Hello, Alan. I checked it. Let me show you full log: Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = " anonymous@espressif.com" Thu Dec 20 01:10:08 2018 : Debug: (138) Chargeable-User-Identity = 0x00 Thu Dec 20 01:10:08 2018 : Debug: (138) Location-Capable = Civic-Location Thu Dec 20 01:10:08 2018 : Debug: (138) Calling-Station-Id = "38-2b-78-03-ee-70" Thu Dec 20 01:10:08 2018 : Debug: (138) Called-Station-Id = "cc-46-d6-09-ed-50:BD" Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port = 13 Thu Dec 20 01:10:08 2018 : Debug: (138) Cisco-AVPair = "audit-session-id=c0a807c8000000015ba9aa3b" Thu Dec 20 01:10:08 2018 : Debug: (138) Acct-Session-Id = "5ba9aa3b/38:2b:78:03:ee:70/1" Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-IP-Address = 192.168.1.200 Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Identifier = "wc-5508" Thu Dec 20 01:10:08 2018 : Debug: (138) Airespace-Wlan-Id = 14 Thu Dec 20 01:10:08 2018 : Debug: (138) Service-Type = Framed-User Thu Dec 20 01:10:08 2018 : Debug: (138) Framed-MTU = 1300 Thu Dec 20 01:10:08 2018 : Debug: (138) NAS-Port-Type = Wireless-802.11 Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Type:0 = VLAN Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Medium-Type:0 = IEEE-802 Thu Dec 20 01:10:08 2018 : Debug: (138) Tunnel-Private-Group-Id:0 = "14" Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x0207007b19001703020070493c43a0045e1a736402d6353c2ebfd02b02b3da47074e8043e42814d384055eb07d8a3fdf5fc763651fee8a9c19e2525e0450f5bee24195a432757be658ec4fec63f0d1a904eaed55de4f98bc097aca893e67f8761a530e374122b3ba2c61eab23cf1af3ecd9ab8edf2907b Thu Dec 20 01:10:08 2018 : Debug: (138) State = 0x9a0fd4fc9e08cd9b875e606333810d4e Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator = 0x3b8a82762eef0a453f82a36821b263f2 Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached attributes Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authorize { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after "@" Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Looking up realm " espressif.com" for User-Name = "anonymous@espressif.com" Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "espressif.com " Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code 2) ID 7 length 123 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Continuing tunnel setup Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = ok Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate { Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with state 0x9a0fd4fc9e08cd9b Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for state 0x9a0fd4fc9e08cd9b, released from the list Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method EAP PEAP (25) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_peap to process data Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Continuing EAP-TLS Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Peer sent flags --- Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls verify] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Done initial handshake Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: [eaptls process] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Session established. Decoding tunneled attributes Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: PEAP state phase2 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP method MSCHAPv2 (26) Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled request Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Setting User-Name to testlogin Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Sending tunneled request to default Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: User-Name = “testlogin" Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: State = 0x0d5314a80d540ec8eca17483a9cfe203 Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server default received request Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x020700441a0207003f3199f6449a50fa3b50be389565dde6ae4b0000000000000000e78496d30625840ded712d0b260d96bead07a7fdd950530a00792e6c696c656b6f76 Thu Dec 20 01:10:08 2018 : Debug: (138) FreeRADIUS-Proxied-To = 127.0.0.1 Thu Dec 20 01:10:08 2018 : Debug: (138) User-Name = "testlogin " Thu Dec 20 01:10:08 2018 : Debug: (138) State = 0x0d5314a80d540ec8eca17483a9cfe203 Thu Dec 20 01:10:08 2018 : Debug: (138) server default { Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: No cached attributes Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authorize { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (!control:Cleartext-Password && &User-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) { Thu Dec 20 01:10:08 2018 : Debug: (138) if (config:User-Password && config:Cleartext-Password) -> FALSE Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from preprocess (rlm_preprocess) Thu Dec 20 01:10:08 2018 : Debug: (138) [preprocess] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from chap (rlm_chap) Thu Dec 20 01:10:08 2018 : Debug: (138) [chap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: Checking for suffix after "@" Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No '@' in User-Name = “testlogin", looking up realm NULL Thu Dec 20 01:10:08 2018 : Debug: (138) suffix: No such realm "NULL" Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from suffix (rlm_realm) Thu Dec 20 01:10:08 2018 : Debug: (138) [suffix] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent EAP Response (code 2) ID 7 length 68 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: No EAP Start, assuming it's an on-going EAP