Re: Add Check Item in PEAP MSCHAP V2 authentication process

29 Aug 2016


      Le 29/08/2016 à 13:24, Alan DeKok a écrit :
...
On Aug 29, 2016, at 5:34 AM, Tim Baledorion <timbaledorion@hotmail.com> wrote:
...
I will try to rephrase my question according to your advices.
   I asked you to explain what you meant by "node" and "node identifier".  You haven't done that.
...
To authenticate host in a network i'm using a Proxy Radius chain. The first element of this chain is named a Node and has a node identifier.
   What is a "node identifier" ?
A node Identifier is
...
Host are connecting to the network via NAS and the Radius Server configured in the NAS is the node radius.
The host and the NAS don't know about the node identifier.
   You've just giving the same explanation as the previous message.  Why do you think this is a good idea?
...
I have add a node file under /etc/raddb/policy.d/ and invoked it in /etc/raddb/sites-available/default
node.pre-proxy {
        if ("%{request:Packet-Type}" == 'Access-Request')  {
                update proxy-request {
                        &NET-NodeID == "ndid-00000001"
    Where is that attribute defined?
If you edited raddb/dictionary, did you *READ* the comments in that file?
        yes I did it and was able to add Net-NodeID to access request as 
radius output is showing
...
but when using PEAP-MSCHAPv2 authentication model the NET-NodeID item doesn't appear in the Access-Request sent to the inner-tunnel.
    Is it supposed to be there?  Why do you think it's supposed to be there?
In the inner-tunnel the authentication is done against LDAP database 
through radius ldap module. I wanted to check the NET-NodeID during the 
TLS phase that's why i was thinking it has to be there.
...
A proxy *cannot* modify the data inside of a TLS tunnel.  TLS is designed to prevent this...
I understand that quite well. That's why i was asking if the i had to 
change something in the supplicant to allow the behaviour i was requesting.
Maybe i should modify the ldap module parameters to look through the 
LDAP database in the authorize section with a match for Net-NodeID 
first, and then authenticate as it is requested in PEAP-MSCHAPv2?
If you think this id is the right one i would have probably to setup 2 
ldap instance one for the inner-tunnel the other for the authorize section.
...
I join the file containing the full authentication log for a request coming from node with identifier ndid-00000001 in NET-NodeID
   Don't attach the debug log.  Include it in the message.
And PLEASE follow instructions.  It's "radiusd -X", not "radiusd -Xx", or "radiusd -xxxxxxxx".
...
Once again thank you for your support. I did my best to answer your request and give you a better view. Let me know if it is not enough.
   Read the documentation and follow it.  That helps a lot.
Alan DeKok.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I change the log options to give you the right output you can see there..


Copyright (C) 1999-2015 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/raddb/dictionary
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/mods-enabled/
including configuration file /etc/raddb/mods-enabled/always
including configuration file /etc/raddb/mods-enabled/attr_filter
including configuration file /etc/raddb/mods-enabled/cache_eap
including configuration file /etc/raddb/mods-enabled/chap
including configuration file /etc/raddb/mods-enabled/detail
including configuration file /etc/raddb/mods-enabled/detail.log
including configuration file /etc/raddb/mods-enabled/dhcp
including configuration file /etc/raddb/mods-enabled/digest
including configuration file /etc/raddb/mods-enabled/dynamic_clients
including configuration file /etc/raddb/mods-enabled/eap
including configuration file /etc/raddb/mods-enabled/echo
including configuration file /etc/raddb/mods-enabled/exec
including configuration file /etc/raddb/mods-enabled/expiration
including configuration file /etc/raddb/mods-enabled/expr
including configuration file /etc/raddb/mods-enabled/files
including configuration file /etc/raddb/mods-enabled/linelog
including configuration file /etc/raddb/mods-enabled/logintime
including configuration file /etc/raddb/mods-enabled/mschap
including configuration file /etc/raddb/mods-enabled/ntlm_auth
including configuration file /etc/raddb/mods-enabled/pap
including configuration file /etc/raddb/mods-enabled/passwd
including configuration file /etc/raddb/mods-enabled/preprocess
including configuration file /etc/raddb/mods-enabled/radutmp
including configuration file /etc/raddb/mods-enabled/realm
including configuration file /etc/raddb/mods-enabled/replicate
including configuration file /etc/raddb/mods-enabled/soh
including configuration file /etc/raddb/mods-enabled/sradutmp
including configuration file /etc/raddb/mods-enabled/unix
including configuration file /etc/raddb/mods-enabled/unpack
including configuration file /etc/raddb/mods-enabled/utf8
including configuration file /etc/raddb/mods-enabled/ldap
including files in directory /etc/raddb/policy.d/
including configuration file /etc/raddb/policy.d/accounting
including configuration file /etc/raddb/policy.d/canonicalization
including configuration file /etc/raddb/policy.d/control
including configuration file /etc/raddb/policy.d/cui
including configuration file /etc/raddb/policy.d/debug
including configuration file /etc/raddb/policy.d/dhcp
including configuration file /etc/raddb/policy.d/eap
including configuration file /etc/raddb/policy.d/filter
including configuration file /etc/raddb/policy.d/operator-name
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/inner-tunnel
main {
  security {
      user = "radiusd"
      group = "radiusd"
      allow_core_dumps = no
  }
     name = "radiusd"
     prefix = "/usr"
     localstatedir = "/var"
     logdir = "/var/log/radius"
     run_dir = "/var/run/radiusd"
}
main {
     name = "radiusd"
     prefix = "/usr"
     localstatedir = "/var"
     sbindir = "/usr/sbin"
     logdir = "/var/log/radius"
     run_dir = "/var/run/radiusd"
     libdir = "/usr/lib64/freeradius"
     radacctdir = "/var/log/radius/radacct"
     hostname_lookups = no
     max_request_time = 30
     cleanup_delay = 5
     max_requests = 16384
     pidfile = "/var/run/radiusd/radiusd.pid"
     checkrad = "/usr/sbin/checkrad"
     debug_level = 0
     proxy_requests = yes
  log {
      stripped_names = no
      auth = no
      auth_badpass = no
      auth_goodpass = no
      colourise = yes
      msg_denied = "You are already logged in - access denied"
  }
  resources {
  }
  security {
      max_attributes = 200
      reject_delay = 1.000000
      status_server = yes
  }
}
radiusd: #### Loading Realms and Home Servers ####
  proxy server {
      retry_delay = 5
      retry_count = 3
      default_fallback = no
      dead_time = 120
      wake_all_if_all_dead = no
  }
  home_server localhost {
      ipaddr = 127.0.0.1
      port = 1812
      type = "auth"
      secret = <<< secret >>>
      response_window = 20.000000
      response_timeouts = 1
      max_outstanding = 65536
      zombie_period = 40
      status_check = "status-server"
      ping_interval = 30
      check_interval = 30
