FreeRADIUS Version 2.1.12, for host i486-pc-linux-gnu, built on Dec 16 2012 at 22:03:33 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/replicate including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/redis including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/rediswho including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/soh including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing,123" nastype = "other" } client 10.202.28.31 { ipaddr = 10.202.28.31 require_message_authenticator = no secret = "test" nastype = "other" } client 10.202.28.35 { ipaddr = 10.202.28.35 require_message_authenticator = no secret = "test" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/home/bhavesh/freeradius-server-3.0.3/_install/etc/raddb/certs/server.key" certificate_file = "/home/bhavesh/freeradius-server-3.0.3/_install/etc/raddb/certs/server.pem" CA_file = "/home/bhavesh/freeradius-server-3.0.3/_install/etc/raddb/certs/ca.pem" private_key_password = "testuser" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 37573 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=0, length=168 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0267000e01616e6f6e796d6f7573 Message-Authenticator = 0x5b4121d03e0a5d677961970041d1e6fd # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 103 length 14 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 10.202.28.31 port 33345 EAP-Message = 0x01680016041059507c4feb0f71fd99152f56ce97536b Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d5e1c56dd220203641ea1c2f Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=1, length=178 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026800060315 State = 0xd589c140d5e1c56dd220203641ea1c2f Message-Authenticator = 0xf6ee39230664bd8652e439bff9df3fd3 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 104 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 10.202.28.31 port 33345 EAP-Message = 0x016900061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d4e0d46dd220203641ea1c2f Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=2, length=399 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026900e3150016030100d8010000d4030153e233d7b8dd1f9a92bca2392f1f982221ee61820c731d6ecc5959822cb42e29000066c014c00ac022c0210039003800880087c00fc00500350084c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032009a009900450044c00ec004002f00960041c011c007c00cc002000500040015001200090014001100080006000300ff01000045000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011000f000101 State = 0xd589c140d4e0d46dd220203641ea1c2f Message-Authenticator = 0x6c83612d5fcd16d5616a911def849b86 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 105 length 227 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 00d8], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 003e], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 08d0], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 2 to 10.202.28.31 port 33345 EAP-Message = 0x016a040015c000000a71160301003e0200003a030153e28132d9d2d93d10d01602b21d96d3cbff9a23358b660b2a319aef48dbe91000c014000012ff01000100000b000403000102000f00010116030108d00b0008cc0008c90003de308203da308202c2a003020102020101300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043 EAP-Message = 0x6572746966696361746520417574686f72697479301e170d3134303631383136343730365a170d3134303831373136343730365a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ca68715a75db5961d4b1d2c930f958d98ad4943dd579f50fa5278ce064e58f256c360f88953756cc5575 EAP-Message = 0x36fbb512c3c4b09643704d36dfa4ff1f951dae6efc30cfc3bcbed2046689c8f92d161a6cc320842c6a88ff4bc98081bb98713bf961c77096192df0a613145abf61996a7c9c9dae94bc0402766329a3e078c52ec17b12a5717c835364ff36f188d4cbc8c920dc388d97acd255a72f0b73932261bdec9dd00538b899dccd79e51b3a4067e930c8f72b82dbb6ac614e96872d74376efea8dc6089dc3a5f7bd1c8016dbd7cb05b3c5942516643b9d5c763826ac7ac99f04b93e867f9613c23005c46f51c27f4e858f8b22618cf7e0ae1d7308751b3b332110203010001a34f304d30130603551d25040c300a06082b0601050507030130360603551d1f042f EAP-Message = 