Re: help with freeradius on u24 for eduroam with ntlm auth

23 Sep 2025


      Below are full debug logs.
Trying to use freeradius to authenticate to AD, so that I can use it to
support eduroam.
using eapol to test, which worked correctly with files.
...
FreeRADIUS Version 3.2.5
Copyright (C) 1999-2023 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/3.0/dictionary
including configuration file /etc/freeradius/3.0/radiusd.conf
including configuration file /etc/freeradius/3.0/proxy.conf
including configuration file /etc/freeradius/3.0/clients.conf
including files in directory /etc/freeradius/3.0/mods-enabled/
including configuration file /etc/freeradius/3.0/mods-enabled/passwd
including configuration file /etc/freeradius/3.0/mods-enabled/detail.log
including configuration file /etc/freeradius/3.0/mods-enabled/expiration
including configuration file /etc/freeradius/3.0/mods-enabled/chap
including configuration file /etc/freeradius/3.0/mods-enabled/preprocess
including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter
including configuration file /etc/freeradius/3.0/mods-enabled/eap
including configuration file /etc/freeradius/3.0/mods-enabled/exec
including configuration file /etc/freeradius/3.0/mods-enabled/linelog
including configuration file /etc/freeradius/3.0/mods-enabled/replicate
including configuration file
/etc/freeradius/3.0/mods-enabled/dynamic_clients
including configuration file /etc/freeradius/3.0/mods-enabled/pap
including configuration file /etc/freeradius/3.0/mods-enabled/detail
including configuration file /etc/freeradius/3.0/mods-enabled/logintime
including configuration file /etc/freeradius/3.0/mods-enabled/echo
including configuration file /etc/freeradius/3.0/mods-enabled/unix
including configuration file /etc/freeradius/3.0/mods-enabled/mschap
including configuration file /etc/freeradius/3.0/mods-enabled/always
including configuration file /etc/freeradius/3.0/mods-enabled/radutmp
including configuration file /etc/freeradius/3.0/mods-enabled/expr
including configuration file /etc/freeradius/3.0/mods-enabled/files
including configuration file /etc/freeradius/3.0/mods-enabled/unpack
including configuration file /etc/freeradius/3.0/mods-enabled/digest
including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp
including configuration file /etc/freeradius/3.0/mods-enabled/inner-eap
including configuration file /etc/freeradius/3.0/mods-enabled/utf8
including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth
including configuration file /etc/freeradius/3.0/mods-enabled/soh
including configuration file /etc/freeradius/3.0/mods-enabled/realm
including files in directory /etc/freeradius/3.0/policy.d/
including configuration file /etc/freeradius/3.0/policy.d/accounting
including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
including configuration file /etc/freeradius/3.0/policy.d/eap
including configuration file /etc/freeradius/3.0/policy.d/dhcp
including configuration file /etc/freeradius/3.0/policy.d/debug
including configuration file
/etc/freeradius/3.0/policy.d/moonshot-targeted-ids
including configuration file /etc/freeradius/3.0/policy.d/rfc7542
including configuration file /etc/freeradius/3.0/policy.d/filter
including configuration file /etc/freeradius/3.0/policy.d/control
including configuration file /etc/freeradius/3.0/policy.d/canonicalization
including configuration file /etc/freeradius/3.0/policy.d/operator-name
including configuration file /etc/freeradius/3.0/policy.d/cui
including files in directory /etc/freeradius/3.0/sites-enabled/
including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel
including configuration file /etc/freeradius/3.0/sites-enabled/default
main {
 security {
  user = "freerad"
  group = "freerad"
  allow_core_dumps = no
 }
name = "freeradius"
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/freeradius"
run_dir = "/var/run/freeradius"
}
main {
name = "freeradius"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/freeradius"
run_dir = "/var/run/freeradius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/freeradius/radacct"
hostname_lookups = no
max_request_time = 30
proxy_dedup_window = 1
cleanup_delay = 5
max_requests = 16384
max_fds = 512
postauth_client_lost = no
pidfile = "/var/run/freeradius/freeradius.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
 log {
  stripped_names = no
  auth = no
  auth_badpass = no
  auth_goodpass = no
  colourise = yes
  msg_denied = "You are already logged in - access denied"
 }
 resources {
 }
 security {
  max_attributes = 200
  reject_delay = 1.000000
  status_server = yes
  require_message_authenticator = "auto"
  limit_proxy_state = "auto"
 }
}
radiusd: #### Loading Realms and Home Servers ####
radiusd: #### Loading Clients ####
 client localhost {
  ipaddr = 127.0.0.1
  secret = <<< secret >>>
  nas_type = "other"
  proto = "*"
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
 client localhost_ipv6 {
  ipv6addr = ::1
  secret = <<< secret >>>
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
Debugger not attached
systemd watchdog is disabled
 # Creating Auth-Type = inner-eap
 # Creating Auth-Type = mschap
 # Creating Auth-Type = pap
/etc/freeradius/3.0/sites-enabled/inner-tunnel[69]: Duplicate Auth-Type
'pap'
 # Creating Auth-Type = ntlm_auth
 # Creating Auth-Type = eap
radiusd: #### Instantiating modules ####
 modules {
  # Loaded module rlm_passwd
  # Loading module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
  passwd etc_passwd {
  filename = "/etc/passwd"
  format = "*User-Name:Crypt-Password:"
  delimiter = ":"
  ignore_nislike = no
  ignore_empty = yes
  allow_multiple_keys = no
  hash_size = 100
  }
  # Loaded module rlm_detail
  # Loading module "auth_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail auth_log {
  filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  dates_as_integer = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail reply_log {
  filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  dates_as_integer = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail pre_proxy_log {
  filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  dates_as_integer = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  detail post_proxy_log {
  filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  dates_as_integer = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loaded module rlm_expiration
  # Loading module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
  # Loaded module rlm_chap
  # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap
  # Loaded module rlm_preprocess
  # Loading module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
  preprocess {
  huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups"
  hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"
  with_ascend_hack = no
  ascend_channels_per_line = 23
  with_ntdomain_hack = no
  with_specialix_jetstream_hack = no
  with_cisco_vsa_hack = no
  with_alvarion_vsa_hack = no
  }
  # Loaded module rlm_attr_filter
  # Loading module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy"
  key = "%{Realm}"
  relaxed = no
  }
  # Loading module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy"
  key = "%{Realm}"
  relaxed = no
  }
  # Loading module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
  filename =
"/etc/freeradius/3.0/mods-config/attr_filter/accounting_response"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.coa" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.coa {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/coa"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loaded module rlm_eap
  # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  eap {
  default_eap_type = "peap"
  timer_expire = 60
  max_eap_type = 52
  ignore_unknown_eap_types = no
  cisco_accounting_username_bug = no
  max_sessions = 16384
  dedup_key = ""
  }
  # Loaded module rlm_exec
  # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec
  exec {
  wait = no
  input_pairs = "request"
  shell_escape = yes
  timeout = 10
  }
  # Loaded module rlm_linelog
  # Loading module "linelog_recv_request" from file
/etc/freeradius/3.0/mods-enabled/linelog
  linelog linelog_recv_request {
  filename = "syslog"
  escape_filenames = no
  syslog_facility = "local0"
  syslog_severity = "debug"
  permissions = 384
  format = "action = Recv-Request, %{pairs:request:}"
  }
  # Loading module "linelog_send_accept" from file
/etc/freeradius/3.0/mods-enabled/linelog
  linelog linelog_send_accept {
  filename = "syslog"
  escape_filenames = no
  syslog_facility = "local0"
  syslog_severity = "debug"
  permissions = 384
  format = "action = Send-Accept, %{pairs:request:}"
  }
  # Loading module "linelog_send_reject" from file
/etc/freeradius/3.0/mods-enabled/linelog
  linelog linelog_send_reject {
  filename = "syslog"
  escape_filenames = no
  syslog_facility = "local0"
  syslog_severity = "debug"
  permissions = 384
  format = "action = Send-Reject, %{pairs:request:}"
  }
  # Loading module "linelog_send_proxy_request" from file
/etc/freeradius/3.0/mods-enabled/linelog
  linelog linelog_send_proxy_request {
  filename = "syslog"
  escape_filenames = no
  syslog_facility = "local0"
  syslog_severity = "debug"
  permissions = 384
  format = "action = Send-Proxy-Request, %{pairs:proxy-request:}"
  }
  # Loading module "linelog_recv_proxy_response" from file
/etc/freeradius/3.0/mods-enabled/linelog
  linelog linelog_recv_proxy_response {
  filename = "syslog"
  escape_filenames = no
  syslog_facility = "local0"
  syslog_severity = "debug"
  permissions = 384
  reference = "messages.%{proxy-reply:Response-Packet-Type}"
  }
  # Loaded module rlm_replicate
  # Loading module "replicate" from file
/etc/freeradius/3.0/mods-enabled/replicate
  # Loaded module rlm_dynamic_clients
  # Loading module "dynamic_clients" from file
/etc/freeradius/3.0/mods-enabled/dynamic_clients
  # Loaded module rlm_pap
  # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  pap {
  normalise = yes
  }
  # Loading module "detail" from file
/etc/freeradius/3.0/mods-enabled/detail
  detail {
  filename =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  dates_as_integer = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loaded module rlm_logintime
  # Loading module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
  logintime {
  minimum_timeout = 60
  }
  # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo
  exec echo {
  wait = yes
  program = "/bin/echo %{User-Name}"
  input_pairs = "request"
  output_pairs = "reply"
  shell_escape = yes
  }
  # Loaded module rlm_unix
  # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix
  unix {
  radwtmp = "/var/log/freeradius/radwtmp"
  }
Creating attribute Unix-Group
  # Loaded module rlm_mschap
  # Loading module "mschap" from file
/etc/freeradius/3.0/mods-enabled/mschap
  mschap {
  use_mppe = yes
  require_encryption = no
  require_strong = no
  with_ntdomain_hack = yes
   passchange {
   }
  allow_retry = yes
  winbind_retry_with_normalised_username = no
  }
  # Loaded module rlm_always
  # Loading module "reject" from file
/etc/freeradius/3.0/mods-enabled/always
  always reject {
  rcode = "reject"
  simulcount = 0
  mpp = no
  }
  # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always
  always fail {
  rcode = "fail"
  simulcount = 0
  mpp = no
  }
  # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  always ok {
  rcode = "ok"
  simulcount = 0
  mpp = no
  }
  # Loading module "handled" from file
/etc/freeradius/3.0/mods-enabled/always
  always handled {
  rcode = "handled"
  simulcount = 0
  mpp = no
  }
  # Loading module "invalid" from file
/etc/freeradius/3.0/mods-enabled/always
  always invalid {
  rcode = "invalid"
  simulcount = 0
  mpp = no
  }
  # Loading module "userlock" from file
/etc/freeradius/3.0/mods-enabled/always
  always userlock {
  rcode = "userlock"
  simulcount = 0
  mpp = no
  }
  # Loading module "notfound" from file
/etc/freeradius/3.0/mods-enabled/always
  always notfound {
  rcode = "notfound"
  simulcount = 0
  mpp = no
  }
  # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always
  always noop {
  rcode = "noop"
  simulcount = 0
  mpp = no
  }
  # Loading module "updated" from file
/etc/freeradius/3.0/mods-enabled/always
  always updated {
  rcode = "updated"
  simulcount = 0
  mpp = no
  }
  # Loaded module rlm_radutmp
  # Loading module "radutmp" from file
/etc/freeradius/3.0/mods-enabled/radutmp
  radutmp {
  filename = "/var/log/freeradius/radutmp"
  username = "%{User-Name}"
  case_sensitive = yes
  check_with_nas = yes
  permissions = 384
  caller_id = yes
  }
  # Loaded module rlm_expr
  # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr
  expr {
  safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Loaded module rlm_files
  # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files
  files {
  filename = "/etc/freeradius/3.0/mods-config/files/authorize"
  acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting"
  preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy"
  }
  # Loaded module rlm_unpack
  # Loading module "unpack" from file
/etc/freeradius/3.0/mods-enabled/unpack
  # Loaded module rlm_digest
  # Loading module "digest" from file
/etc/freeradius/3.0/mods-enabled/digest
  # Loading module "sradutmp" from file
/etc/freeradius/3.0/mods-enabled/sradutmp
  radutmp sradutmp {
  filename = "/var/log/freeradius/sradutmp"
  username = "%{User-Name}"
  case_sensitive = yes
  check_with_nas = yes
  permissions = 420
  caller_id = no
  }
  # Loading module "inner-eap" from file
/etc/freeradius/3.0/mods-enabled/inner-eap
  eap inner-eap {
  default_eap_type = "mschapv2"
  timer_expire = 60
  max_eap_type = 52
  ignore_unknown_eap_types = no
  cisco_accounting_username_bug = no
  max_sessions = 16384
  dedup_key = ""
  }
  # Loaded module rlm_utf8
  # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8
  # Loading module "ntlm_auth" from file
/etc/freeradius/3.0/mods-enabled/ntlm_auth
  exec ntlm_auth {
  wait = yes
  program = "/usr/bin/ntlm_auth --request-nt-key --allow-mschapv2
--domain=ccdom --username=%{mschap:User-Name} --password=%{User-Password}"
  shell_escape = yes
  }
  # Loaded module rlm_soh
  # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh
  soh {
  dhcp = yes
  }
  # Loaded module rlm_realm
  # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
  realm IPASS {
  format = "prefix"
  delimiter = "/"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "suffix" from file
/etc/freeradius/3.0/mods-enabled/realm
  realm suffix {
  format = "suffix"
  delimiter = "@"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "bangpath" from file
/etc/freeradius/3.0/mods-enabled/realm
  realm bangpath {
  format = "prefix"
  delimiter = "!"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
  realm realmpercent {
  format = "suffix"
  delimiter = "%"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "ntdomain" from file
/etc/freeradius/3.0/mods-enabled/realm
  realm ntdomain {
  format = "prefix"
  delimiter = "\"
  ignore_default = no
  ignore_null = no
  }
  instantiate {
  }
  # Instantiating module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "auth_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
  # Instantiating module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
  # Instantiating module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints
  # Instantiating module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/post-proxy
  # Instantiating module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy
  # Instantiating module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/access_reject
  # Instantiating module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file
/etc/freeradius/3.0/mods-config/attr_filter/accounting_response
  # Instantiating module "attr_filter.coa" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/coa
  # Instantiating module "eap" from file
/etc/freeradius/3.0/mods-enabled/eap
   # Linked to sub-module rlm_eap_tls
   tls {
    tls = "tls-common"
   }
   tls-config tls-common {
    verify_depth = 0
    pem_file_type = yes
    private_key_file = "/etc/freeradius/3.0/certs/server.key"
    certificate_file = "/etc/freeradius/3.0/certs/server.pem"
    ca_file = "/etc/freeradius/3.0/certs/ca.pem"
    private_key_password = <<< secret >>>
    fragment_size = 1024
    include_length = yes
    auto_chain = yes
    check_crl = no
    check_all_crl = no
    ca_path_reload_interval = 0
    reject_unknown_intermediate_ca = no
    ecdh_curve = "prime256v1"
    tls_min_version = "1.2"
    cache {
    enable = no
    lifetime = 24
    max_entries = 255
    }
    verify {
    skip_if_ocsp_ok = no
    }
    ocsp {
    enable = yes
    override_cert_url = no
    use_nonce = yes
    timeout = 0
    softfail = no
    }
   }
   # Linked to sub-module rlm_eap_ttls
   ttls {
    tls = "tls-common"
    default_eap_type = "mschapv2"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    virtual_server = "eduroam-inner"
    include_length = yes
    require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_peap
   peap {
    tls = "tls-common"
    default_eap_type = "mschapv2"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    proxy_tunneled_request_as_eap = yes
    virtual_server = "eduroam-inner"
    soh = no
    require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
    with_ntdomain_hack = no
    send_error = no
   }
  # Instantiating module "linelog_recv_request" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "linelog_send_accept" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "linelog_send_reject" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "linelog_send_proxy_request" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "linelog_recv_proxy_response" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "pap" from file
/etc/freeradius/3.0/mods-enabled/pap
  # Instantiating module "detail" from file
/etc/freeradius/3.0/mods-enabled/detail
  # Instantiating module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
  # Instantiating module "mschap" from file
/etc/freeradius/3.0/mods-enabled/mschap
rlm_mschap (mschap): using internal authentication
  # Instantiating module "reject" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "fail" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "ok" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "handled" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "invalid" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "userlock" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "notfound" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "noop" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "updated" from file
/etc/freeradius/3.0/mods-enabled/always
  # Instantiating module "files" from file
/etc/freeradius/3.0/mods-enabled/files
reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting
reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy
  # Instantiating module "inner-eap" from file
/etc/freeradius/3.0/mods-enabled/inner-eap
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
    with_ntdomain_hack = no
    send_error = yes
   }
  # Instantiating module "IPASS" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "suffix" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "bangpath" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "ntdomain" from file
/etc/freeradius/3.0/mods-enabled/realm
 } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/3.0/radiusd.conf
} # server
server eduroam-inner { # from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
 # Loading authenticate {...}
Compiling Auth-Type pap for attr Auth-Type
 # Loading authorize {...}
} # server eduroam-inner
server eduroam { # from file /etc/freeradius/3.0/sites-enabled/default
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading pre-proxy {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
Compiling Post-Auth-Type REJECT for attr Post-Auth-Type
} # server eduroam
radiusd: #### Opening IP addresses and Ports ####
listen {
  type = "auth"
  ipaddr = *
  port = 18120
}
listen {
  type = "auth"
  ipaddr = *
  port = 1812
}
Listening on auth address * port 18120 bound to server eduroam-inner
Listening on auth address * port 1812 bound to server eduroam
Ready to process requests
(0) Received Access-Request Id 0 from 127.0.0.1:44501 to 127.0.0.1:1812
length 154
(0)   Message-Authenticator = 0xe2c9259cd8c916b2573100a887c43b6a
(0)   User-Name = "anonymous@wi.mit.edu"
(0)   NAS-IP-Address = 127.0.0.1
(0)   Calling-Station-Id = "02-00-00-00-00-01"
(0)   Framed-MTU = 1400
(0)   NAS-Port-Type = Wireless-802.11
(0)   Service-Type = Framed-User
(0)   Connect-Info = "CONNECT 11Mbps 802.11b"
(0)   EAP-Message = 0x02de001901616e6f6e796d6f75734077692e6d69742e656475
(0) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(0)   authorize {
(0) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(0) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0xe2c9259cd8c916b2573100a887c43b6a, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message = 0x02de001901616e6f6e796d6f75734077692e6d69742e656475
(0)     [linelog_recv_request] = ok
(0)     policy split_username_nai {
(0)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(0)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(0)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(0)         update request {
(0)           EXPAND %{1}
(0)              --> anonymous
(0)           &Stripped-User-Name := anonymous
(0)         } # update request = noop
(0)         if ("%{3}" != '') {
(0)         EXPAND %{3}
(0)            --> wi.mit.edu
(0)         if ("%{3}" != '')  -> TRUE
(0)         if ("%{3}" != '')  {
(0)           update request {
(0)             EXPAND %{3}
(0)                --> wi.mit.edu
(0)             &Stripped-User-Domain = wi.mit.edu
(0)           } # update request = noop
(0)         } # if ("%{3}" != '')  = noop
(0)         [updated] = updated
(0)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(0)       ... skipping else: Preceding "if" was taken
(0)     } # policy split_username_nai = updated
(0)     if (noop || !&Stripped-User-Domain) {
(0)     if (noop || !&Stripped-User-Domain)  -> FALSE
(0)     if (&Stripped-User-Domain != "wi.mit.edu") {
(0)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(0) eap: Peer sent EAP Response (code 2) ID 222 length 25
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_peap to process data
(0) eap_peap: (TLS) PEAP -Initiating new session
(0) eap: Sending EAP Request (code 1) ID 223 length 6
(0) eap: EAP session adding &reply:State = 0xc7b8934ac7678a03
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found.  Ignoring.