      check_timeout = 4
      num_answers_to_alive = 3
      revive_interval = 120
   limit {
       max_connections = 16
       max_requests = 0
       lifetime = 0
       idle_timeout = 0
   }
   coa {
       irt = 2
       mrt = 16
       mrc = 5
       mrd = 30
   }
  }
  home_server_pool my_auth_failover {
     type = fail-over
     home_server = localhost
  }
  realm example.com {
     auth_pool = my_auth_failover
  }
  realm LOCAL {
  }
radiusd: #### Loading Clients ####
  client localhost {
      ipaddr = 127.0.0.1
      require_message_authenticator = no
      secret = <<< secret >>>
      nas_type = "other"
      proto = "*"
   limit {
       max_connections = 16
       lifetime = 0
       idle_timeout = 30
   }
  }
  client localhost_ipv6 {
      ipv6addr = ::1
      require_message_authenticator = no
      secret = <<< secret >>>
   limit {
       max_connections = 16
       lifetime = 0
       idle_timeout = 30
   }
  }
  client rp_netos {
      ipaddr = 192.168.42.193
      require_message_authenticator = no
      secret = <<< secret >>>
   limit {
       max_connections = 16
       lifetime = 0
       idle_timeout = 30
   }
  }
  client rp_netos2 {
      ipaddr = 192.168.42.103
      require_message_authenticator = no
      secret = <<< secret >>>
   limit {
       max_connections = 16
       lifetime = 0
       idle_timeout = 30
   }
  }
Debugger not attached
  # Creating Auth-Type = digest
radiusd: #### Instantiating modules ####
   # Loaded module rlm_always
   # Loading module "reject" from file /etc/raddb/mods-enabled/always
   always reject {
       rcode = "reject"
       simulcount = 0
       mpp = no
   }
   # Loading module "fail" from file /etc/raddb/mods-enabled/always
   always fail {
       rcode = "fail"
       simulcount = 0
       mpp = no
   }
   # Loading module "ok" from file /etc/raddb/mods-enabled/always
   always ok {
       rcode = "ok"
       simulcount = 0
       mpp = no
   }
   # Loading module "handled" from file /etc/raddb/mods-enabled/always
   always handled {
       rcode = "handled"
       simulcount = 0
       mpp = no
   }
   # Loading module "invalid" from file /etc/raddb/mods-enabled/always
   always invalid {
       rcode = "invalid"
       simulcount = 0
       mpp = no
   }
   # Loading module "userlock" from file /etc/raddb/mods-enabled/always
   always userlock {
       rcode = "userlock"
       simulcount = 0
       mpp = no
   }
   # Loading module "notfound" from file /etc/raddb/mods-enabled/always
   always notfound {
       rcode = "notfound"
       simulcount = 0
       mpp = no
   }
   # Loading module "noop" from file /etc/raddb/mods-enabled/always
   always noop {
       rcode = "noop"
       simulcount = 0
       mpp = no
   }
   # Loading module "updated" from file /etc/raddb/mods-enabled/always
   always updated {
       rcode = "updated"
       simulcount = 0
       mpp = no
   }
   # Loaded module rlm_attr_filter
   # Loading module "attr_filter.post-proxy" from file 
/etc/raddb/mods-enabled/attr_filter
   attr_filter attr_filter.post-proxy {
       filename = "/etc/raddb/mods-config/attr_filter/post-proxy"
       key = "%{Realm}"
       relaxed = no
   }
   # Loading module "attr_filter.pre-proxy" from file 
/etc/raddb/mods-enabled/attr_filter
   attr_filter attr_filter.pre-proxy {
       filename = "/etc/raddb/mods-config/attr_filter/pre-proxy"
       key = "%{Realm}"
       relaxed = no
   }
   # Loading module "attr_filter.access_reject" from file 
/etc/raddb/mods-enabled/attr_filter
   attr_filter attr_filter.access_reject {
       filename = "/etc/raddb/mods-config/attr_filter/access_reject"
       key = "%{User-Name}"
       relaxed = no
   }
   # Loading module "attr_filter.access_challenge" from file 
/etc/raddb/mods-enabled/attr_filter
   attr_filter attr_filter.access_challenge {
       filename = "/etc/raddb/mods-config/attr_filter/access_challenge"
       key = "%{User-Name}"
       relaxed = no
   }
   # Loading module "attr_filter.accounting_response" from file 
/etc/raddb/mods-enabled/attr_filter
   attr_filter attr_filter.accounting_response {
       filename = "/etc/raddb/mods-config/attr_filter/accounting_response"
       key = "%{User-Name}"
       relaxed = no
   }
   # Loaded module rlm_cache
   # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap
   cache cache_eap {
       driver = "rlm_cache_rbtree"
       key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
       ttl = 15
       max_entries = 0
       epoch = 0
       add_stats = no
   }
   # Loaded module rlm_chap
   # Loading module "chap" from file /etc/raddb/mods-enabled/chap
   # Loaded module rlm_detail
   # Loading module "detail" from file /etc/raddb/mods-enabled/detail
   detail {
       filename = 
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
       header = "%t"
       permissions = 384
       locking = no
       escape_filenames = no
       log_packet_header = no
   }
   # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log
   detail auth_log {
       filename = 
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
       header = "%t"
       permissions = 384
       locking = no
       escape_filenames = no
       log_packet_header = no
   }
   # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log
   detail reply_log {
       filename = 
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
       header = "%t"
       permissions = 384
       locking = no
       escape_filenames = no
       log_packet_header = no
   }
   # Loading module "pre_proxy_log" from file 
/etc/raddb/mods-enabled/detail.log
   detail pre_proxy_log {
       filename = 
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
       header = "%t"
       permissions = 384
       locking = no
       escape_filenames = no
       log_packet_header = no
   }
   # Loading module "post_proxy_log" from file 
/etc/raddb/mods-enabled/detail.log
   detail post_proxy_log {
       filename = 
"/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
       header = "%t"
       permissions = 384
       locking = no
       escape_filenames = no
       log_packet_header = no
   }
   # Loaded module rlm_dhcp
   # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp
   # Loaded module rlm_digest
   # Loading module "digest" from file /etc/raddb/mods-enabled/digest
   # Loaded module rlm_dynamic_clients
   # Loading module "dynamic_clients" from file 
/etc/raddb/mods-enabled/dynamic_clients
   # Loaded module rlm_eap
   # Loading module "eap" from file /etc/raddb/mods-enabled/eap
   eap {
       default_eap_type = "md5"
       timer_expire = 60
       ignore_unknown_eap_types = no
       cisco_accounting_username_bug = no
       max_sessions = 16384
   }
   # Loaded module rlm_exec
   # Loading module "echo" from file /etc/raddb/mods-enabled/echo
   exec echo {
       wait = yes
       program = "/bin/echo %{User-Name}"
       input_pairs = "request"
       output_pairs = "reply"
       shell_escape = yes
   }
   # Loading module "exec" from file /etc/raddb/mods-enabled/exec
   exec {
       wait = no
       input_pairs = "request"
       shell_escape = yes
       timeout = 10
   }
   # Loaded module rlm_expiration
   # Loading module "expiration" from file 
/etc/raddb/mods-enabled/expiration