0x302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010505000382010100754db55ff8e6d06350faa99ab6946e34d398e629ca733ab2e53df4feb051c31a43b78a3ddc394f1e7a2e41d0fe35d69597eda00d9d82c96000650aaca422e3f97fdbe18dbced43ca8b669e0faf40ce820384acfdebd83de63bb730e4c68a72b9604a73817b1a27d5f46a7dcc5dc81e5b351cde0176414b244733a3f686b9e05fd36643c10fee4a2bd8accb8f716608c8db6ef7b214d47010afb2dd05eb1dfa9905ae73cb0e7f924760c691f6bfa63185a5f716956f2db0e22dd1 EAP-Message = 0xcd12b0ad7f2b93a39fe91b7c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d7e3d46dd220203641ea1c2f Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=3, length=178 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026a00061500 State = 0xd589c140d7e3d46dd220203641ea1c2f Message-Authenticator = 0xe8916caf6737003270244cda7b9d1b7e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 106 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 10.202.28.31 port 33345 EAP-Message = 0x016b040015c000000a7137ee8a91a1973d7cf9db502267d427e62085d938e942688f6ac9a6a86798462ae2f65e9d42628a062b20a5a97a6c74197ef80f57a842c55448ea0004e5308204e1308203c9a003020102020900918b4d607ae913fc300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3134303631383136343730365a170d3134303831373136343730365a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a02820101009f4e7176a14dab39651c511995bc46350acbd5bf92265ee294fe179036db49 EAP-Message = 0xe3de73f45781f8a3b62694f7381fe1a038e9e6eb355c71886ccdf98cdee5b8f28b6348f9b15732123a35722844a507420165a5abef6c7531b8d935afd7535a31e1996ac89d9c137ddbc516dc6e11e2e1346f48ab5ba9b99ff9aa43a702a224230d28c221dc744748a0024b34a6822e36f0e9ecb30e5c807260ef68beccbccfde9791ff8e9bc8c8f65cb04bb3b6797c4e30478828340f04f2f5e11cf523999348298bc610805cf933a0943754c6626025c3e94579aa5c1f00831ffea6b69026b7e4a81a2fbe8e676ad747d4c488e3474d39583deed5b78313791dada983d7aac8e30203010001a382013430820130301d0603551d0e041604147a8f5d1c EAP-Message = 0xf162f75eb37d27c07430aae4492cd2c43081c80603551d230481c03081bd80147a8f5d1cf162f75eb37d27c07430aae4492cd2c4a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900918b4d607ae913fc300c0603551d13040530030101ff30360603551d1f042f302d302ba029a027862568 EAP-Message = 0x7474703a2f2f7777772e6578 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d6e2d46dd220203641ea1c2f Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=4, length=178 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026b00061500 State = 0xd589c140d6e2d46dd220203641ea1c2f Message-Authenticator = 0x92468bc600d1edd3cb2b160cbf5b145d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 107 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 10.202.28.31 port 33345 EAP-Message = 0x016c028f158000000a71616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d010105050003820101001addb7afbf0d741b9131fceeca688cc5c71c58b8e8b9f666f961f4856475c2f1bb407694f6d2c31ccedcee001d81b670dddedff901feed02720025db41ef3d85d9d39f9cd8b98ac9ea71f080925a7eea2c0e6896715fabd8bb8d7f48aa2b4ebc012ddc4277cdf8fbde0a40792e18d59a1c84addb4c7f8a896884667b0094f9dde889649d022fbfeba48e4932ece8d559220481bb05deeb226dc12161bb5f19bfdacc258540adba7fd829fc06016ca14c7c64104eed7bc5bf89d1a2044d00acae0b2191be4327e2 EAP-Message = 0x71a8e233ace1791a07306690a6bba092f29e13239dd522442375555cfacbe0a7cecfe3876475c2f49b44acfd2da8cb3e7c0592f4794905e4ee160301014b0c0001470300174104d346a6446d0ce128598605107ab5f02a157bdb1cce96f509e69f67c51c617f2d555686f40d1ef8443a66534ab8305dd3321ad310683471a53a3f3e5761730de2010052c29e2a295bb1b821cc99459c15297714215721f8518d6357f170400a1130efec753600d1af097bd51551b8ab85f71a340866c14699cc45ac7e561e94075e20f1bc151b3dfad37243bd2e74f2aee6e8282fa1d930bf0394e2452cad0bb484ef3cd4f9911421ed50ec70c668d92cbffffcc73cb2 EAP-Message = 0xa3e4a5c14167c43f083947d1f07b7025d5e13d74a076046bbbabaadaf324cdabe0ea2c9637c86782bc3ab6f63ae20b9946a80ef50080bd0d0325c634c3e37d52274aac54157f27824ca720b3cae1d8b012a361202b5d38a705b42a8da21972b7749b49d5d09239878ac10378d9db444f876bea81787f79b0b358b27bbeb3ea9085ef73766b8ce62b9f4e63a616030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d1e5d46dd220203641ea1c2f Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=5, length=312 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026c008c15001603010046100000424104563bb1e50d8684483b8734b36d7feacea03c96891708a9c2541d0a93a84fc4a21bcffbc35186f99f01b6546e8f265ad34db5fb25f866a90772bf2e748198c92f1403010001011603010030748770f481dbec8c29f902f88a714b7ac9d9559a570368bd74e394c6b990dc3a68cce1095999527ef423de2ee78cb82a