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0) session-state: Saving cached attributes
(0)   Framed-MTU = 994
(0) Sent Access-Challenge Id 0 from 127.0.0.1:1812 to 127.0.0.1:44501
length 64
(0)   EAP-Message = 0x01df00061920
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0xc7b8934ac7678a03967e916c9021e13b
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 1 from 127.0.0.1:44501 to 127.0.0.1:1812
length 341
(1)   Message-Authenticator = 0x018daab05310d8ad8b79254cb1f4d01f
(1)   User-Name = "anonymous@wi.mit.edu"
(1)   NAS-IP-Address = 127.0.0.1
(1)   Calling-Station-Id = "02-00-00-00-00-01"
(1)   Framed-MTU = 1400
(1)   NAS-Port-Type = Wireless-802.11
(1)   Service-Type = Framed-User
(1)   Connect-Info = "CONNECT 11Mbps 802.11b"
(1)   EAP-Message =
0x02df00c21980000000b816030100b3010000af03031d4f66accb06afef43c3538637f66a0bd1fc261295e9fa44b8b28c216b5b2c79000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff0100004e000b000403000102000a000c000a001d0017001e001900180016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602
(1)   State = 0xc7b8934ac7678a03967e916c9021e13b
(1) Restoring &session-state
(1)   &session-state:Framed-MTU = 994
(1) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(1)   authorize {
(1) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(1) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0x018daab05310d8ad8b79254cb1f4d01f, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02df00c21980000000b816030100b3010000af03031d4f66accb06afef43c3538637f66a0bd1fc261295e9fa44b8b28c216b5b2c79000038c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff0100004e000b000403000102000a000c000a001d0017001e001900180016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602,
State = 0xc7b8934ac7678a03967e916c9021e13b
(1)     [linelog_recv_request] = ok
(1)     policy split_username_nai {
(1)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(1)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(1)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(1)         update request {
(1)           EXPAND %{1}
(1)              --> anonymous
(1)           &Stripped-User-Name := anonymous
(1)         } # update request = noop
(1)         if ("%{3}" != '') {
(1)         EXPAND %{3}
(1)            --> wi.mit.edu
(1)         if ("%{3}" != '')  -> TRUE
(1)         if ("%{3}" != '')  {
(1)           update request {
(1)             EXPAND %{3}
(1)                --> wi.mit.edu
(1)             &Stripped-User-Domain = wi.mit.edu
(1)           } # update request = noop
(1)         } # if ("%{3}" != '')  = noop
(1)         [updated] = updated
(1)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(1)       ... skipping else: Preceding "if" was taken
(1)     } # policy split_username_nai = updated
(1)     if (noop || !&Stripped-User-Domain) {
(1)     if (noop || !&Stripped-User-Domain)  -> FALSE
(1)     if (&Stripped-User-Domain != "wi.mit.edu") {
(1)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(1) eap: Peer sent EAP Response (code 2) ID 223 length 194
(1) eap: Continuing tunnel setup
(1)     [eap] = ok
(1)   } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1)   authenticate {
(1) eap: Removing EAP session with state 0xc7b8934ac7678a03
(1) eap: Previous EAP request found for state 0xc7b8934ac7678a03, released
from the list
(1) eap: Peer sent packet with method EAP PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: (TLS) EAP Peer says that the final record size will be 184
bytes
(1) eap_peap: (TLS) EAP Got all data (184 bytes)
(1) eap_peap: (TLS) PEAP - Handshake state - before SSL initialization
(1) eap_peap: (TLS) PEAP - Handshake state - Server before SSL
initialization
(1) eap_peap: (TLS) PEAP - Handshake state - Server before SSL
initialization
(1) eap_peap: (TLS) PEAP - recv TLS 1.3 Handshake, ClientHello
(1) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read client
hello
(1) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerHello
(1) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server
hello
(1) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, Certificate
(1) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write
certificate
(1) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerKeyExchange
(1) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write key
exchange
(1) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, ServerHelloDone
(1) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server
done
(1) eap_peap: (TLS) PEAP - Server : Need to read more data: SSLv3/TLS
write server done
(1) eap_peap: (TLS) PEAP - In Handshake Phase
(1) eap: Sending EAP Request (code 1) ID 224 length 1004
(1) eap: EAP session adding &reply:State = 0xc7b8934ac6588a03
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found.  Ignoring.
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1) session-state: Saving cached attributes
(1)   Framed-MTU = 994
(1)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(1)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(1)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(1)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(1)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(1) Sent Access-Challenge Id 1 from 127.0.0.1:1812 to 127.0.0.1:44501
length 1068
(1)   EAP-Message =
0x01e003ec19c000000ef0160303003d0200003903038a12ede44a1da6cffb20dcee147b38f3ac638b367554443da32b9358373a50ae00c030000011ff01000100000b000403000102001700001603030d4e0b000d4a000d470006f3308206ef30820557a0030201020210355bbce204f47497fc69d9f6ca522a21300d06092a864886f70d01010b05003044310b300906035504061302555331123010060355040a1309496e7465726e6574323121301f06035504031318496e436f6d6d6f6e20525341205365727665722043412032301e170d3235303931373030303030305a170d3236313031383233353935395a3077310b3009060355040613025553311630140603550408130d4d617373616368757365747473312e302c060355040a13254d61737361636875736574747320496e73746974757465206f6620546563686e6f6c6f67793120301e06035504031317656475726f616d2d746573742e77692e6d69742e65647530820122300d06092a864886f70d01
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0xc7b8934ac6588a03967e916c9021e13b
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 2 from 127.0.0.1:44501 to 127.0.0.1:1812
length 153
(2)   Message-Authenticator = 0xe8c224374b4fe4a201cb209cbbb8b349
(2)   User-Name = "anonymous@wi.mit.edu"
(2)   NAS-IP-Address = 127.0.0.1
(2)   Calling-Station-Id = "02-00-00-00-00-01"
(2)   Framed-MTU = 1400
(2)   NAS-Port-Type = Wireless-802.11
(2)   Service-Type = Framed-User
(2)   Connect-Info = "CONNECT 11Mbps 802.11b"
(2)   EAP-Message = 0x02e000061900
(2)   State = 0xc7b8934ac6588a03967e916c9021e13b
(2) Restoring &session-state
(2)   &session-state:Framed-MTU = 994
(2)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(2)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(2)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(2)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(2)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(2) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(2)   authorize {
(2) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(2) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0xe8c224374b4fe4a201cb209cbbb8b349, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message = 0x02e000061900, State = 0xc7b8934ac6588a03967e916c9021e13b
(2)     [linelog_recv_request] = ok
(2)     policy split_username_nai {
(2)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(2)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(2)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(2)         update request {
(2)           EXPAND %{1}
(2)              --> anonymous
(2)           &Stripped-User-Name := anonymous
(2)         } # update request = noop
(2)         if ("%{3}" != '') {
(2)         EXPAND %{3}
(2)            --> wi.mit.edu
(2)         if ("%{3}" != '')  -> TRUE
(2)         if ("%{3}" != '')  {
(2)           update request {
(2)             EXPAND %{3}
(2)                --> wi.mit.edu
(2)             &Stripped-User-Domain = wi.mit.edu
(2)           } # update request = noop
(2)         } # if ("%{3}" != '')  = noop
(2)         [updated] = updated
(2)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(2)       ... skipping else: Preceding "if" was taken
(2)     } # policy split_username_nai = updated
(2)     if (noop || !&Stripped-User-Domain) {
(2)     if (noop || !&Stripped-User-Domain)  -> FALSE
(2)     if (&Stripped-User-Domain != "wi.mit.edu") {
(2)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(2) eap: Peer sent EAP Response (code 2) ID 224 length 6
(2) eap: Continuing tunnel setup
(2)     [eap] = ok
(2)   } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2)   authenticate {
(2) eap: Removing EAP session with state 0xc7b8934ac6588a03
(2) eap: Previous EAP request found for state 0xc7b8934ac6588a03, released
from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: (TLS) Peer ACKed our handshake fragment
(2) eap: Sending EAP Request (code 1) ID 225 length 1000
(2) eap: EAP session adding &reply:State = 0xc7b8934ac5598a03
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) Post-Auth-Type sub-section not found.  Ignoring.
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2) session-state: Saving cached attributes
(2)   Framed-MTU = 994
(2)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(2)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(2)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(2)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(2)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(2) Sent Access-Challenge Id 2 from 127.0.0.1:1812 to 127.0.0.1:44501
length 1064
(2)   EAP-Message =
0x01e103e8194074302306082b060105050730018617687474703a2f2f6f6373702e7365637469676f2e636f6d30220603551d11041b30198217656475726f616d2d746573742e77692e6d69742e65647530820180060a2b06010401d679020402048201700482016c016a007700d809553b944f7affc816196f944f85abb0f8fc5e8755260f15d12e72bb454b140000019959e441930000040300483046022100b0024f3b426f32ef8ecf2275ce2eb3c019341bde6004d86f18292621cd9dc24f022100da6de8d13ba403578909895603e5536d5dec6d688e69c25b75c740ace2cb4454007600af67883b57b04edd8fa6d97ef62ea8eb810ac77160f0245e55d60c2fe785873a0000019959e440ba0000040300473045022100b824bfd68c70b93e59a760ceb8e8cd3e631cec82893c0402b5067be2ff4da7de022061469a16440a1cd628b76bc1c9079dd569542dc5a52ba7b84d5ec354fd8341b4007700d76d7d10d1a7f577c2c7e95fd700bff982c9335a65e1d0b301
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0xc7b8934ac5598a03967e916c9021e13b
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 3 from 127.0.0.1:44501 to 127.0.0.1:1812
length 153
(3)   Message-Authenticator = 0xd4f01566b8ab196c4c893a42935fb19d
(3)   User-Name = "anonymous@wi.mit.edu"
(3)   NAS-IP-Address = 127.0.0.1
(3)   Calling-Station-Id = "02-00-00-00-00-01"
(3)   Framed-MTU = 1400
(3)   NAS-Port-Type = Wireless-802.11
(3)   Service-Type = Framed-User
(3)   Connect-Info = "CONNECT 11Mbps 802.11b"
(3)   EAP-Message = 0x02e100061900
(3)   State = 0xc7b8934ac5598a03967e916c9021e13b
(3) Restoring &session-state
(3)   &session-state:Framed-MTU = 994
(3)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(3)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(3)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(3)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(3)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(3) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(3)   authorize {
(3) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(3) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0xd4f01566b8ab196c4c893a42935fb19d, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message = 0x02e100061900, State = 0xc7b8934ac5598a03967e916c9021e13b
(3)     [linelog_recv_request] = ok
(3)     policy split_username_nai {
(3)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(3)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(3)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(3)         update request {
(3)           EXPAND %{1}
(3)              --> anonymous
(3)           &Stripped-User-Name := anonymous
(3)         } # update request = noop
(3)         if ("%{3}" != '') {
(3)         EXPAND %{3}
(3)            --> wi.mit.edu
(3)         if ("%{3}" != '')  -> TRUE
(3)         if ("%{3}" != '')  {
(3)           update request {
(3)             EXPAND %{3}
(3)                --> wi.mit.edu
(3)             &Stripped-User-Domain = wi.mit.edu
(3)           } # update request = noop
(3)         } # if ("%{3}" != '')  = noop
(3)         [updated] = updated
(3)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(3)       ... skipping else: Preceding "if" was taken
(3)     } # policy split_username_nai = updated
(3)     if (noop || !&Stripped-User-Domain) {
(3)     if (noop || !&Stripped-User-Domain)  -> FALSE
(3)     if (&Stripped-User-Domain != "wi.mit.edu") {
(3)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(3) eap: Peer sent EAP Response (code 2) ID 225 length 6
(3) eap: Continuing tunnel setup
(3)     [eap] = ok
(3)   } # authorize = ok
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3)   authenticate {
(3) eap: Removing EAP session with state 0xc7b8934ac5598a03
(3) eap: Previous EAP request found for state 0xc7b8934ac5598a03, released
from the list
(3) eap: Peer sent packet with method EAP PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: (TLS) Peer ACKed our handshake fragment
(3) eap: Sending EAP Request (code 1) ID 226 length 1000
(3) eap: EAP session adding &reply:State = 0xc7b8934ac45a8a03
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) Post-Auth-Type sub-section not found.  Ignoring.