   # Loaded module rlm_expr
   # Loading module "expr" from file /etc/raddb/mods-enabled/expr
   expr {
       safe_characters = 
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: 
/Ã¤Ã©Ã¶Ã¼Ã Ã¢Ã¦Ã§Ã¨Ã©ÃªÃ«Ã®Ã¯Ã´Å“Ã¹Ã»Ã¼aÃ¿Ã„Ã‰Ã–ÃœÃŸÃ€Ã‚Ã†Ã‡ÃˆÃ‰ÃŠÃ‹ÃŽÃÃ”Å’Ã™Ã›ÃœÅ¸"
   }
   # Loaded module rlm_files
   # Loading module "files" from file /etc/raddb/mods-enabled/files
   files {
       filename = "/etc/raddb/mods-config/files/authorize"
       acctusersfile = "/etc/raddb/mods-config/files/accounting"
       preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy"
   }
   # Loaded module rlm_linelog
   # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog
   linelog {
       filename = "/var/log/radius/linelog"
       escape_filenames = no
       syslog_severity = "info"
       permissions = 384
       format = "This is a log message for %{User-Name}"
       reference = "messages.%{%{reply:Packet-Type}:-default}"
   }
   # Loading module "log_accounting" from file 
/etc/raddb/mods-enabled/linelog
   linelog log_accounting {
       filename = "/var/log/radius/linelog-accounting"
       escape_filenames = no
       syslog_severity = "info"
       permissions = 384
       format = ""
       reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
   }
   # Loaded module rlm_logintime
   # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime
   logintime {
       minimum_timeout = 60
   }
   # Loaded module rlm_mschap
   # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap
   mschap {
       use_mppe = yes
       require_encryption = no
       require_strong = no
       with_ntdomain_hack = yes
    passchange {
    }
       allow_retry = yes
   }
   # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth
   exec ntlm_auth {
       wait = yes
       program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN 
--username=%{mschap:User-Name} --password=%{User-Password}"
       shell_escape = yes
   }
   # Loaded module rlm_pap
   # Loading module "pap" from file /etc/raddb/mods-enabled/pap
   pap {
       normalise = yes
   }
   # Loaded module rlm_passwd
   # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd
   passwd etc_passwd {
       filename = "/etc/passwd"
       format = "*User-Name:Crypt-Password:"
       delimiter = ":"
       ignore_nislike = no
       ignore_empty = yes
       allow_multiple_keys = no
       hash_size = 100
   }
   # Loaded module rlm_preprocess
   # Loading module "preprocess" from file 
/etc/raddb/mods-enabled/preprocess
   preprocess {
       huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups"
       hints = "/etc/raddb/mods-config/preprocess/hints"
       with_ascend_hack = no
       ascend_channels_per_line = 23
       with_ntdomain_hack = no
       with_specialix_jetstream_hack = no
       with_cisco_vsa_hack = no
       with_alvarion_vsa_hack = no
   }
   # Loaded module rlm_radutmp
   # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp
   radutmp {
       filename = "/var/log/radius/radutmp"
       username = "%{User-Name}"
       case_sensitive = yes
       check_with_nas = yes
       permissions = 384
       caller_id = yes
   }
   # Loaded module rlm_realm
   # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm
   realm IPASS {
       format = "prefix"
       delimiter = "/"
       ignore_default = no
       ignore_null = no
   }
   # Loading module "suffix" from file /etc/raddb/mods-enabled/realm
   realm suffix {
       format = "suffix"
       delimiter = "@"
       ignore_default = no
       ignore_null = no
   }
   # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm
   realm realmpercent {
       format = "suffix"
       delimiter = "%"
       ignore_default = no
       ignore_null = no
   }
   # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm
   realm ntdomain {
       format = "prefix"
       delimiter = "\\"
       ignore_default = no
       ignore_null = no
   }
   # Loaded module rlm_replicate
   # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate
   # Loaded module rlm_soh
   # Loading module "soh" from file /etc/raddb/mods-enabled/soh
   soh {
       dhcp = yes
   }
   # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp
   radutmp sradutmp {
       filename = "/var/log/radius/sradutmp"
       username = "%{User-Name}"
       case_sensitive = yes
       check_with_nas = yes
       permissions = 420
       caller_id = no
   }
   # Loaded module rlm_unix
   # Loading module "unix" from file /etc/raddb/mods-enabled/unix
   unix {
       radwtmp = "/var/log/radius/radwtmp"
   }
Creating attribute Unix-Group
   # Loaded module rlm_unpack
   # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack
   # Loaded module rlm_utf8
   # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8
   # Loaded module rlm_ldap
   # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap
   ldap {
       server = "localhost"
       identity = 
"cn=Manager,uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos"
       password = <<< secret >>>
    sasl {
    }
    user {
        scope = "sub"
        access_positive = yes
     sasl {
     }
    }
    group {
        filter = "(objectClass=posixGroup)"
        scope = "sub"
        name_attribute = "cn"
        membership_attribute = "memberOf"
        cacheable_name = no
        cacheable_dn = no
    }
    client {
        filter = "(objectClass=radiusClient)"
        scope = "sub"
        base_dn = 
"uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos"
    }
    profile {
    }
    options {
        ldap_debug = 40
        chase_referrals = yes
        rebind = yes
        net_timeout = 1
        res_timeout = 10
        srv_timelimit = 3
        idle = 60
        probes = 3
        interval = 3
    }
    tls {
        start_tls = no
    }
   }
Creating attribute LDAP-Group
  instantiate {
  }
  modules {
   # Instantiating module "reject" from file /etc/raddb/mods-enabled/always
   # Instantiating module "fail" from file /etc/raddb/mods-enabled/always
   # Instantiating module "ok" from file /etc/raddb/mods-enabled/always
   # Instantiating module "handled" from file /etc/raddb/mods-enabled/always
   # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always
   # Instantiating module "userlock" from file 
/etc/raddb/mods-enabled/always
   # Instantiating module "notfound" from file 
/etc/raddb/mods-enabled/always
   # Instantiating module "noop" from file /etc/raddb/mods-enabled/always
   # Instantiating module "updated" from file /etc/raddb/mods-enabled/always
   # Instantiating module "attr_filter.post-proxy" from file 
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy
   # Instantiating module "attr_filter.pre-proxy" from file 
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy
   # Instantiating module "attr_filter.access_reject" from file 
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject
[/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item 
"FreeRADIUS-Response-Delay"     found in filter list for realm "DEFAULT".
[/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item 
"FreeRADIUS-Response-Delay-USec"     found in filter list for realm 
"DEFAULT".
