrl:Port F5: sent ReqId #1 to 0180c2-000003. 0004:20:13:34.94 1X m8021xCtrl:Port F5: added new client xxxxxx-xxxxxx. 0004:20:13:34.94 1X m8021xCtrl:Port F5: received RspId #1 from xxxxxx-xxxxxx. 0004:20:13:34.94 1X m8021xCtrl:Port F5: started authentication session for client xxxxxx-xxxxxx. 0004:20:13:34.94 RAD mRadiusCtr:Received RADIUS MSG: AUTH REQUEST, session: 165, access method: PORT-ACCESS. 0004:20:13:34.94 1X m8021xCtrl:Port F5: received EAP identity request for client xxxxxx-xxxxxx. 0004:20:13:34.94 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:34.94 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:34.94 RAD mRadiusCtr:ACCESS REQUEST id: 95 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:34.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:35.45 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:35.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:36.45 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:36.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.95 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.96 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.96 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:37.98 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.02 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.03 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.03 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.06 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.50 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:38.79 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.55 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.55 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.55 PSEC eDrvPoll:incoming mac xxxxxx-xxxxxx on port F5 for vlan 120 rejected by portsec demux. wma does not want this pkt. 0004:20:13:39.93 RAD mRadiusCtr:ACCESS REQUEST id: 95 to y.y.y.y has timed out. 0004:20:13:39.93 1X m8021xCtrl:Port F5: received notification for client xxxxxx-xxxxxx: 'Can't reach RADIUS server...' 0004:20:13:39.93 1X m8021xCtrl:Port F5: dropped notification for client xxxxxx-xxxxxx. 0004:20:13:39.93 RAD mRadiusCtr:ACCESS REQUEST id: 95 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:39.99 RAD tRadiusR:ACCESS CHALLENGE id: 95 from y.y.y.y received. 0004:20:13:39.99 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:39.99 1X m8021xCtrl:Port F5: sent EAP request #2 to 0180c2-000003. 0004:20:13:39.99 RAD tRadiusR:ACCESS CHALLENGE id: 95 from y.y.y.y received. 0004:20:13:39.99 RAD tRadiusR:ACCESS CHALLENGE id: 95 from y.y.y.y DROPPED, not in waiting for server reply state. 0004:20:13:39.99 1X m8021xCtrl:Port F5: received type 25 EAP response #2 from xxxxxx-xxxxxx. 0004:20:13:39.99 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:39.99 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:39.99 RAD mRadiusCtr:ACCESS REQUEST id: 96 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.05 RAD tRadiusR:ACCESS CHALLENGE id: 96 from y.y.y.y received. 0004:20:13:40.05 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.05 1X m8021xCtrl:Port F5: sent EAP request #3 to 0180c2-000003. 0004:20:13:40.06 1X m8021xCtrl:Port F5: received type 25 EAP response #3 from xxxxxx-xxxxxx. 0004:20:13:40.06 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.06 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.06 RAD mRadiusCtr:ACCESS REQUEST id: 97 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.06 RAD tRadiusR:ACCESS CHALLENGE id: 97 from y.y.y.y received. 0004:20:13:40.06 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.06 1X m8021xCtrl:Port F5: sent EAP request #4 to 0180c2-000003. 0004:20:13:40.06 1X m8021xCtrl:Port F5: received type 25 EAP response #4 from xxxxxx-xxxxxx. 0004:20:13:40.06 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.06 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.06 RAD mRadiusCtr:ACCESS REQUEST id: 98 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.07 RAD tRadiusR:ACCESS CHALLENGE id: 98 from y.y.y.y received. 0004:20:13:40.07 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.07 1X m8021xCtrl:Port F5: sent EAP request #5 to 0180c2-000003. 0004:20:13:40.07 1X m8021xCtrl:Port F5: received type 25 EAP response #5 from xxxxxx-xxxxxx. 0004:20:13:40.07 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.07 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.07 RAD mRadiusCtr:ACCESS REQUEST id: 99 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: x.x.x.x 0004:20:13:40.07 RAD tRadiusR:ACCESS CHALLENGE id: 99 from y.y.y.y received. 0004:20:13:40.07 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.07 1X m8021xCtrl:Port F5: sent EAP request #6 to 0180c2-000003. 0004:20:13:40.08 1X m8021xCtrl:Port F5: received type 25 EAP response #6 from xxxxxx-xxxxxx. 