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3) session-state: Saving cached attributes
(3)   Framed-MTU = 994
(3)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(3)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(3)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(3)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(3)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(3) Sent Access-Challenge Id 3 from 127.0.0.1:1812 to 127.0.0.1:44501
length 1064
(3)   EAP-Message =
0x01e203e819405452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3232313131363030303030305a170d3332313131353233353935395a3044310b300906035504061302555331123010060355040a1309496e7465726e6574323121301f06035504031318496e436f6d6d6f6e20525341205365727665722043412032308201a2300d06092a864886f70d01010105000382018f003082018a028201810089f05cc438bad03457af9755a0f42243fc3e18113adb6d7a52210631d6d4b7b7928886858ff899ff1885a29d2b5ae1f8042149de44af405f9a22112c3a7b9747a995892a54c79dc733902923314855b7781aa63ab60c1a3f3bbf5d123fe039b3fa1a0b5bf8bfcc3d7d897bd2f79a9f354f2a3fbff7fd449fdbf54d494366b8c2a5691830928bae7b4bac89d60aed5f16df37bead316f591d89b5628d4c89dc372583dc6855cbfec6d3d3f04c0b
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0xc7b8934ac45a8a03967e916c9021e13b
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 4 from 127.0.0.1:44501 to 127.0.0.1:1812
length 153
(4)   Message-Authenticator = 0x154957ea5dc10d5c49e4b2b6868c0c7f
(4)   User-Name = "anonymous@wi.mit.edu"
(4)   NAS-IP-Address = 127.0.0.1
(4)   Calling-Station-Id = "02-00-00-00-00-01"
(4)   Framed-MTU = 1400
(4)   NAS-Port-Type = Wireless-802.11
(4)   Service-Type = Framed-User
(4)   Connect-Info = "CONNECT 11Mbps 802.11b"
(4)   EAP-Message = 0x02e200061900
(4)   State = 0xc7b8934ac45a8a03967e916c9021e13b
(4) Restoring &session-state
(4)   &session-state:Framed-MTU = 994
(4)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(4)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(4)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(4)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(4)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(4) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(4)   authorize {
(4) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(4) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0x154957ea5dc10d5c49e4b2b6868c0c7f, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message = 0x02e200061900, State = 0xc7b8934ac45a8a03967e916c9021e13b
(4)     [linelog_recv_request] = ok
(4)     policy split_username_nai {
(4)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(4)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(4)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(4)         update request {
(4)           EXPAND %{1}
(4)              --> anonymous
(4)           &Stripped-User-Name := anonymous
(4)         } # update request = noop
(4)         if ("%{3}" != '') {
(4)         EXPAND %{3}
(4)            --> wi.mit.edu
(4)         if ("%{3}" != '')  -> TRUE
(4)         if ("%{3}" != '')  {
(4)           update request {
(4)             EXPAND %{3}
(4)                --> wi.mit.edu
(4)             &Stripped-User-Domain = wi.mit.edu
(4)           } # update request = noop
(4)         } # if ("%{3}" != '')  = noop
(4)         [updated] = updated
(4)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(4)       ... skipping else: Preceding "if" was taken
(4)     } # policy split_username_nai = updated
(4)     if (noop || !&Stripped-User-Domain) {
(4)     if (noop || !&Stripped-User-Domain)  -> FALSE
(4)     if (&Stripped-User-Domain != "wi.mit.edu") {
(4)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(4) eap: Peer sent EAP Response (code 2) ID 226 length 6
(4) eap: Continuing tunnel setup
(4)     [eap] = ok
(4)   } # authorize = ok
(4) Found Auth-Type = eap
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4)   authenticate {
(4) eap: Removing EAP session with state 0xc7b8934ac45a8a03
(4) eap: Previous EAP request found for state 0xc7b8934ac45a8a03, released
from the list
(4) eap: Peer sent packet with method EAP PEAP (25)
(4) eap: Calling submodule eap_peap to process data
(4) eap_peap: (TLS) Peer ACKed our handshake fragment
(4) eap: Sending EAP Request (code 1) ID 227 length 848
(4) eap: EAP session adding &reply:State = 0xc7b8934ac35b8a03
(4)     [eap] = handled
(4)   } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) Post-Auth-Type sub-section not found.  Ignoring.
(4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(4) session-state: Saving cached attributes
(4)   Framed-MTU = 994
(4)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(4)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(4)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(4)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(4)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(4) Sent Access-Challenge Id 4 from 127.0.0.1:1812 to 127.0.0.1:44501
length 912
(4)   EAP-Message =
0x01e30350190025b1f7db2fa875c26a82acc3b6ce5b82c6a906cc11632a639972de975d50d94eb0af24a57652230510d9f0087c34eb3ce40e8c28940b694f6a1f34721bac365104f3470c76b1e637d0c92cdd97487bdae3b39ac46258883a1f43c32f305132715f39987ff0351a4a78249a74c48842551d60092397e495bad7ce64c22776e366ec2e6d2f09004003fad0831bcba48b59842f544bfaf7de582d5ff7181730788c639df97b36b04014946caef20acba2162192058dea1ab2a0574ea66ae5f32bbb092195ee099541ff6f8b05410c82a6fb6ccb0e8fe7851924f3103405bd41a8fcf26cf112495878cb9ad9e5bcc1e0ba3660dd3ad4757df870e79c80c17df34889c00276fe091b219fa5b4bac6c8b7502375e72a5a1b8dcf26a4345270500ee47ad22a3502979236462191a1d0f5393fd02e00f84337316fca16e539dde1cb5655fdb2cd621b60097d592d699da5fd26d8ee9cbc25460c90bfe3a990518cd903eacaec9a927abad50c98096dee6d7e7135fc
(4)   Message-Authenticator = 0x00000000000000000000000000000000
(4)   State = 0xc7b8934ac35b8a03967e916c9021e13b
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 5 from 127.0.0.1:44501 to 127.0.0.1:1812
length 283
(5)   Message-Authenticator = 0x24f5b7273d9ff4074da469f6969de643
(5)   User-Name = "anonymous@wi.mit.edu"
(5)   NAS-IP-Address = 127.0.0.1
(5)   Calling-Station-Id = "02-00-00-00-00-01"
(5)   Framed-MTU = 1400
(5)   NAS-Port-Type = Wireless-802.11
(5)   Service-Type = Framed-User
(5)   Connect-Info = "CONNECT 11Mbps 802.11b"
(5)   EAP-Message =
0x02e3008819800000007e1603030046100000424104298fa4dc60436c9aa164f91fe3788a444792a090590106e20f65328f6ada6937ed75bc958a48eafb0adbad587b553061af2f34b8671143e74be7265d3260401114030300010116030300283bbfe69d315e4d042fd7e300d28add4375a6a5074206646cce1ad132ce326c1090bbe41907ae906f
(5)   State = 0xc7b8934ac35b8a03967e916c9021e13b
(5) Restoring &session-state
(5)   &session-state:Framed-MTU = 994
(5)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(5)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(5)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(5)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(5)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(5) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(5)   authorize {
(5) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(5) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0x24f5b7273d9ff4074da469f6969de643, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02e3008819800000007e1603030046100000424104298fa4dc60436c9aa164f91fe3788a444792a090590106e20f65328f6ada6937ed75bc958a48eafb0adbad587b553061af2f34b8671143e74be7265d3260401114030300010116030300283bbfe69d315e4d042fd7e300d28add4375a6a5074206646cce1ad132ce326c1090bbe41907ae906f,
State = 0xc7b8934ac35b8a03967e916c9021e13b
(5)     [linelog_recv_request] = ok
(5)     policy split_username_nai {
(5)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(5)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(5)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(5)         update request {
(5)           EXPAND %{1}
(5)              --> anonymous
(5)           &Stripped-User-Name := anonymous
(5)         } # update request = noop
(5)         if ("%{3}" != '') {
(5)         EXPAND %{3}
(5)            --> wi.mit.edu
(5)         if ("%{3}" != '')  -> TRUE
(5)         if ("%{3}" != '')  {
(5)           update request {
(5)             EXPAND %{3}
(5)                --> wi.mit.edu
(5)             &Stripped-User-Domain = wi.mit.edu
(5)           } # update request = noop
(5)         } # if ("%{3}" != '')  = noop
(5)         [updated] = updated
(5)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(5)       ... skipping else: Preceding "if" was taken
(5)     } # policy split_username_nai = updated
(5)     if (noop || !&Stripped-User-Domain) {
(5)     if (noop || !&Stripped-User-Domain)  -> FALSE
(5)     if (&Stripped-User-Domain != "wi.mit.edu") {
(5)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(5) eap: Peer sent EAP Response (code 2) ID 227 length 136
(5) eap: Continuing tunnel setup
(5)     [eap] = ok
(5)   } # authorize = ok
(5) Found Auth-Type = eap
(5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(5)   authenticate {
(5) eap: Removing EAP session with state 0xc7b8934ac35b8a03
(5) eap: Previous EAP request found for state 0xc7b8934ac35b8a03, released
from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: (TLS) EAP Peer says that the final record size will be 126
bytes
(5) eap_peap: (TLS) EAP Got all data (126 bytes)
(5) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write server
done
(5) eap_peap: (TLS) PEAP - recv TLS 1.2 Handshake, ClientKeyExchange
(5) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read client
key exchange
(5) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read change
cipher spec
(5) eap_peap: (TLS) PEAP - recv TLS 1.2 Handshake, Finished
(5) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS read finished
(5) eap_peap: (TLS) PEAP - send TLS 1.2 ChangeCipherSpec
(5) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write change
cipher spec
(5) eap_peap: (TLS) PEAP - send TLS 1.2 Handshake, Finished
(5) eap_peap: (TLS) PEAP - Handshake state - Server SSLv3/TLS write
finished
(5) eap_peap: (TLS) PEAP - Handshake state - SSL negotiation finished
successfully
(5) eap_peap: (TLS) PEAP - Connection Established
(5) eap_peap:   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(5) eap_peap:   TLS-Session-Version = "TLS 1.2"
(5) eap: Sending EAP Request (code 1) ID 228 length 57
(5) eap: EAP session adding &reply:State = 0xc7b8934ac25c8a03
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found.  Ignoring.