   # Instantiating module "attr_filter.access_challenge" from file 
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge
   # Instantiating module "attr_filter.accounting_response" from file 
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response
   # Instantiating module "cache_eap" from file 
/etc/raddb/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) 
loaded and linked
   # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail
   # Instantiating module "auth_log" from file 
/etc/raddb/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in 
detail output
   # Instantiating module "reply_log" from file 
/etc/raddb/mods-enabled/detail.log
   # Instantiating module "pre_proxy_log" from file 
/etc/raddb/mods-enabled/detail.log
   # Instantiating module "post_proxy_log" from file 
/etc/raddb/mods-enabled/detail.log
   # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap
    # Linked to sub-module rlm_eap_md5
    # Linked to sub-module rlm_eap_leap
    # Linked to sub-module rlm_eap_gtc
    gtc {
        challenge = "Password: "
        auth_type = "PAP"
    }
    # Linked to sub-module rlm_eap_tls
    tls {
        tls = "tls-common"
    }
    tls-config tls-common {
        rsa_key_exchange = no
        dh_key_exchange = yes
        rsa_key_length = 512
        dh_key_length = 512
        verify_depth = 0
        ca_path = "/etc/raddb/certs"
        pem_file_type = yes
        private_key_file = "/etc/raddb/certs/server.pem"
        certificate_file = "/etc/raddb/certs/server.pem"
        ca_file = "/etc/raddb/certs/ca.pem"
        private_key_password = <<< secret >>>
        dh_file = "/etc/raddb/certs/dh"
        fragment_size = 1024
        include_length = yes
        check_crl = no
        check_all_crl = no
        cipher_list = "DEFAULT"
        ecdh_curve = "prime256v1"
     cache {
         enable = yes
         lifetime = 24
         max_entries = 255
     }
     verify {
     }
     ocsp {
         enable = no
         override_cert_url = yes
         url = "http://127.0.0.1/ocsp/"
         use_nonce = yes
         timeout = 0
         softfail = no
     }
    }
    # Linked to sub-module rlm_eap_ttls
    ttls {
        tls = "tls-common"
        default_eap_type = "md5"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        virtual_server = "inner-tunnel"
        include_length = yes
        require_client_cert = no
    }
tls: Using cached TLS configuration from previous invocation
    # Linked to sub-module rlm_eap_peap
    peap {
        tls = "tls-common"
        default_eap_type = "mschapv2"
        copy_request_to_tunnel = yes
        use_tunneled_reply = yes
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        soh = no
        require_client_cert = no
    }
tls: Using cached TLS configuration from previous invocation
    # Linked to sub-module rlm_eap_mschapv2
    mschapv2 {
        with_ntdomain_hack = no
        send_error = no
    }
   # Instantiating module "expiration" from file 
/etc/raddb/mods-enabled/expiration
   # Instantiating module "files" from file /etc/raddb/mods-enabled/files
reading pairlist file /etc/raddb/mods-config/files/authorize
reading pairlist file /etc/raddb/mods-config/files/accounting
reading pairlist file /etc/raddb/mods-config/files/pre-proxy
   # Instantiating module "linelog" from file 
/etc/raddb/mods-enabled/linelog
   # Instantiating module "log_accounting" from file 
/etc/raddb/mods-enabled/linelog
   # Instantiating module "logintime" from file 
/etc/raddb/mods-enabled/logintime
   # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap
rlm_mschap (mschap): using internal authentication
   # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap
   # Instantiating module "etc_passwd" from file 
/etc/raddb/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
   # Instantiating module "preprocess" from file 
/etc/raddb/mods-enabled/preprocess
reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /etc/raddb/mods-config/preprocess/hints
   # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm
   # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm
   # Instantiating module "realmpercent" from file 
/etc/raddb/mods-enabled/realm
   # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm
   # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20440
    accounting {
        reference = "%{tolower:type.%{Acct-Status-Type}}"
    }
    post-auth {
        reference = "."
    }
rlm_ldap (ldap): Initialising connection pool
    pool {
        start = 5
        min = 3
        max = 32
        spare = 10
        uses = 0
        lifetime = 0
        cleanup_interval = 30
        idle_timeout = 60
        retry_delay = 30
        spread = no
    }
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending 
slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending 
slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending 
slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending 
slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending 
slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
  } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/raddb/radiusd.conf
} # server
server default { # from file /etc/raddb/sites-enabled/default
  # Loading authenticate {...}
  # Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
  # Loading preacct {...}
  # Loading accounting {...}
  # Loading post-proxy {...}
  # Loading post-auth {...}
} # server default
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
  # Loading authenticate {...}
  # Loading authorize {...}
  # Loading session {...}
  # Loading pre-proxy {...}
  # Loading post-proxy {...}
  # Loading post-auth {...}
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
       type = "auth"
       ipaddr = *
       port = 0
    limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
    }
}
listen {
       type = "acct"
       ipaddr = *
       port = 0
    limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
    }
}
listen {
       type = "auth"
       ipv6addr = ::
       port = 0
    limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
    }
}
listen {
       type = "acct"
       ipv6addr = ::
       port = 0
    limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
    }
}
listen {
       type = "auth"
       ipaddr = 127.0.0.1
       port = 18120
}
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 35699
Listening on proxy address :: port 44518
Ready to process requests
(0) Received Access-Request Id 43 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 247
(0)   User-Name = "test@networks.com"
(0)   NAS-IP-Address = 127.0.0.1
(0)   NAS-Identifier = "ap.example.com"
(0)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(0)   NAS-Port-Type = Wireless-802.11
(0)   NAS-Port = 0
(0)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(0)   Connect-Info = "CONNECT 0Mbps 802.11b"
(0)   Acct-Session-Id = "57B6BC2F-0000000D"
(0)   Framed-MTU = 1400
(0)   EAP-Message = 0x02b0001a01746573744062796f2d6e6574776f726b732e636f6d
(0)   Message-Authenticator = 0x4fdc92648eb97a3542cd72db55e279a6
(0)   Event-Timestamp = "Aug 29 2016 15:02:38 CEST"
(0)   Proxy-State = 0x323435
(0)   NET-NodeID = "ndid-00000001"
(0)   Proxy-State = 0x313532
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (!&User-Name) {
(0)       if (!&User-Name)  -> FALSE
(0)       if (&User-Name =~ / /) {
(0)       if (&User-Name =~ / /)  -> FALSE
(0)       if (&User-Name =~ /@.*@/ ) {
(0)       if (&User-Name =~ /@.*@/ )  -> FALSE
(0)       if (&User-Name =~ /\.\./ ) {
(0)       if (&User-Name =~ /\.\./ )  -> FALSE
(0)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(0)       if (&User-Name =~ /\.$/)  {
(0)       if (&User-Name =~ /\.$/)   -> FALSE
(0)       if (&User-Name =~ /@\./)  {
(0)       if (&User-Name =~ /@\./)   -> FALSE
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(0) suffix: No such realm "networks.com"
(0)     [suffix] = noop
(0) eap: Peer sent EAP Response (code 2) ID 176 length 26
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the 
rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_md5 to process data
(0) eap_md5: Issuing MD5 Challenge
(0) eap: Sending EAP Request (code 1) ID 177 length 22
(0) eap: EAP session adding &reply:State = 0x371139a637a03deb
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found.  Ignoring.