State = 0xd589c140d1e5d46dd220203641ea1c2f Message-Authenticator = 0xbc52ce52373381d6a7fd5a7ddbcb7c7a # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 108 length 140 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 5 to 10.202.28.31 port 33345 EAP-Message = 0x016d004515800000003b1403010001011603010030ce75f6a1c9a8c81b17e7522cbeb6433f9acc3547dc014aedd1f433710f0ac1ba0be11982751e3bf5f55da59fa3087035 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d0e4d46dd220203641ea1c2f Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=6, length=364 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026d00c015001703010020da68b957464d98fbe2d06acfd36c8a50c5436ea87a9af2f36064f2b0ab856bf71703010090c87bd4ac9629855c769798783518ff9ed06277e8a60953a8be21d0f861cf1f34fb570b3da999b0ac0b951a229e1c4d5b069f969043453b021f7c28b3f27deab2e64621a617d0850d1a92a64fc3e6198a339c90988e14a965fdcb1faf55a7ebf8977fc192cae9ced93cf8fd78e1a048971685d02a1551f7b7ce3323ff045bfa524596b93567538f59bc2b9867f6c84f8b State = 0xd589c140d0e4d46dd220203641ea1c2f Message-Authenticator = 0x5e58e392173e18000f0f38be3967c3f1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 109 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "testuser" MS-CHAP-Challenge = 0xaf81bc4ee124b6ec62b38d69e3ae5288 MS-CHAP2-Response = 0x0700000000000000007100000000000000000000000000000000ddb4fd0283d58b0a5841eacd29d590e590cdd9a59171dfd1 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "testuser" MS-CHAP-Challenge = 0xaf81bc4ee124b6ec62b38d69e3ae5288 MS-CHAP2-Response = 0x0700000000000000007100000000000000000000000000000000ddb4fd0283d58b0a5841eacd29d590e590cdd9a59171dfd1 FreeRADIUS-Proxied-To = 127.0.0.1 NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" server inner-tunnel { # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry testuser at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: testuser [mschap] Told to do MS-CHAPv2 for testuser with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group post-auth {...} expand: %{request:User-Name} -> testuser ++[outer.reply] returns noop } # server inner-tunnel [ttls] Got tunneled reply code 2 MS-CHAP2-Success = 0x07533d41434242463838333743324146324541323934373038433631313845324433303745354444364341 MS-MPPE-Recv-Key = 0x2ce496ba9ed3325f570730df562221d6 MS-MPPE-Send-Key = 0xba8e15ec8a851880c3da9231bd89607a MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 6 to 10.202.28.31 port 33345 User-Name = "testuser" EAP-Message = 0x016e005f15800000005517030100506d233ce5f277e8790ca9d99b7c6154d04fab50fde0bf996936a266c513eee868d0a91e83d2047f566844b1e3689704e80743ab4b722d91c087f375eb3f771ed97840aaa0d96cc57e3284b043fb1cf720 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd589c140d3e7d46dd220203641ea1c2f Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.202.28.31 port 33345, id=7, length=178 User-Name = "anonymous" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Called-Station-Id = "00-0E-8E-38-3E-10:WiFi_SSO-Bhavesh" Calling-Station-Id = "64-70-02-08-95-D9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x026e00061500 State = 0xd589c140d3e7d46dd220203641ea1c2f Message-Authenticator = 0xee2c1fb5ca38abe58da40276e36568d9 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 110 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [ttls] Using saved attributes from the original Access-Accept [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 10.202.28.31 port 33345 MS-MPPE-Recv-Key = 0x29f123b3d8518cb0e0f8baf763ca60b0544d963e68dd4b6b56229e989ab6d76e MS-MPPE-Send-Key = 0xf775e50a813dee91f70134dcce0f43b45fafac2093597705018ef26cb09dccd6 EAP-Message = 0x036e0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Finished request 7. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +59 Cleaning up request 1 ID 1 with timestamp +59 Cleaning up request 2 ID 2 with timestamp +59 Cleaning up request 3 ID 3 with timestamp +59 Cleaning up request 4 ID 4 with timestamp +59 Cleaning up request 5 ID 5 with timestamp +59 Cleaning up request 6 ID 6 with timestamp +59 Cleaning up request 7 ID 7 with timestamp +59 Ready to process requests.