(5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(5) session-state: Saving cached attributes
(5)   Framed-MTU = 994
(5)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(5)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(5)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(5)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(5)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(5)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
ClientKeyExchange"
(5)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
Finished"
(5)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(5)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Finished"
(5)   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(5)   TLS-Session-Version = "TLS 1.2"
(5) Sent Access-Challenge Id 5 from 127.0.0.1:1812 to 127.0.0.1:44501
length 115
(5)   EAP-Message =
0x01e400391900140303000101160303002858477b1fccb295ca523e4f0184223513ed9573f3c8bf282122e9591a96e94938641c24a04b996933
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0xc7b8934ac25c8a03967e916c9021e13b
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 6 from 127.0.0.1:44501 to 127.0.0.1:1812
length 153
(6)   Message-Authenticator = 0xef0ae3900b6969681c7aa846ea2a701d
(6)   User-Name = "anonymous@wi.mit.edu"
(6)   NAS-IP-Address = 127.0.0.1
(6)   Calling-Station-Id = "02-00-00-00-00-01"
(6)   Framed-MTU = 1400
(6)   NAS-Port-Type = Wireless-802.11
(6)   Service-Type = Framed-User
(6)   Connect-Info = "CONNECT 11Mbps 802.11b"
(6)   EAP-Message = 0x02e400061900
(6)   State = 0xc7b8934ac25c8a03967e916c9021e13b
(6) Restoring &session-state
(6)   &session-state:Framed-MTU = 994
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, ClientKeyExchange"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, Finished"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(6)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Finished"
(6)   &session-state:TLS-Session-Cipher-Suite =
"ECDHE-RSA-AES256-GCM-SHA384"
(6)   &session-state:TLS-Session-Version = "TLS 1.2"
(6) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(6)   authorize {
(6) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(6) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0xef0ae3900b6969681c7aa846ea2a701d, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message = 0x02e400061900, State = 0xc7b8934ac25c8a03967e916c9021e13b
(6)     [linelog_recv_request] = ok
(6)     policy split_username_nai {
(6)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(6)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(6)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(6)         update request {
(6)           EXPAND %{1}
(6)              --> anonymous
(6)           &Stripped-User-Name := anonymous
(6)         } # update request = noop
(6)         if ("%{3}" != '') {
(6)         EXPAND %{3}
(6)            --> wi.mit.edu
(6)         if ("%{3}" != '')  -> TRUE
(6)         if ("%{3}" != '')  {
(6)           update request {
(6)             EXPAND %{3}
(6)                --> wi.mit.edu
(6)             &Stripped-User-Domain = wi.mit.edu
(6)           } # update request = noop
(6)         } # if ("%{3}" != '')  = noop
(6)         [updated] = updated
(6)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(6)       ... skipping else: Preceding "if" was taken
(6)     } # policy split_username_nai = updated
(6)     if (noop || !&Stripped-User-Domain) {
(6)     if (noop || !&Stripped-User-Domain)  -> FALSE
(6)     if (&Stripped-User-Domain != "wi.mit.edu") {
(6)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(6) eap: Peer sent EAP Response (code 2) ID 228 length 6
(6) eap: Continuing tunnel setup
(6)     [eap] = ok
(6)   } # authorize = ok
(6) Found Auth-Type = eap
(6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(6)   authenticate {
(6) eap: Removing EAP session with state 0xc7b8934ac25c8a03
(6) eap: Previous EAP request found for state 0xc7b8934ac25c8a03, released
from the list
(6) eap: Peer sent packet with method EAP PEAP (25)
(6) eap: Calling submodule eap_peap to process data
(6) eap_peap: (TLS) Peer ACKed our handshake fragment.  handshake is
finished
(6) eap_peap: Session established.  Decoding tunneled attributes
(6) eap_peap: PEAP state TUNNEL ESTABLISHED
(6) eap: Sending EAP Request (code 1) ID 229 length 40
(6) eap: EAP session adding &reply:State = 0xc7b8934ac15d8a03
(6)     [eap] = handled
(6)   } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) Post-Auth-Type sub-section not found.  Ignoring.
(6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(6) session-state: Saving cached attributes
(6)   Framed-MTU = 994
(6)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(6)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(6)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(6)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(6)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(6)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
ClientKeyExchange"
(6)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
Finished"
(6)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(6)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Finished"
(6)   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(6)   TLS-Session-Version = "TLS 1.2"
(6) Sent Access-Challenge Id 6 from 127.0.0.1:1812 to 127.0.0.1:44501
length 98
(6)   EAP-Message =
0x01e500281900170303001d58477b1fccb295cb836147df0a3dfb7a8d5e339c520372c40c2a127663
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0xc7b8934ac15d8a03967e916c9021e13b
(6) Finished request
Waking up in 4.9 seconds.
(7) Received Access-Request Id 7 from 127.0.0.1:44501 to 127.0.0.1:1812
length 197
(7)   Message-Authenticator = 0xc991b02ebde08bfa9661e8713288f7ac
(7)   User-Name = "anonymous@wi.mit.edu"
(7)   NAS-IP-Address = 127.0.0.1
(7)   Calling-Station-Id = "02-00-00-00-00-01"
(7)   Framed-MTU = 1400
(7)   NAS-Port-Type = Wireless-802.11
(7)   Service-Type = Framed-User
(7)   Connect-Info = "CONNECT 11Mbps 802.11b"
(7)   EAP-Message =
0x02e50032190017030300273bbfe69d315e4d053e6612d73f624f7ddca42892195bb7638fd71840f620adf6ee94bc51c54c9b
(7)   State = 0xc7b8934ac15d8a03967e916c9021e13b
(7) Restoring &session-state
(7)   &session-state:Framed-MTU = 994
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, ClientKeyExchange"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, Finished"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(7)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Finished"
(7)   &session-state:TLS-Session-Cipher-Suite =
"ECDHE-RSA-AES256-GCM-SHA384"
(7)   &session-state:TLS-Session-Version = "TLS 1.2"
(7) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(7)   authorize {
(7) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(7) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0xc991b02ebde08bfa9661e8713288f7ac, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02e50032190017030300273bbfe69d315e4d053e6612d73f624f7ddca42892195bb7638fd71840f620adf6ee94bc51c54c9b,
State = 0xc7b8934ac15d8a03967e916c9021e13b
(7)     [linelog_recv_request] = ok
(7)     policy split_username_nai {
(7)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(7)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(7)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(7)         update request {
(7)           EXPAND %{1}
(7)              --> anonymous
(7)           &Stripped-User-Name := anonymous
(7)         } # update request = noop
(7)         if ("%{3}" != '') {
(7)         EXPAND %{3}
(7)            --> wi.mit.edu
(7)         if ("%{3}" != '')  -> TRUE
(7)         if ("%{3}" != '')  {
(7)           update request {
(7)             EXPAND %{3}
(7)                --> wi.mit.edu
(7)             &Stripped-User-Domain = wi.mit.edu
(7)           } # update request = noop
(7)         } # if ("%{3}" != '')  = noop
(7)         [updated] = updated
(7)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(7)       ... skipping else: Preceding "if" was taken
(7)     } # policy split_username_nai = updated
(7)     if (noop || !&Stripped-User-Domain) {
(7)     if (noop || !&Stripped-User-Domain)  -> FALSE
(7)     if (&Stripped-User-Domain != "wi.mit.edu") {
(7)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(7) eap: Peer sent EAP Response (code 2) ID 229 length 50
(7) eap: Continuing tunnel setup
(7)     [eap] = ok
(7)   } # authorize = ok
(7) Found Auth-Type = eap
(7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(7)   authenticate {
(7) eap: Removing EAP session with state 0xc7b8934ac15d8a03
(7) eap: Previous EAP request found for state 0xc7b8934ac15d8a03, released
from the list
(7) eap: Peer sent packet with method EAP PEAP (25)
(7) eap: Calling submodule eap_peap to process data
(7) eap_peap: (TLS) EAP Done initial handshake
(7) eap_peap: Session established.  Decoding tunneled attributes
(7) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(7) eap_peap: Identity - rgt@wi.mit.edu
(7) eap_peap: Got inner identity 'rgt@wi.mit.edu'
(7) eap_peap: Setting default EAP type for tunneled EAP session
(7) eap_peap: Got tunneled request
(7) eap_peap:   EAP-Message = 0x02e50013017267744077692e6d69742e656475
(7) eap_peap: Setting User-Name to rgt@wi.mit.edu
(7) eap_peap: Sending tunneled request to eduroam-inner
(7) eap_peap:   EAP-Message = 0x02e50013017267744077692e6d69742e656475
(7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(7) eap_peap:   User-Name = "rgt@wi.mit.edu"
(7) Virtual server eduroam-inner received request
(7)   EAP-Message = 0x02e50013017267744077692e6d69742e656475
(7)   FreeRADIUS-Proxied-To = 127.0.0.1
(7)   User-Name = "rgt@wi.mit.edu"
(7) server eduroam-inner {
(7)   # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(7)     authorize {
(7)       policy split_username_nai {
(7)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(7)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(7)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(7)           update request {
(7)             EXPAND %{1}
(7)                --> rgt
(7)             &Stripped-User-Name := rgt
(7)           } # update request = noop
(7)           if ("%{3}" != '') {
(7)           EXPAND %{3}
(7)              --> wi.mit.edu
(7)           if ("%{3}" != '')  -> TRUE
(7)           if ("%{3}" != '')  {
(7)             update request {
(7)               EXPAND %{3}
(7)                  --> wi.mit.edu
(7)               &Stripped-User-Domain = wi.mit.edu
(7)             } # update request = noop
(7)           } # if ("%{3}" != '')  = noop
(7)           [updated] = updated
(7)         } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(7)         ... skipping else: Preceding "if" was taken
(7)       } # policy split_username_nai = updated
(7)       if (noop || (&Stripped-User-Domain &&
 (&outer.Stripped-User-Domain != &Stripped-User-Domain))) {
(7)       if (noop || (&Stripped-User-Domain &&
 (&outer.Stripped-User-Domain != &Stripped-User-Domain)))  -> FALSE
(7)       if (&outer.session-state:){
(7)       if (&outer.session-state:) -> TRUE
(7)       if (&outer.session-state:) {
(7)         update {
(7)           &outer.session-state:Stripped-User-Name :=
&Stripped-User-Name -> 'rgt'
(7)         } # update = noop
(7)       } # if (&outer.session-state:) = noop
(7) inner-eap: Peer sent EAP Response (code 2) ID 229 length 19
(7) inner-eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(7)       [inner-eap] = ok
(7)     } # authorize = ok
(7)   Found Auth-Type = inner-eap
(7)   # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(7)     authenticate {
(7) inner-eap: Peer sent packet with method EAP Identity (1)
(7) inner-eap: Calling submodule eap_mschapv2 to process data
(7) eap_mschapv2: Issuing Challenge
(7) inner-eap: Sending EAP Request (code 1) ID 230 length 42
(7) inner-eap: EAP session adding &reply:State = 0x17eaa20b170cb824
(7)       [inner-eap] = handled
(7)     } # authenticate = handled
(7)   Using Post-Auth-Type Challenge
(7)   Post-Auth-Type sub-section not found.  Ignoring.