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) Sent Access-Challenge Id 43 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(0)   EAP-Message = 0x01b1001604104bc0dfc03ce08c315d92502a27ac7646
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0x371139a637a03deb21d5bd1c31ccd110
(0)   Proxy-State = 0x323435
(0)   Proxy-State = 0x313532
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 137 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 244
(1)   User-Name = "test@networks.com"
(1)   NAS-IP-Address = 127.0.0.1
(1)   NAS-Identifier = "ap.example.com"
(1)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(1)   NAS-Port-Type = Wireless-802.11
(1)   NAS-Port = 0
(1)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(1)   Connect-Info = "CONNECT 0Mbps 802.11b"
(1)   Acct-Session-Id = "57B6BC2F-0000000D"
(1)   Framed-MTU = 1400
(1)   EAP-Message = 0x02b100060319
(1)   State = 0x371139a637a03deb21d5bd1c31ccd110
(1)   Message-Authenticator = 0x1374fdc6a4a2bf94c7be641022790462
(1)   Event-Timestamp = "Aug 29 2016 15:02:38 CEST"
(1)   Proxy-State = 0x323436
(1)   NET-NodeID = "ndid-00000001"
(1)   Proxy-State = 0x3733
(1) session-state: No cached attributes
(1) # Executing section authorize from file /etc/raddb/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (!&User-Name) {
(1)       if (!&User-Name)  -> FALSE
(1)       if (&User-Name =~ / /) {
(1)       if (&User-Name =~ / /)  -> FALSE
(1)       if (&User-Name =~ /@.*@/ ) {
(1)       if (&User-Name =~ /@.*@/ )  -> FALSE
(1)       if (&User-Name =~ /\.\./ ) {
(1)       if (&User-Name =~ /\.\./ )  -> FALSE
(1)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(1)       if (&User-Name =~ /\.$/)  {
(1)       if (&User-Name =~ /\.$/)   -> FALSE
(1)       if (&User-Name =~ /@\./)  {
(1)       if (&User-Name =~ /@\./)   -> FALSE
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(1) suffix: No such realm "networks.com"
(1)     [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 177 length 6
(1) eap: No EAP Start, assuming it's an on-going EAP conversation
(1)     [eap] = updated
(1)     [files] = noop
rlm_ldap (ldap): Reserved connection (0)
(1) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(1) ldap:    --> (uid=test@networks.com)
(1) ldap: Performing search in 
"uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos" with 
filter "(uid=test@networks.com)", scope "sub"
(1) ldap: Waiting for search result...
(1) ldap: Search returned no results
rlm_ldap (ldap): Released connection (0)
rlm_ldap (ldap): Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending 
slots used
rlm_ldap (ldap): Connecting to ldap://localhost:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(1)     [ldap] = notfound
(1)     [expiration] = noop
(1)     [logintime] = noop
(1) pap: WARNING: No "known good" password found for the user.  Not 
setting Auth-Type
(1) pap: WARNING: Authentication will fail unless a "known good" 
password is available
(1)     [pap] = noop
(1)   } # authorize = updated
(1) Found Auth-Type = EAP
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0x371139a637a03deb
(1) eap: Finished EAP session with state 0x371139a637a03deb
(1) eap: Previous EAP request found for state 0x371139a637a03deb, 
released from the list
(1) eap: Peer sent packet with method EAP NAK (3)
(1) eap: Found mutually acceptable type PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Initiating new EAP-TLS session
(1) eap_peap: Flushing SSL sessions (of #0)
(1) eap_peap: [eaptls start] = request
(1) eap: Sending EAP Request (code 1) ID 178 length 6
(1) eap: EAP session adding &reply:State = 0x371139a636a320eb
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found.  Ignoring.
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1) Sent Access-Challenge Id 137 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(1)   EAP-Message = 0x01b200061920
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0x371139a636a320eb21d5bd1c31ccd110
(1)   Proxy-State = 0x323436
(1)   Proxy-State = 0x3733
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 174 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 536
(2)   User-Name = "test@networks.com"
(2)   NAS-IP-Address = 127.0.0.1
(2)   NAS-Identifier = "ap.example.com"
(2)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(2)   NAS-Port-Type = Wireless-802.11
(2)   NAS-Port = 0
(2)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(2)   Connect-Info = "CONNECT 0Mbps 802.11b"
(2)   Acct-Session-Id = "57B6BC2F-0000000D"
(2)   Framed-MTU = 1400
(2)   EAP-Message = 
0x02b2012719800000011d1603010118010001140303086d3e45de9495047ce3f0f8d54f321ddfac7b35faaadfcd70c70192c37bb4790000acc030c02cc028c024c014c00a00a500a300a1009f006b006a0069006800390038003700360088008700860085c032c02ec02ac026c00fc005009d003d003500
(2)   State = 0x371139a636a320eb21d5bd1c31ccd110
(2)   Message-Authenticator = 0xe262d277d05ab21413f28aec76deb023
(2)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(2)   Proxy-State = 0x323437
(2)   NET-NodeID = "ndid-00000001"
(2)   Proxy-State = 0x313539
(2) session-state: No cached attributes
(2) # Executing section authorize from file /etc/raddb/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (!&User-Name) {
(2)       if (!&User-Name)  -> FALSE
(2)       if (&User-Name =~ / /) {
(2)       if (&User-Name =~ / /)  -> FALSE
(2)       if (&User-Name =~ /@.*@/ ) {
(2)       if (&User-Name =~ /@.*@/ )  -> FALSE
(2)       if (&User-Name =~ /\.\./ ) {
(2)       if (&User-Name =~ /\.\./ )  -> FALSE
(2)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(2)       if (&User-Name =~ /\.$/)  {
(2)       if (&User-Name =~ /\.$/)   -> FALSE
(2)       if (&User-Name =~ /@\./)  {
(2)       if (&User-Name =~ /@\./)   -> FALSE
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(2) suffix: No such realm "networks.com"
(2)     [suffix] = noop
(2) eap: Peer sent EAP Response (code 2) ID 178 length 295
(2) eap: Continuing tunnel setup
(2)     [eap] = ok
(2)   } # authorize = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0x371139a636a320eb
(2) eap: Finished EAP session with state 0x371139a636a320eb
(2) eap: Previous EAP request found for state 0x371139a636a320eb, 
released from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: Continuing EAP-TLS
(2) eap_peap: Peer indicated complete TLS record size will be 285 bytes
(2) eap_peap: Got complete TLS record (285 bytes)
(2) eap_peap: [eaptls verify] = length included
(2) eap_peap: (other): before/accept initialization
(2) eap_peap: TLS_accept: before/accept initialization
(2) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(2) eap_peap: <<< TLS 1.2  [length 0118]
(2) eap_peap: TLS_accept: SSLv3 read client hello A
(2) eap_peap: >>> UNKNOWN TLS VERSION ?0000? [length 0005]
(2) eap_peap: >>> TLS 1.2  [length 005e]
(2) eap_peap: TLS_accept: SSLv3 write server hello A
(2) eap_peap: >>> UNKNOWN TLS VERSION ?0000? [length 0005]
(2) eap_peap: >>> TLS 1.2  [length 08d3]
(2) eap_peap: TLS_accept: SSLv3 write certificate A
(2) eap_peap: >>> UNKNOWN TLS VERSION ?0000? [length 0005]
(2) eap_peap: >>> TLS 1.2  [length 014d]
(2) eap_peap: TLS_accept: SSLv3 write key exchange A
(2) eap_peap: >>> UNKNOWN TLS VERSION ?0000? [length 0005]
(2) eap_peap: >>> TLS 1.2  [length 0004]
(2) eap_peap: TLS_accept: SSLv3 write server done A
(2) eap_peap: TLS_accept: SSLv3 flush data
(2) eap_peap: TLS_accept: SSLv3 read client certificate A
(2) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key 
exchange A
(2) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key 
exchange A
(2) eap_peap: In SSL Handshake Phase
(2) eap_peap: In SSL Accept mode
(2) eap_peap: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 179 length 1004
(2) eap: EAP session adding &reply:State = 0x371139a635a220eb
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) Post-Auth-Type sub-section not found.  Ignoring.