conversation Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = updated Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling sql-wifi (rlm_sql) Thu Dec 20 01:10:08 2018 : Debug: %{User-Name} Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: attribute --> User-Name Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND %{User-Name} Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> testlogin Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: SQL-User-Name set to ’testlogin' Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Closing connection (28): Hit idle_timeout, was idle for 80 seconds Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): You probably need to lower "min" Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Socket destructor called, closing socket Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Reserved connection (19) Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, UserName, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radcheck table Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Conditional check items matched, merging assignment check items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x3161666532333532663366363365333136376163646230306136646366386235 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password FROM 0 TO 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, username, 'NT-Password' as attribute, pass_hash, ':=' as op FROM userstable WHERE username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in radreply table, merging reply items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x3161666532333532663366363365333136376163646230306136646366386235 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 0 MAX 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: APPENDING NT-Password FROM 0 TO 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 0 out 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to group processing Thu Dec 20 01:10:08 2018 : Debug: SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}' Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName=' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='%{SQL-User-Name}' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT 'OfficeWifi' as GroupName FROM userstable WHERE UserName='testlogin' Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: User found in the group table Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = ’testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi": Conditional check items matched Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi": Merging assignment check items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 2 MAX 3 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING NT-Password FROM 0 TO 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 2 out 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = Auth-Type Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[1] = NT-Password Thu Dec 20 01:10:08 2018 : Debug: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: Parsed xlat tree: Thu Dec 20 01:10:08 2018 : Debug: literal --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = ' Thu Dec 20 01:10:08 2018 : Debug: attribute --> SQL-User-Name Thu Dec 20 01:10:08 2018 : Debug: literal --> ' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: EXPAND SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = '%{SQL-User-Name}' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: --> SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Executing select query: SELECT wifi_id as id, 'OfficeWifi' as GroupName, 'NT-Password' as attribute, password, ':=' as op FROM userstable WHERE Username = 'testlogin' ORDER BY id Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: Group "OfficeWifi": Merging reply items Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: FROM 1 TO 1 MAX 2 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: Examining NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: OVERWRITING NT-Password FROM 0 TO 0 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: TO in 1 out 1 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ::: to[0] = NT-Password Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: ... falling-through to profile processing Thu Dec 20 01:10:08 2018 : Debug: rlm_sql (sql-wifi): Released connection (19) Thu Dec 20 01:10:08 2018 : Info: Need 1 more connections to reach min connections (5) Thu Dec 20 01:10:08 2018 : Info: rlm_sql (sql-wifi): Opening additional connection (30), 1 of 6 pending slots used Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Starting connect to MySQL server Thu Dec 20 01:10:08 2018 : Debug: rlm_sql_mysql: Connected to database 'vpn_wifi' on 127.0.0.1 via TCP/IP, server version 5.7.19-17-log, protocol version 10 Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from sql-wifi (rlm_sql) Thu Dec 20 01:10:08 2018 : Debug: (138) [sql-wifi] = ok Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: calling pap (rlm_pap) Thu Dec 20 01:10:08 2018 : WARNING: (138) pap: Auth-Type already set. Not setting to PAP Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authorize]: returned from pap (rlm_pap) Thu Dec 20 01:10:08 2018 : Debug: (138) [pap] = noop Thu Dec 20 01:10:08 2018 : Debug: (138) } # authorize = updated Thu Dec 20 01:10:08 2018 : Debug: (138) Found Auth-Type = eap Thu Dec 20 01:10:08 2018 : Debug: (138) # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) authenticate { Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: calling eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Expiring EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Finished