(7) } # server eduroam-inner
(7) Virtual server sending reply
(7)   EAP-Message =
0x01e6002a1a01e60025105d6182ebdc829c988a123831cd0e811a667265657261646975732d332e322e35
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x17eaa20b170cb824a795a0f9a16081e3
(7) eap_peap: Got tunneled reply code 11
(7) eap_peap:   EAP-Message =
0x01e6002a1a01e60025105d6182ebdc829c988a123831cd0e811a667265657261646975732d332e322e35
(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap:   State = 0x17eaa20b170cb824a795a0f9a16081e3
(7) eap_peap: Got tunneled reply RADIUS code 11
(7) eap_peap:   EAP-Message =
0x01e6002a1a01e60025105d6182ebdc829c988a123831cd0e811a667265657261646975732d332e322e35
(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap:   State = 0x17eaa20b170cb824a795a0f9a16081e3
(7) eap_peap: Got tunneled Access-Challenge
(7) eap: Sending EAP Request (code 1) ID 230 length 73
(7) eap: EAP session adding &reply:State = 0xc7b8934ac05e8a03
(7)     [eap] = handled
(7)   } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) Post-Auth-Type sub-section not found.  Ignoring.
(7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(7) session-state: Saving cached attributes
(7)   Framed-MTU = 994
(7)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(7)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(7)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(7)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(7)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(7)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
ClientKeyExchange"
(7)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
Finished"
(7)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(7)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Finished"
(7)   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(7)   TLS-Session-Version = "TLS 1.2"
(7)   Stripped-User-Name := "rgt"
(7) Sent Access-Challenge Id 7 from 127.0.0.1:1812 to 127.0.0.1:44501
length 131
(7)   EAP-Message =
0x01e600491900170303003e58477b1fccb295ccad71e2a7443e78759ff8901dc0d01db1b7f4e91c01c25a06d3719391186546a3c47d2f14dce1e2b16f33b0267c94a3e3b1c7746cd05e
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0xc7b8934ac05e8a03967e916c9021e13b
(7) Finished request
Waking up in 4.9 seconds.
(8) Received Access-Request Id 8 from 127.0.0.1:44501 to 127.0.0.1:1812
length 251
(8)   Message-Authenticator = 0x6f8c007996d1f0012504cb6d41fb22cd
(8)   User-Name = "anonymous@wi.mit.edu"
(8)   NAS-IP-Address = 127.0.0.1
(8)   Calling-Station-Id = "02-00-00-00-00-01"
(8)   Framed-MTU = 1400
(8)   NAS-Port-Type = Wireless-802.11
(8)   Service-Type = Framed-User
(8)   Connect-Info = "CONNECT 11Mbps 802.11b"
(8)   EAP-Message =
0x02e600681900170303005d3bbfe69d315e4d068224633a70b745c40db57e3bfa61164251382ee15d0d98781773e43485c9fafafdaada92edab12beccde4df1a19c4e8c8b0a8165c9c6cfbeb2fdaf67fc60774800317c82dc69fdcefa47b51cf09a09df027f37c4c1
(8)   State = 0xc7b8934ac05e8a03967e916c9021e13b
(8) Restoring &session-state
(8)   &session-state:Framed-MTU = 994
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, ClientKeyExchange"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, Finished"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(8)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Finished"
(8)   &session-state:TLS-Session-Cipher-Suite =
"ECDHE-RSA-AES256-GCM-SHA384"
(8)   &session-state:TLS-Session-Version = "TLS 1.2"
(8)   &session-state:Stripped-User-Name := "rgt"
(8) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(8)   authorize {
(8) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(8) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0x6f8c007996d1f0012504cb6d41fb22cd, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02e600681900170303005d3bbfe69d315e4d068224633a70b745c40db57e3bfa61164251382ee15d0d98781773e43485c9fafafdaada92edab12beccde4df1a19c4e8c8b0a8165c9c6cfbeb2fdaf67fc60774800317c82dc69fdcefa47b51cf09a09df027f37c4c1,
State = 0xc7b8934ac05e8a03967e916c9021e13b
(8)     [linelog_recv_request] = ok
(8)     policy split_username_nai {
(8)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(8)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(8)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(8)         update request {
(8)           EXPAND %{1}
(8)              --> anonymous
(8)           &Stripped-User-Name := anonymous
(8)         } # update request = noop
(8)         if ("%{3}" != '') {
(8)         EXPAND %{3}
(8)            --> wi.mit.edu
(8)         if ("%{3}" != '')  -> TRUE
(8)         if ("%{3}" != '')  {
(8)           update request {
(8)             EXPAND %{3}
(8)                --> wi.mit.edu
(8)             &Stripped-User-Domain = wi.mit.edu
(8)           } # update request = noop
(8)         } # if ("%{3}" != '')  = noop
(8)         [updated] = updated
(8)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(8)       ... skipping else: Preceding "if" was taken
(8)     } # policy split_username_nai = updated
(8)     if (noop || !&Stripped-User-Domain) {
(8)     if (noop || !&Stripped-User-Domain)  -> FALSE
(8)     if (&Stripped-User-Domain != "wi.mit.edu") {
(8)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(8) eap: Peer sent EAP Response (code 2) ID 230 length 104
(8) eap: Continuing tunnel setup
(8)     [eap] = ok
(8)   } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(8)   authenticate {
(8) eap: Removing EAP session with state 0xc7b8934ac05e8a03
(8) eap: Previous EAP request found for state 0xc7b8934ac05e8a03, released
from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: (TLS) EAP Done initial handshake
(8) eap_peap: Session established.  Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP method MSCHAPv2 (26)
(8) eap_peap: Got tunneled request
(8) eap_peap:   EAP-Message =
0x02e600491a02e600443174e3afa54124cbabd1b307e98e39a929000000000000000061d5dca99a6819aad04554871d20f79dab498e512e199053007267744077692e6d69742e656475
(8) eap_peap: Setting User-Name to rgt@wi.mit.edu
(8) eap_peap: Sending tunneled request to eduroam-inner
(8) eap_peap:   EAP-Message =
0x02e600491a02e600443174e3afa54124cbabd1b307e98e39a929000000000000000061d5dca99a6819aad04554871d20f79dab498e512e199053007267744077692e6d69742e656475
(8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap:   User-Name = "rgt@wi.mit.edu"
(8) eap_peap:   State = 0x17eaa20b170cb824a795a0f9a16081e3
(8) Virtual server eduroam-inner received request
(8)   EAP-Message =
0x02e600491a02e600443174e3afa54124cbabd1b307e98e39a929000000000000000061d5dca99a6819aad04554871d20f79dab498e512e199053007267744077692e6d69742e656475
(8)   FreeRADIUS-Proxied-To = 127.0.0.1
(8)   User-Name = "rgt@wi.mit.edu"
(8)   State = 0x17eaa20b170cb824a795a0f9a16081e3
(8) server eduroam-inner {
(8)   session-state: No cached attributes
(8)   # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8)     authorize {
(8)       policy split_username_nai {
(8)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(8)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(8)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(8)           update request {
(8)             EXPAND %{1}
(8)                --> rgt
(8)             &Stripped-User-Name := rgt
(8)           } # update request = noop
(8)           if ("%{3}" != '') {
(8)           EXPAND %{3}
(8)              --> wi.mit.edu
(8)           if ("%{3}" != '')  -> TRUE
(8)           if ("%{3}" != '')  {
(8)             update request {
(8)               EXPAND %{3}
(8)                  --> wi.mit.edu
(8)               &Stripped-User-Domain = wi.mit.edu
(8)             } # update request = noop
(8)           } # if ("%{3}" != '')  = noop
(8)           [updated] = updated
(8)         } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(8)         ... skipping else: Preceding "if" was taken
(8)       } # policy split_username_nai = updated
(8)       if (noop || (&Stripped-User-Domain &&
 (&outer.Stripped-User-Domain != &Stripped-User-Domain))) {
(8)       if (noop || (&Stripped-User-Domain &&
 (&outer.Stripped-User-Domain != &Stripped-User-Domain)))  -> FALSE
(8)       if (&outer.session-state:){
(8)       if (&outer.session-state:) -> TRUE
(8)       if (&outer.session-state:) {
(8)         update {
(8)           &outer.session-state:Stripped-User-Name :=
&Stripped-User-Name -> 'rgt'
(8)         } # update = noop
(8)       } # if (&outer.session-state:) = noop
(8) inner-eap: Peer sent EAP Response (code 2) ID 230 length 73
(8) inner-eap: No EAP Start, assuming it's an on-going EAP conversation
(8)       [inner-eap] = updated
(8) files: users: Matched entry DEFAULT at line 1
(8)       [files] = ok
(8) pap: WARNING: Auth-Type already set.  Not setting to PAP
(8)       [pap] = noop
(8)       [mschap] = noop
(8)     } # authorize = updated
(8)   Found Auth-Type = inner-eap
(8)   # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8)     authenticate {
(8) inner-eap: Removing EAP session with state 0x17eaa20b170cb824
(8) inner-eap: Previous EAP request found for state 0x17eaa20b170cb824,
released from the list
(8) inner-eap: Peer sent packet with method EAP MSCHAPv2 (26)
(8) inner-eap: Calling submodule eap_mschapv2 to process data
(8) eap_mschapv2: # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8) eap_mschapv2:   authenticate {
(8) mschap: Found Cleartext-Password, hashing to create NT-Password
(8) mschap: Creating challenge hash with username: rgt@wi.mit.edu
(8) mschap: Client is using MS-CHAPv2
(8) mschap: ERROR: MS-CHAP2-Response is incorrect
(8) eap_mschapv2:     [mschap] = reject
(8) eap_mschapv2:   } # authenticate = reject
(8) eap_mschapv2: MSCHAP-Error: ?E=691 R=1
C=af9121d55ab76fc424446fdeafaacdc3 V=3 M=Authentication rejected
(8) eap_mschapv2: Found new challenge from MS-CHAP-Error: err=691 retry=1
challenge=af9121d55ab76fc424446fdeafaacdc3
(8) eap_mschapv2: ERROR: MSCHAP Failure
(8) inner-eap: Sending EAP Request (code 1) ID 231 length 83
(8) inner-eap: EAP session adding &reply:State = 0x17eaa20b160db824
(8)       [inner-eap] = handled
(8)     } # authenticate = handled
(8)   Using Post-Auth-Type Challenge
(8)   Post-Auth-Type sub-section not found.  Ignoring.