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2) Sent Access-Challenge Id 174 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(2)   EAP-Message = 
0x01b303ec19c000000a96160303005e0200005a0303e9f2047fc1d1511f1210e6f60a5946326e7c424ffc3efa55bde9969661ca4994204a4f1a6a018245aee98f951647d5735f8bece0eed8c3f534571b6bd3cd05c9f0c030000012ff01000100000b000403000102000f00010116030308d30b0008cf00
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0x371139a635a220eb21d5bd1c31ccd110
(2)   Proxy-State = 0x323437
(2)   Proxy-State = 0x313539
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 53 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 245
(3)   User-Name = "test@networks.com"
(3)   NAS-IP-Address = 127.0.0.1
(3)   NAS-Identifier = "ap.example.com"
(3)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(3)   NAS-Port-Type = Wireless-802.11
(3)   NAS-Port = 0
(3)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(3)   Connect-Info = "CONNECT 0Mbps 802.11b"
(3)   Acct-Session-Id = "57B6BC2F-0000000D"
(3)   Framed-MTU = 1400
(3)   EAP-Message = 0x02b300061900
(3)   State = 0x371139a635a220eb21d5bd1c31ccd110
(3)   Message-Authenticator = 0x48bf958304fca9ed2620c5a65d5cf9a3
(3)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(3)   Proxy-State = 0x323438
(3)   NET-NodeID = "ndid-00000001"
(3)   Proxy-State = 0x313832
(3) session-state: No cached attributes
(3) # Executing section authorize from file /etc/raddb/sites-enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (!&User-Name) {
(3)       if (!&User-Name)  -> FALSE
(3)       if (&User-Name =~ / /) {
(3)       if (&User-Name =~ / /)  -> FALSE
(3)       if (&User-Name =~ /@.*@/ ) {
(3)       if (&User-Name =~ /@.*@/ )  -> FALSE
(3)       if (&User-Name =~ /\.\./ ) {
(3)       if (&User-Name =~ /\.\./ )  -> FALSE
(3)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(3)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(3)       if (&User-Name =~ /\.$/)  {
(3)       if (&User-Name =~ /\.$/)   -> FALSE
(3)       if (&User-Name =~ /@\./)  {
(3)       if (&User-Name =~ /@\./)   -> FALSE
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(3) suffix: No such realm "networks.com"
(3)     [suffix] = noop
(3) eap: Peer sent EAP Response (code 2) ID 179 length 6
(3) eap: Continuing tunnel setup
(3)     [eap] = ok
(3)   } # authorize = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0x371139a635a220eb
(3) eap: Finished EAP session with state 0x371139a635a220eb
(3) eap: Previous EAP request found for state 0x371139a635a220eb, 
released from the list
(3) eap: Peer sent packet with method EAP PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: Continuing EAP-TLS
(3) eap_peap: Peer ACKed our handshake fragment
(3) eap_peap: [eaptls verify] = request
(3) eap_peap: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 180 length 1000
(3) eap: EAP session adding &reply:State = 0x371139a634a520eb
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) Post-Auth-Type sub-section not found.  Ignoring.
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3) Sent Access-Challenge Id 53 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(3)   EAP-Message = 
0x01b403e819406e2c60847a14529a5f98e7f1bf52f2d26ec514453677352a8d68a5302b0361fe4a7e16c5647984b3f69dc5a2f30d1de20669ed19427408514d9cc5c87907b21503e44e9b8f8fdb08c2b76a59168ae1e46613f67abfac342e29b19c095fd044a369df5742aff224c7ec2c19d1ebaa0004e8
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0x371139a634a520eb21d5bd1c31ccd110
(3)   Proxy-State = 0x323438
(3)   Proxy-State = 0x313832
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 25 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 244
(4)   User-Name = "test@networks.com"
(4)   NAS-IP-Address = 127.0.0.1
(4)   NAS-Identifier = "ap.example.com"
(4)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(4)   NAS-Port-Type = Wireless-802.11
(4)   NAS-Port = 0
(4)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(4)   Connect-Info = "CONNECT 0Mbps 802.11b"
(4)   Acct-Session-Id = "57B6BC2F-0000000D"
(4)   Framed-MTU = 1400
(4)   EAP-Message = 0x02b400061900
(4)   State = 0x371139a634a520eb21d5bd1c31ccd110
(4)   Message-Authenticator = 0xa6232bab1566a1702867526c16e026d0
(4)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(4)   Proxy-State = 0x323439
(4)   NET-NodeID = "ndid-00000001"
(4)   Proxy-State = 0x3533
(4) session-state: No cached attributes
(4) # Executing section authorize from file /etc/raddb/sites-enabled/default
(4)   authorize {
(4)     policy filter_username {
(4)       if (!&User-Name) {
(4)       if (!&User-Name)  -> FALSE
(4)       if (&User-Name =~ / /) {
(4)       if (&User-Name =~ / /)  -> FALSE
(4)       if (&User-Name =~ /@.*@/ ) {
(4)       if (&User-Name =~ /@.*@/ )  -> FALSE
(4)       if (&User-Name =~ /\.\./ ) {
(4)       if (&User-Name =~ /\.\./ )  -> FALSE
(4)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(4)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(4)       if (&User-Name =~ /\.$/)  {
(4)       if (&User-Name =~ /\.$/)   -> FALSE
(4)       if (&User-Name =~ /@\./)  {
(4)       if (&User-Name =~ /@\./)   -> FALSE
(4)     } # policy filter_username = notfound
(4)     [preprocess] = ok
(4)     [chap] = noop
(4)     [mschap] = noop
(4)     [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(4) suffix: No such realm "networks.com"
(4)     [suffix] = noop
(4) eap: Peer sent EAP Response (code 2) ID 180 length 6
(4) eap: Continuing tunnel setup
(4)     [eap] = ok
(4)   } # authorize = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /etc/raddb/sites-enabled/default
(4)   authenticate {
(4) eap: Expiring EAP session with state 0x371139a634a520eb
(4) eap: Finished EAP session with state 0x371139a634a520eb
(4) eap: Previous EAP request found for state 0x371139a634a520eb, 
released from the list
(4) eap: Peer sent packet with method EAP PEAP (25)
(4) eap: Calling submodule eap_peap to process data
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: Peer ACKed our handshake fragment
(4) eap_peap: [eaptls verify] = request
(4) eap_peap: [eaptls process] = handled
(4) eap: Sending EAP Request (code 1) ID 181 length 728
(4) eap: EAP session adding &reply:State = 0x371139a633a420eb
(4)     [eap] = handled
(4)   } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) Post-Auth-Type sub-section not found.  Ignoring.