0004:20:13:40.08 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.08 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.08 RAD mRadiusCtr:ACCESS REQUEST id: 100 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.09 RAD tRadiusR:ACCESS CHALLENGE id: 100 from y.y.y.y received. 0004:20:13:40.09 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.09 1X m8021xCtrl:Port F5: sent EAP request #7 to 0180c2-000003. 0004:20:13:40.09 1X m8021xCtrl:Port F5: received type 25 EAP response #7 from xxxxxx-xxxxxx. 0004:20:13:40.09 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.09 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.09 RAD mRadiusCtr:ACCESS REQUEST id: 101 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.09 RAD tRadiusR:ACCESS CHALLENGE id: 101 from y.y.y.y received. 0004:20:13:40.09 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.09 1X m8021xCtrl:Port F5: sent EAP request #8 to 0180c2-000003. 0004:20:13:40.10 1X m8021xCtrl:Port F5: received type 25 EAP response #8 from xxxxxx-xxxxxx. 0004:20:13:40.10 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.10 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.10 RAD mRadiusCtr:ACCESS REQUEST id: 102 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.10 RAD tRadiusR:ACCESS CHALLENGE id: 102 from y.y.y.y received. 0004:20:13:40.10 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.10 1X m8021xCtrl:Port F5: sent EAP request #9 to 0180c2-000003. 0004:20:13:40.11 1X m8021xCtrl:Port F5: received type 25 EAP response #9 from xxxxxx-xxxxxx. 0004:20:13:40.11 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.11 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.11 RAD mRadiusCtr:ACCESS REQUEST id: 103 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.26 RAD tRadiusR:ACCESS CHALLENGE id: 103 from y.y.y.y received. 0004:20:13:40.26 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.26 1X m8021xCtrl:Port F5: sent EAP request #10 to 0180c2-000003. 0004:20:13:40.27 1X m8021xCtrl:Port F5: received type 25 EAP response #10 from xxxxxx-xxxxxx. 0004:20:13:40.27 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.27 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.27 RAD mRadiusCtr:ACCESS REQUEST id: 104 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.28 RAD tRadiusR:ACCESS CHALLENGE id: 104 from y.y.y.y received. 0004:20:13:40.28 1X m8021xCtrl:Port F5: received EAP request for client xxxxxx-xxxxxx. 0004:20:13:40.28 1X m8021xCtrl:Port F5: sent EAP request #11 to 0180c2-000003. 0004:20:13:40.28 1X m8021xCtrl:Port F5: received type 25 EAP response #11 from xxxxxx-xxxxxx. 0004:20:13:40.28 1X m8021xCtrl:Port F5: sent EAP response from client xxxxxx-xxxxxx to authenticaton server. 0004:20:13:40.28 RAD mRadiusCtr:Received RADIUS MSG: DATA, session: 165. 0004:20:13:40.28 RAD mRadiusCtr:ACCESS REQUEST id: 105 to y.y.y.y, session: 165, access method: PORT-ACCESS, User-Name: testx(a)abdn.ac.uk, Calling-Station-Id: xxxxxx-xxxxxx, NAS-Port-Id: F5, NAS-IP-Address: z.z.z.z 0004:20:13:40.30 RAD tRadiusR:ACCESS ACCEPT id: 105 from y.y.y.y received. 0004:20:13:40.30 1X m8021xCtrl:Port F5: received Success for client xxxxxx-xxxxxx, finished authentication session. 0004:20:13:40.30 UMIB m8021xCtrl:added new dca client xxxxxx-xxxxxx for new client port F5. 0004:20:13:40.30 UMIB m8021xCtrl:Client Mac xxxxxx-xxxxxx, accessMode 8021x 0004:20:13:40.30 1X m8021xCtrl:Port F5: starting session for client xxxxxx-xxxxxx. 0004:20:13:40.30 1X m8021xCtrl:Port F5: sent Success #11 to xxxxxx-xxxxxx. 0004:20:13:40.30 RAD tRadiusR:Removing RADIUS REQUEST id: 105 from queue. 0004:20:13:40.30 RAD mRadiusCtr:Received RADIUS MSG: ACCT REQUEST, session: 83. 0004:20:13:41.81 RAD mRadiusCtr:ACCOUNTING REQUEST id: 106 to y.y.y.y, session: 83, access method: CONSOLE, User-Name: testx, Calling-Station-Id: xxxxxx-xxxxxx, NAS-IP-Address: x.x.x.x. 0004:20:13:41.82 RAD tRadiusR:ACCOUNTING RESPONSE id: 106 from y.y.y.y received. 0004:20:13:41.82 RAD tRadiusR:Removing RADIUS REQUEST id: 106 from queue. 0004:20:14:27.07 RAD mRadiusCtr:Received RADIUS MSG: ACCT REQUEST, session: 32. 0004:20:14:27.07 RAD mRadiusCtr:ACCOUNTING REQUEST id: 107 to y.y.y.y, session: 32, access method: CONSOLE, User-Name: manager, Calling-Station-Id: a.a.a.a, NAS-IP-Address: x.x.x.x. 0004:20:14:27.08 RAD tRadiusR:ACCOUNTING RESPONSE id: 107 from y.y.y.y received. 0004:20:14:27.08 RAD tRadiusR:Removing RADIUS REQUEST id: 107 from queue. 0004:20:14:50.59 SSH tSsh0:Too many authentication failures, status = -6403 0004:20:15:07.30 RAD mRadiusCtr:Received RADIUS MSG: ACCT REQUEST, session: 84. 0004:20:15:07.30 RAD mRadiusCtr:ACCOUNTING REQUEST id: 108 to y.y.y.y, session: 84, access method: CONSOLE, User-Name: manager, Calling-Station-Id: a.a.a.a, NAS-IP-Address: x.x.x.x. 0004:20:15:07.32 RAD tRadiusR:ACCOUNTING RESPONSE id: 108 from y.y.y.y received. 0004:20:15:07.32 RAD tRadiusR:Removing RADIUS REQUEST id: 108 from queue. Thanks, Colin The University of Aberdeen is a charity registered in Scotland, No SC013683.