EAP session with state 0x0d5314a80d540ec8 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Previous EAP request found for state 0x0d5314a80d540ec8, released from the list Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Peer sent packet with method EAP MSCHAPv2 (26) Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Calling submodule eap_mschapv2 to process data Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/default Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: Auth-Type MS-CHAP { Thu Dec 20 01:10:08 2018 : Debug: (138) eap_mschapv2: modsingle[authenticate]: calling mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: NT-Password found but incorrect length, expected 16 bytes got 17 bytes. Authentication may fail Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password configured. Cannot create NT-Password Thu Dec 20 01:10:08 2018 : WARNING: (138) mschap: No Cleartext-Password configured. Cannot create LM-Password Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Creating challenge hash with username: testlogin Thu Dec 20 01:10:08 2018 : Debug: (138) mschap: Client is using MS-CHAPv2 Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: FAILED: No NT/LM-Password. Cannot perform authentication Thu Dec 20 01:10:08 2018 : ERROR: (138) mschap: MS-CHAP2-Response is incorrect Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: returned from mschap (rlm_mschap) Thu Dec 20 01:10:08 2018 : Debug: (138) [mschap] = reject Thu Dec 20 01:10:08 2018 : Debug: (138) } # Auth-Type MS-CHAP = reject Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Failure (code 4) ID 7 length 4 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Freeing handler Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = reject Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = reject Thu Dec 20 01:10:08 2018 : Debug: (138) Failed to authenticate the user Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Reject Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not found. Ignoring. Thu Dec 20 01:10:08 2018 : Auth: (138) Login incorrect (mschap: FAILED: No NT/LM-Password. Cannot perform authentication): [testlogin/<via Auth-Type = eap>] (from client WC-5508_ port 0 via TLS tunnel) Thu Dec 20 01:10:08 2018 : Debug: (138) } # server default Thu Dec 20 01:10:08 2018 : Debug: (138) Virtual server sending reply Thu Dec 20 01:10:08 2018 : Debug: (138) NT-Password = 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) MS-CHAP-Error = "\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected" Thu Dec 20 01:10:08 2018 : Debug: (138) EAP-Message = 0x04070004 Thu Dec 20 01:10:08 2018 : Debug: (138) Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply code 3 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password = 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error = "\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected" Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Got tunneled reply RADIUS code 3 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: NT-Password = 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: MS-CHAP-Error = "\007E=691 R=1 C=86e3f7442e804d519197bbbf0301334f V=3 M=Authentication rejected" Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: EAP-Message = 0x04070004 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: Tunneled authentication was rejected Thu Dec 20 01:10:08 2018 : Debug: (138) eap_peap: FAILURE Thu Dec 20 01:10:08 2018 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: Sending EAP Request (code 1) ID 8 length 59 Thu Dec 20 01:10:08 2018 : Debug: (138) eap: EAP session adding &reply:State = 0x9a0fd4fc9f07cd9b Thu Dec 20 01:10:08 2018 : Debug: (138) modsingle[authenticate]: returned from eap (rlm_eap) Thu Dec 20 01:10:08 2018 : Debug: (138) [eap] = handled Thu Dec 20 01:10:08 2018 : Debug: (138) } # authenticate = handled Thu Dec 20 01:10:08 2018 : Debug: (138) Using Post-Auth-Type Challenge Thu Dec 20 01:10:08 2018 : Debug: (138) Post-Auth-Type sub-section not found. Ignoring. Thu Dec 20 01:10:08 2018 : Debug: (138) session-state: Nothing to cache Could you please explain, what for you mean with "It looks like you've taken the input password, and then tried to use that as the NT hash."? Which way I have to use for my case? And what exactly meaning strings below: Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x696e616d6974414c545a694e3039393021 Thu Dec 20 01:10:08 2018 : Debug: (138) sql-wifi: NT-Password := 0x3161666532333532663366363365333136376163646230306136646366386235 That isn't my real hashes. Yes, I used the same hash as you provided via smbencrypt. I can provide with you my full configuration file as well is it could help. чт, 20 дек. 2018 г. в 11:40, Alan DeKok <aland@deployingradius.com>:
On Dec 20, 2018, at 2:47 AM, Anton Kiryushkin <swood@fotofor.biz> wrote:
Hello, Matthew.
Yes, I have the same fear about the hash. I made it in the two ways: - hash=$(printf '%s' "${pass}" | iconv -t utf16le | openssl md4
2>/dev/null
| awk '{print $NF}') - smbencrypt
Both ways are equal. Which method is right in my case?
smbencrypt it preferred. I use:
$ smbencrypt hello LM Hash NT Hash -------------------------------- -------------------------------- FDA95FBECA288D44AAD3B435B51404EE 066DDFD4EF0E9CD7C256FE77191EF43C
And the use the NT hash.
There is just no way that an input password ends up being *all* ASCII characters after hashing. It looks like you've taken the input password, and then tried to use that as the NT hash.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Best regards, Anton Kiryushkin