(4) # Executing group from file /etc/raddb/sites-enabled/default
(4) Sent Access-Challenge Id 25 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(4)   EAP-Message = 
0x01b502d81900696361746520417574686f72697479820900c80c6a04cc34a5b8300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b05
(4)   Message-Authenticator = 0x00000000000000000000000000000000
(4)   State = 0x371139a633a420eb21d5bd1c31ccd110
(4)   Proxy-State = 0x323439
(4)   Proxy-State = 0x3533
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 38 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 375
(5)   User-Name = "test@networks.com"
(5)   NAS-IP-Address = 127.0.0.1
(5)   NAS-Identifier = "ap.example.com"
(5)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(5)   NAS-Port-Type = Wireless-802.11
(5)   NAS-Port = 0
(5)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(5)   Connect-Info = "CONNECT 0Mbps 802.11b"
(5)   Acct-Session-Id = "57B6BC2F-0000000D"
(5)   Framed-MTU = 1400
(5)   EAP-Message = 
0x02b5008819800000007e160303004610000042410431128ddc0356f86957851dd707c12ae192bdb88c6f512e5df0d071f3adadecc08b794c4f9e42dfbdfdf21316e4e159f05f8a6903da041953efe7c2bad4c1b577140303000101160303002854efea8e9a013206156eba355d78173519a815b97239f4
(5)   State = 0x371139a633a420eb21d5bd1c31ccd110
(5)   Message-Authenticator = 0x8665063fa72577a8661f55fc08225a51
(5)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(5)   Proxy-State = 0x323530
(5)   NET-NodeID = "ndid-00000001"
(5)   Proxy-State = 0x323130
(5) session-state: No cached attributes
(5) # Executing section authorize from file /etc/raddb/sites-enabled/default
(5)   authorize {
(5)     policy filter_username {
(5)       if (!&User-Name) {
(5)       if (!&User-Name)  -> FALSE
(5)       if (&User-Name =~ / /) {
(5)       if (&User-Name =~ / /)  -> FALSE
(5)       if (&User-Name =~ /@.*@/ ) {
(5)       if (&User-Name =~ /@.*@/ )  -> FALSE
(5)       if (&User-Name =~ /\.\./ ) {
(5)       if (&User-Name =~ /\.\./ )  -> FALSE
(5)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(5)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(5)       if (&User-Name =~ /\.$/)  {
(5)       if (&User-Name =~ /\.$/)   -> FALSE
(5)       if (&User-Name =~ /@\./)  {
(5)       if (&User-Name =~ /@\./)   -> FALSE
(5)     } # policy filter_username = notfound
(5)     [preprocess] = ok
(5)     [chap] = noop
(5)     [mschap] = noop
(5)     [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(5) suffix: No such realm "networks.com"
(5)     [suffix] = noop
(5) eap: Peer sent EAP Response (code 2) ID 181 length 136
(5) eap: Continuing tunnel setup
(5)     [eap] = ok
(5)   } # authorize = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5)   authenticate {
(5) eap: Expiring EAP session with state 0x371139a633a420eb
(5) eap: Finished EAP session with state 0x371139a633a420eb
(5) eap: Previous EAP request found for state 0x371139a633a420eb, 
released from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: Continuing EAP-TLS
(5) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(5) eap_peap: Got complete TLS record (126 bytes)
(5) eap_peap: [eaptls verify] = length included
(5) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(5) eap_peap: <<< TLS 1.2  [length 0046]
(5) eap_peap: TLS_accept: SSLv3 read client key exchange A
(5) eap_peap: TLS_accept: SSLv3 read certificate verify A
(5) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(5) eap_peap: <<< TLS 1.2  [length 0001]
(5) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(5) eap_peap: <<< TLS 1.2  [length 0010]
(5) eap_peap: TLS_accept: SSLv3 read finished A
(5) eap_peap: >>> UNKNOWN TLS VERSION ?0000? [length 0005]
(5) eap_peap: >>> TLS 1.2  [length 0001]
(5) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(5) eap_peap: >>> UNKNOWN TLS VERSION ?0000? [length 0005]
(5) eap_peap: >>> TLS 1.2  [length 0010]
(5) eap_peap: TLS_accept: SSLv3 write finished A
(5) eap_peap: TLS_accept: SSLv3 flush data
(5) eap_peap: (other): SSL negotiation finished successfully
(5) eap_peap: SSL Connection Established
(5) eap_peap: [eaptls process] = handled
(5) eap: Sending EAP Request (code 1) ID 182 length 57
(5) eap: EAP session adding &reply:State = 0x371139a632a720eb
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found.  Ignoring.
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) Sent Access-Challenge Id 38 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(5)   EAP-Message = 
0x01b600391900140303000101160303002819fa6702ec138e0a9a606384fbfb9ec3cb1a750ecb37253538c30cf0cdbf318f1fef12143c7dc0d4
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0x371139a632a720eb21d5bd1c31ccd110
(5)   Proxy-State = 0x323530
(5)   Proxy-State = 0x323130
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 195 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 244
(6)   User-Name = "test@networks.com"
(6)   NAS-IP-Address = 127.0.0.1
(6)   NAS-Identifier = "ap.example.com"
(6)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(6)   NAS-Port-Type = Wireless-802.11
(6)   NAS-Port = 0
(6)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(6)   Connect-Info = "CONNECT 0Mbps 802.11b"
(6)   Acct-Session-Id = "57B6BC2F-0000000D"
(6)   Framed-MTU = 1400
(6)   EAP-Message = 0x02b600061900
(6)   State = 0x371139a632a720eb21d5bd1c31ccd110
(6)   Message-Authenticator = 0xdd66cb234b303e480fc827583315c38b
(6)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(6)   Proxy-State = 0x323531
(6)   NET-NodeID = "ndid-00000001"
(6)   Proxy-State = 0x3539
(6) session-state: No cached attributes
(6) # Executing section authorize from file /etc/raddb/sites-enabled/default
(6)   authorize {
(6)     policy filter_username {
(6)       if (!&User-Name) {
(6)       if (!&User-Name)  -> FALSE
(6)       if (&User-Name =~ / /) {
(6)       if (&User-Name =~ / /)  -> FALSE
(6)       if (&User-Name =~ /@.*@/ ) {
(6)       if (&User-Name =~ /@.*@/ )  -> FALSE
(6)       if (&User-Name =~ /\.\./ ) {
(6)       if (&User-Name =~ /\.\./ )  -> FALSE
(6)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(6)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(6)       if (&User-Name =~ /\.$/)  {
(6)       if (&User-Name =~ /\.$/)   -> FALSE
(6)       if (&User-Name =~ /@\./)  {
(6)       if (&User-Name =~ /@\./)   -> FALSE
(6)     } # policy filter_username = notfound
(6)     [preprocess] = ok
(6)     [chap] = noop
(6)     [mschap] = noop
(6)     [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(6) suffix: No such realm "networks.com"
(6)     [suffix] = noop
(6) eap: Peer sent EAP Response (code 2) ID 182 length 6
(6) eap: Continuing tunnel setup
(6)     [eap] = ok
(6)   } # authorize = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /etc/raddb/sites-enabled/default
(6)   authenticate {
(6) eap: Expiring EAP session with state 0x371139a632a720eb
(6) eap: Finished EAP session with state 0x371139a632a720eb
(6) eap: Previous EAP request found for state 0x371139a632a720eb, 
released from the list
(6) eap: Peer sent packet with method EAP PEAP (25)
(6) eap: Calling submodule eap_peap to process data
(6) eap_peap: Continuing EAP-TLS
(6) eap_peap: Peer ACKed our handshake fragment.  handshake is finished
(6) eap_peap: [eaptls verify] = success
(6) eap_peap: [eaptls process] = success
(6) eap_peap: Session established.  Decoding tunneled attributes
(6) eap_peap: PEAP state TUNNEL ESTABLISHED
...
...
...
UNKNOWN TLS VERSION ?0000? [length 0005]
(6) eap: Sending EAP Request (code 1) ID 183 length 40
(6) eap: EAP session adding &reply:State = 0x371139a631a620eb
(6)     [eap] = handled
(6)   } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) Post-Auth-Type sub-section not found.  Ignoring.