3 3

Configuring the DHCP module to forward request to another Radius server.
by Fabrice-externe SEGURA 09 Aug '13

09 Aug '13

Hi. I'm trying to use Freeradius 2.2.0 to catch DHCP request on a local network (a specific interface and physical network of my machine), and forward it to another radius server (through another interface), using the radius protocol, to get authorized, and get the IP address to respond with to the DHCP request. I managed to successfully install freeradius, the DHCP module listens and interpret properly incoming requests (and performs properly some attribute rewrites), but I can't find out what line(s) I should put in the "dhcp DHCP-Discover" section of dhcp.conf, to turn the incoming DHCP request into an outgoing radius request to get IP address and authorization from the other radius server (basically, do the proxy job !). I see that there is an example to get authorization and IP allocation with "mac2ip" locally, based on a file, but not how to trigger the forwarding of a new request. Any advice / idea ?

4 9

Multiple policy files
by Jonathan Gazeley 09 Aug '13

09 Aug '13

For a while I've been using FreeRADIUS with a set of includes.d-style directories that I can drop modules, virtual sites, etc into. This works well - until today. So far I've only had one included policy file in use, and the stock policy.conf is commented out. Today I tried to add another new virtual site which also has a policy file. Although radiusd -X clearly shows that the new policy file is being read, my virtual server is unable to call upon policies defined in the file. On a FreeRADIUS server with no other sites/policies, the new site and policy work fine, so it appears to be some kind of namespace issue. I've been through both policy files and there are no namespace clashes. Each policy file has its own name, e.g. policy eduroam {} and policy rainbow {}. Unusually, the debug log doesn't seem to be that helpful (it says that the files have been loaded, and that the policy can't be found by name). Apologies for the naming scheme - the various sites, modules and policies we currently manage have been inherited from various authors and I'm working on overhauling it. "debug-working.log" is from a FreeRADIUS server using only the new virtual site, which works. "debug-not-working.log" is from a full development FreeRADIUS server with other sites and policies, which does not work. "policies" is the policy file used with the existing (eduroam) sites "rainbow.conf" is the new policy that works on its own, but not in conjunction with other policies. Can anyone spare a few minutes to cast an eye over the debug output and see if I've missed something? I spent all yesterday afternoon looking and this problem and didn't make much progress. Thanks, Jonathan

4 5

How to store session info in external database?
by Maciej Lew 09 Aug '13

09 Aug '13

Hi, I would like to store freeradius session information like Acct-Session-Id, Acct-Start-Time, Acct-Stop-Time, Acct-Input-Octets, Acct-Output-Octets, Framed-IP-Address, NAS-IP-Address in external database. We have our devices connected to databases which are readonly so we cannot store those informations there. Also we have database where we want to store session statistics from all devices. Is that possible to achieve ? Till now we tried setting up virtual host with Auth-Type rules redirecting to script but we cannot receive Acct-Session-Id. Here is how our /etc/freeradius/sites-avaliable/default looks like: authorize { chap mschap sql update control { Auth-Type := `/etc/freeradius/bin/testradius '%{User-Name}' '%{Calling-Station-Id}' '%{NAS-IP-Address}' '%{reply:Framed-IP-Address}' '%{reply:Acct-Session-Id}' '%{reply:Acct-Unique-Session-Id}'` } } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } preacct { acct_unique } accounting { # sql } session { # sql } post-auth { # sql } Sorry for any language mistakes :) -- Pozdrawiam Maciej Lew tel. 883-376-062

4 5