(8) } # server eduroam-inner
(8) Virtual server sending reply
(8)   EAP-Message =
0x01e700531a04e6004e453d36393120523d3120433d616639313231643535616237366663343234343436666465616661616364633320563d33204d3d41757468656e7469636174696f6e2072656a6563746564
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x17eaa20b160db824a795a0f9a16081e3
(8) eap_peap: Got tunneled reply code 11
(8) eap_peap:   EAP-Message =
0x01e700531a04e6004e453d36393120523d3120433d616639313231643535616237366663343234343436666465616661616364633320563d33204d3d41757468656e7469636174696f6e2072656a6563746564
(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap:   State = 0x17eaa20b160db824a795a0f9a16081e3
(8) eap_peap: Got tunneled reply RADIUS code 11
(8) eap_peap:   EAP-Message =
0x01e700531a04e6004e453d36393120523d3120433d616639313231643535616237366663343234343436666465616661616364633320563d33204d3d41757468656e7469636174696f6e2072656a6563746564
(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap:   State = 0x17eaa20b160db824a795a0f9a16081e3
(8) eap_peap: Got tunneled Access-Challenge
(8) eap: Sending EAP Request (code 1) ID 231 length 114
(8) eap: EAP session adding &reply:State = 0xc7b8934acf5f8a03
(8)     [eap] = handled
(8)   } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) Post-Auth-Type sub-section not found.  Ignoring.
(8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(8) session-state: Saving cached attributes
(8)   Framed-MTU = 994
(8)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(8)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(8)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(8)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(8)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(8)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
ClientKeyExchange"
(8)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
Finished"
(8)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(8)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Finished"
(8)   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(8)   TLS-Session-Version = "TLS 1.2"
(8)   Stripped-User-Name := "rgt"
(8) Sent Access-Challenge Id 8 from 127.0.0.1:1812 to 127.0.0.1:44501
length 172
(8)   EAP-Message =
0x01e700721900170303006758477b1fccb295cdd1e97c1ed2cf55355ecb8ba6578483a0891c09142559eb08fd0381ead0ed900f2b21d6fc084224e1a361807e3b1e64cedfeeec3bf99104a8cf10a6bf436e14cae8e769f424b6370b39a9e3d2ae13a592e19a2e73f107a18a53534276e03256
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0xc7b8934acf5f8a03967e916c9021e13b
(8) Finished request
Waking up in 4.9 seconds.
(9) Received Access-Request Id 9 from 127.0.0.1:44501 to 127.0.0.1:1812
length 184
(9)   Message-Authenticator = 0x23e97b491bf2b2491b2d132fc5b6b8d5
(9)   User-Name = "anonymous@wi.mit.edu"
(9)   NAS-IP-Address = 127.0.0.1
(9)   Calling-Station-Id = "02-00-00-00-00-01"
(9)   Framed-MTU = 1400
(9)   NAS-Port-Type = Wireless-802.11
(9)   Service-Type = Framed-User
(9)   Connect-Info = "CONNECT 11Mbps 802.11b"
(9)   EAP-Message =
0x02e700251900170303001a3bbfe69d315e4d07d954e42861898ca577208b684e803698b14e
(9)   State = 0xc7b8934acf5f8a03967e916c9021e13b
(9) Restoring &session-state
(9)   &session-state:Framed-MTU = 994
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, ClientKeyExchange"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, Finished"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(9)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Finished"
(9)   &session-state:TLS-Session-Cipher-Suite =
"ECDHE-RSA-AES256-GCM-SHA384"
(9)   &session-state:TLS-Session-Version = "TLS 1.2"
(9)   &session-state:Stripped-User-Name := "rgt"
(9) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(9)   authorize {
(9) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(9) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0x23e97b491bf2b2491b2d132fc5b6b8d5, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02e700251900170303001a3bbfe69d315e4d07d954e42861898ca577208b684e803698b14e,
State = 0xc7b8934acf5f8a03967e916c9021e13b
(9)     [linelog_recv_request] = ok
(9)     policy split_username_nai {
(9)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(9)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(9)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(9)         update request {
(9)           EXPAND %{1}
(9)              --> anonymous
(9)           &Stripped-User-Name := anonymous
(9)         } # update request = noop
(9)         if ("%{3}" != '') {
(9)         EXPAND %{3}
(9)            --> wi.mit.edu
(9)         if ("%{3}" != '')  -> TRUE
(9)         if ("%{3}" != '')  {
(9)           update request {
(9)             EXPAND %{3}
(9)                --> wi.mit.edu
(9)             &Stripped-User-Domain = wi.mit.edu
(9)           } # update request = noop
(9)         } # if ("%{3}" != '')  = noop
(9)         [updated] = updated
(9)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(9)       ... skipping else: Preceding "if" was taken
(9)     } # policy split_username_nai = updated
(9)     if (noop || !&Stripped-User-Domain) {
(9)     if (noop || !&Stripped-User-Domain)  -> FALSE
(9)     if (&Stripped-User-Domain != "wi.mit.edu") {
(9)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(9) eap: Peer sent EAP Response (code 2) ID 231 length 37
(9) eap: Continuing tunnel setup
(9)     [eap] = ok
(9)   } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(9)   authenticate {
(9) eap: Removing EAP session with state 0xc7b8934acf5f8a03
(9) eap: Previous EAP request found for state 0xc7b8934acf5f8a03, released
from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: (TLS) EAP Done initial handshake
(9) eap_peap: Session established.  Decoding tunneled attributes
(9) eap_peap: PEAP state phase2
(9) eap_peap: EAP method MSCHAPv2 (26)
(9) eap_peap: Got tunneled request
(9) eap_peap:   EAP-Message = 0x02e700061a04
(9) eap_peap: Setting User-Name to rgt@wi.mit.edu
(9) eap_peap: Sending tunneled request to eduroam-inner
(9) eap_peap:   EAP-Message = 0x02e700061a04
(9) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(9) eap_peap:   User-Name = "rgt@wi.mit.edu"
(9) eap_peap:   State = 0x17eaa20b160db824a795a0f9a16081e3
(9) Virtual server eduroam-inner received request
(9)   EAP-Message = 0x02e700061a04
(9)   FreeRADIUS-Proxied-To = 127.0.0.1
(9)   User-Name = "rgt@wi.mit.edu"
(9)   State = 0x17eaa20b160db824a795a0f9a16081e3
(9) server eduroam-inner {
(9)   session-state: No cached attributes
(9)   # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9)     authorize {
(9)       policy split_username_nai {
(9)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(9)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(9)         if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(9)           update request {
(9)             EXPAND %{1}
(9)                --> rgt
(9)             &Stripped-User-Name := rgt
(9)           } # update request = noop
(9)           if ("%{3}" != '') {
(9)           EXPAND %{3}
(9)              --> wi.mit.edu
(9)           if ("%{3}" != '')  -> TRUE
(9)           if ("%{3}" != '')  {
(9)             update request {
(9)               EXPAND %{3}
(9)                  --> wi.mit.edu
(9)               &Stripped-User-Domain = wi.mit.edu
(9)             } # update request = noop
(9)           } # if ("%{3}" != '')  = noop
(9)           [updated] = updated
(9)         } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(9)         ... skipping else: Preceding "if" was taken
(9)       } # policy split_username_nai = updated
(9)       if (noop || (&Stripped-User-Domain &&
 (&outer.Stripped-User-Domain != &Stripped-User-Domain))) {
(9)       if (noop || (&Stripped-User-Domain &&
 (&outer.Stripped-User-Domain != &Stripped-User-Domain)))  -> FALSE
(9)       if (&outer.session-state:){
(9)       if (&outer.session-state:) -> TRUE
(9)       if (&outer.session-state:) {
(9)         update {
(9)           &outer.session-state:Stripped-User-Name :=
&Stripped-User-Name -> 'rgt'
(9)         } # update = noop
(9)       } # if (&outer.session-state:) = noop
(9) inner-eap: Peer sent EAP Response (code 2) ID 231 length 6
(9) inner-eap: No EAP Start, assuming it's an on-going EAP conversation
(9)       [inner-eap] = updated
(9) files: users: Matched entry DEFAULT at line 1
(9)       [files] = ok
(9) pap: WARNING: Auth-Type already set.  Not setting to PAP
(9)       [pap] = noop
(9)       [mschap] = noop
(9)     } # authorize = updated
(9)   Found Auth-Type = inner-eap
(9)   # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9)     authenticate {
(9) inner-eap: Removing EAP session with state 0x17eaa20b160db824
(9) inner-eap: Previous EAP request found for state 0x17eaa20b160db824,
released from the list
(9) inner-eap: Peer sent packet with method EAP MSCHAPv2 (26)
(9) inner-eap: Calling submodule eap_mschapv2 to process data
(9) inner-eap: Sending EAP Failure (code 4) ID 231 length 4
(9) inner-eap: Freeing handler
(9)       [inner-eap] = reject
(9)     } # authenticate = reject
(9)   Failed to authenticate the user
(9)   Using Post-Auth-Type Reject
(9)   Post-Auth-Type sub-section not found.  Ignoring.
(9) } # server eduroam-inner
(9) Virtual server sending reply
(9)   EAP-Message = 0x04e70004
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap: Got tunneled reply code 3
(9) eap_peap:   EAP-Message = 0x04e70004
(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap: Got tunneled reply RADIUS code 3
(9) eap_peap:   EAP-Message = 0x04e70004
(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap: Tunneled authentication was rejected
(9) eap_peap: FAILURE
(9) eap: Sending EAP Request (code 1) ID 232 length 46
(9) eap: EAP session adding &reply:State = 0xc7b8934ace508a03
(9)     [eap] = handled
(9)   } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) Post-Auth-Type sub-section not found.  Ignoring.
(9) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(9) session-state: Saving cached attributes
(9)   Framed-MTU = 994
(9)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3 Handshake,
ClientHello"
(9)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHello"
(9)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Certificate"
(9)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerKeyExchange"
(9)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
ServerHelloDone"
(9)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
ClientKeyExchange"
(9)   TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2 Handshake,
Finished"
(9)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(9)   TLS-Session-Information = "(TLS) PEAP - send TLS 1.2 Handshake,
Finished"
(9)   TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(9)   TLS-Session-Version = "TLS 1.2"
(9)   Stripped-User-Name := "rgt"
(9) Sent Access-Challenge Id 9 from 127.0.0.1:1812 to 127.0.0.1:44501
length 104
(9)   EAP-Message =
0x01e8002e1900170303002358477b1fccb295cecd17bf73532e789cc96643b03898861e94ed5afecd7ead1d97d0cc
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9)   State = 0xc7b8934ace508a03967e916c9021e13b
(9) Finished request
Waking up in 4.9 seconds.
(10) Received Access-Request Id 10 from 127.0.0.1:44501 to 127.0.0.1:1812
length 193
(10)   Message-Authenticator = 0x8112a33dda4e23458ca203252210a740
(10)   User-Name = "anonymous@wi.mit.edu"
(10)   NAS-IP-Address = 127.0.0.1
(10)   Calling-Station-Id = "02-00-00-00-00-01"
(10)   Framed-MTU = 1400
(10)   NAS-Port-Type = Wireless-802.11
(10)   Service-Type = Framed-User
(10)   Connect-Info = "CONNECT 11Mbps 802.11b"
(10)   EAP-Message =
0x02e8002e190017030300233bbfe69d315e4d082714fa498ed3f47b247f50624cc37e8bfdffbbe9c189d6e0e9dd61
(10)   State = 0xc7b8934ace508a03967e916c9021e13b
(10) Restoring &session-state
(10)   &session-state:Framed-MTU = 994
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.3
Handshake, ClientHello"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHello"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Certificate"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerKeyExchange"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, ServerHelloDone"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, ClientKeyExchange"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - recv TLS 1.2
Handshake, Finished"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
ChangeCipherSpec"
(10)   &session-state:TLS-Session-Information = "(TLS) PEAP - send TLS 1.2
Handshake, Finished"
(10)   &session-state:TLS-Session-Cipher-Suite =
"ECDHE-RSA-AES256-GCM-SHA384"
(10)   &session-state:TLS-Session-Version = "TLS 1.2"
(10)   &session-state:Stripped-User-Name := "rgt"
(10) # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/default
(10)   authorize {
(10) linelog_recv_request: EXPAND action = Recv-Request, %{pairs:request:}
(10) linelog_recv_request:    --> action = Recv-Request,
Message-Authenticator = 0x8112a33dda4e23458ca203252210a740, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02e8002e190017030300233bbfe69d315e4d082714fa498ed3f47b247f50624cc37e8bfdffbbe9c189d6e0e9dd61,
State = 0xc7b8934ace508a03967e916c9021e13b
(10)     [linelog_recv_request] = ok
(10)     policy split_username_nai {
(10)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(10)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(10)       if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(10)         update request {
(10)           EXPAND %{1}
(10)              --> anonymous
(10)           &Stripped-User-Name := anonymous
(10)         } # update request = noop
(10)         if ("%{3}" != '') {
(10)         EXPAND %{3}
(10)            --> wi.mit.edu
(10)         if ("%{3}" != '')  -> TRUE
(10)         if ("%{3}" != '')  {
(10)           update request {
(10)             EXPAND %{3}
(10)                --> wi.mit.edu
(10)             &Stripped-User-Domain = wi.mit.edu
(10)           } # update request = noop
(10)         } # if ("%{3}" != '')  = noop
(10)         [updated] = updated
(10)       } # if (&User-Name && (&User-Name =~
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(10)       ... skipping else: Preceding "if" was taken
(10)     } # policy split_username_nai = updated
(10)     if (noop || !&Stripped-User-Domain) {
(10)     if (noop || !&Stripped-User-Domain)  -> FALSE
(10)     if (&Stripped-User-Domain != "wi.mit.edu") {
(10)     if (&Stripped-User-Domain != "wi.mit.edu")  -> FALSE
(10) eap: Peer sent EAP Response (code 2) ID 232 length 46
(10) eap: Continuing tunnel setup
(10)     [eap] = ok
(10)   } # authorize = ok
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(10)   authenticate {
(10) eap: Removing EAP session with state 0xc7b8934ace508a03
(10) eap: Previous EAP request found for state 0xc7b8934ace508a03,
released from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: (TLS) EAP Done initial handshake
(10) eap_peap: Session established.  Decoding tunneled attributes
(10) eap_peap: PEAP state send tlv failure
(10) eap_peap: Received EAP-TLV response
(10) eap_peap:   ERROR: The users session was previously rejected:
returning reject (again.)
(10) eap_peap:   This means you need to read the PREVIOUS messages in the
debug output
(10) eap_peap:   to find out the reason why the user was rejected
(10) eap_peap:   Look for "reject" or "fail".  Those earlier messages will
tell you
(10) eap_peap:   what went wrong, and how to fix the problem
(10) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module
failed
(10) eap: Sending EAP Failure (code 4) ID 232 length 4
(10) eap: Failed in EAP select
(10)     [eap] = invalid
(10)   } # authenticate = invalid
(10) Failed to authenticate the user
(10) Using Post-Auth-Type Reject
(10) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(10)   Post-Auth-Type REJECT {
(10) attr_filter.access_reject: EXPAND %{User-Name}
(10) attr_filter.access_reject:    --> anonymous@wi.mit.edu
(10) attr_filter.access_reject: Matched entry DEFAULT at line 11
(10)     [attr_filter.access_reject] = updated
(10) linelog_send_reject: EXPAND action = Send-Reject, %{pairs:request:}
(10) linelog_send_reject:    --> action = Send-Reject,
Message-Authenticator = 0x8112a33dda4e23458ca203252210a740, User-Name = "
anonymous@wi.mit.edu", NAS-IP-Address = 127.0.0.1, Calling-Station-Id =
"02-00-00-00-00-01", Framed-MTU = 1400, NAS-Port-Type = Wireless-802.11,
Service-Type = Framed-User, Connect-Info = "CONNECT 11Mbps 802.11b",
EAP-Message =
0x02e8002e190017030300233bbfe69d315e4d082714fa498ed3f47b247f50624cc37e8bfdffbbe9c189d6e0e9dd61,
State = 0xc7b8934ace508a03967e916c9021e13b, Stripped-User-Name =
"anonymous", Stripped-User-Domain = "wi.mit.edu", EAP-Type = PEAP,
Module-Failure-Message = "eap_peap: The users session was previously
rejected: returning reject (again.)", Module-Failure-Message = "eap: Failed
continuing EAP PEAP (25) session.  EAP sub-module failed"
(10)     [linelog_send_reject] = ok
(10)   } # Post-Auth-Type REJECT = updated
(10) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(10) Sending delayed response
(10) Sent Access-Reject Id 10 from 127.0.0.1:1812 to 127.0.0.1:44501
length 44
(10)   EAP-Message = 0x04e80004
(10)   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 0 with timestamp +7 due to cleanup_delay
was reached
(1) Cleaning up request packet ID 1 with timestamp +7 due to cleanup_delay
was reached
(2) Cleaning up request packet ID 2 with timestamp +7 due to cleanup_delay
was reached
(3) Cleaning up request packet ID 3 with timestamp +7 due to cleanup_delay
was reached
(4) Cleaning up request packet ID 4 with timestamp +7 due to cleanup_delay
was reached
(5) Cleaning up request packet ID 5 with timestamp +7 due to cleanup_delay
was reached
(6) Cleaning up request packet ID 6 with timestamp +7 due to cleanup_delay
was reached
(7) Cleaning up request packet ID 7 with timestamp +7 due to cleanup_delay
was reached
(8) Cleaning up request packet ID 8 with timestamp +7 due to cleanup_delay
was reached
(9) Cleaning up request packet ID 9 with timestamp +7 due to cleanup_delay
was reached
(10) Cleaning up request packet ID 10 with timestamp +7 due to
cleanup_delay was reached
Ready to process requests

Re: help with freeradius on u24 for eduroam with ntlm auth

Rob Taylor