(6) # Executing group from file /etc/raddb/sites-enabled/default
(6) Sent Access-Challenge Id 195 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(6)   EAP-Message = 
0x01b700281900170303001d19fa6702ec138e0bb9f262622d3d9a141016bf6ee3d8daf5f342063546
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0x371139a631a620eb21d5bd1c31ccd110
(6)   Proxy-State = 0x323531
(6)   Proxy-State = 0x3539
(6) Finished request
Waking up in 4.9 seconds.
(7) Received Access-Request Id 30 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 295
(7)   User-Name = "test@networks.com"
(7)   NAS-IP-Address = 127.0.0.1
(7)   NAS-Identifier = "ap.example.com"
(7)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(7)   NAS-Port-Type = Wireless-802.11
(7)   NAS-Port = 0
(7)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(7)   Connect-Info = "CONNECT 0Mbps 802.11b"
(7)   Acct-Session-Id = "57B6BC2F-0000000D"
(7)   Framed-MTU = 1400
(7)   EAP-Message = 
0x02b700391900170303002e54efea8e9a0132076a14efcd33bdaaa1bbff803a76a7edec72f39edaf5f5f67924ecb9986b483ce633497804d9c5
(7)   State = 0x371139a631a620eb21d5bd1c31ccd110
(7)   Message-Authenticator = 0x080b56e9357686067f801e708ecc3fed
(7)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(7)   Proxy-State = 0x323532
(7)   NET-NodeID = "ndid-00000001"
(7)   Proxy-State = 0x3434
(7) session-state: No cached attributes
(7) # Executing section authorize from file /etc/raddb/sites-enabled/default
(7)   authorize {
(7)     policy filter_username {
(7)       if (!&User-Name) {
(7)       if (!&User-Name)  -> FALSE
(7)       if (&User-Name =~ / /) {
(7)       if (&User-Name =~ / /)  -> FALSE
(7)       if (&User-Name =~ /@.*@/ ) {
(7)       if (&User-Name =~ /@.*@/ )  -> FALSE
(7)       if (&User-Name =~ /\.\./ ) {
(7)       if (&User-Name =~ /\.\./ )  -> FALSE
(7)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(7)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(7)       if (&User-Name =~ /\.$/)  {
(7)       if (&User-Name =~ /\.$/)   -> FALSE
(7)       if (&User-Name =~ /@\./)  {
(7)       if (&User-Name =~ /@\./)   -> FALSE
(7)     } # policy filter_username = notfound
(7)     [preprocess] = ok
(7)     [chap] = noop
(7)     [mschap] = noop
(7)     [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(7) suffix: No such realm "networks.com"
(7)     [suffix] = noop
(7) eap: Peer sent EAP Response (code 2) ID 183 length 57
(7) eap: Continuing tunnel setup
(7)     [eap] = ok
(7)   } # authorize = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /etc/raddb/sites-enabled/default
(7)   authenticate {
(7) eap: Expiring EAP session with state 0x371139a631a620eb
(7) eap: Finished EAP session with state 0x371139a631a620eb
(7) eap: Previous EAP request found for state 0x371139a631a620eb, 
released from the list
(7) eap: Peer sent packet with method EAP PEAP (25)
(7) eap: Calling submodule eap_peap to process data
(7) eap_peap: Continuing EAP-TLS
(7) eap_peap: [eaptls verify] = ok
(7) eap_peap: Done initial handshake
(7) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(7) eap_peap: [eaptls process] = ok
(7) eap_peap: Session established.  Decoding tunneled attributes
(7) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(7) eap_peap: Identity - test@networks.com
(7) eap_peap: Got inner identity 'test@networks.com'
(7) eap_peap: Setting default EAP type for tunneled EAP session
(7) eap_peap: Got tunneled request
(7) eap_peap:   EAP-Message = 
0x02b7001a01746573744062796f2d6e6574776f726b732e636f6d
(7) eap_peap: Setting User-Name to test@networks.com
(7) eap_peap: Sending tunneled request to inner-tunnel
(7) eap_peap:   EAP-Message = 
0x02b7001a01746573744062796f2d6e6574776f726b732e636f6d
(7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(7) eap_peap:   User-Name = "test@networks.com"
(7) eap_peap:   NAS-IP-Address = 127.0.0.1
(7) eap_peap:   NAS-Identifier = "ap.example.com"
(7) eap_peap:   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(7) eap_peap:   NAS-Port-Type = Wireless-802.11
(7) eap_peap:   NAS-Port = 0
(7) eap_peap:   Calling-Station-Id = "2A-72-E8-47-76-FE"
(7) eap_peap:   Connect-Info = "CONNECT 0Mbps 802.11b"
(7) eap_peap:   Acct-Session-Id = "57B6BC2F-0000000D"
(7) eap_peap:   Framed-MTU = 1400
(7) eap_peap:   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(7) Virtual server inner-tunnel received request
(7)   EAP-Message = 0x02b7001a01746573744062796f2d6e6574776f726b732e636f6d
(7)   FreeRADIUS-Proxied-To = 127.0.0.1
(7)   User-Name = "test@networks.com"
(7)   NAS-IP-Address = 127.0.0.1
(7)   NAS-Identifier = "ap.example.com"
(7)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(7)   NAS-Port-Type = Wireless-802.11
(7)   NAS-Port = 0
(7)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(7)   Connect-Info = "CONNECT 0Mbps 802.11b"
(7)   Acct-Session-Id = "57B6BC2F-0000000D"
(7)   Framed-MTU = 1400
(7)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(7) server inner-tunnel {
(7)   # Executing section authorize from file 
/etc/raddb/sites-enabled/inner-tunnel
(7)     authorize {
(7)       policy split_username_nai {
(7)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(7)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(7)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(7)           update request {
(7)             EXPAND %{1}
(7)                --> test
(7)             &Stripped-User-Name := test
(7)             EXPAND %{3}
(7)                --> networks.com
(7)             &Stripped-User-Domain = networks.com
(7)           } # update request = noop
(7)           [updated] = updated
(7)         } # if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(7)         ... skipping else for request 7: Preceding "if" was taken
(7)       } # policy split_username_nai = updated
(7)       [chap] = noop
(7)       [mschap] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: No '@' in User-Name = "test", looking up realm NULL
(7) suffix: No such realm "NULL"
(7)       [suffix] = noop
(7)       update control {
(7)         &Proxy-To-Realm := LOCAL
(7)       } # update control = noop
(7) eap: Peer sent EAP Response (code 2) ID 183 length 26
(7) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the 
rest of authorize
(7)       [eap] = ok
(7)     } # authorize = ok
(7)   Found Auth-Type = EAP
(7)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(7)     authenticate {
(7) eap: Peer sent packet with method EAP Identity (1)
(7) eap: Calling submodule eap_mschapv2 to process data
(7) eap_mschapv2: Issuing Challenge
(7) eap: Sending EAP Request (code 1) ID 184 length 43
(7) eap: EAP session adding &reply:State = 0x6acaf5586a72ef8f
(7)       [eap] = handled
(7)     } # authenticate = handled
(7) } # server inner-tunnel
(7) Virtual server sending reply
(7)   EAP-Message = 
0x01b8002b1a01b80026105bfb592d949a07337487f04e29ae52d6667265657261646975732d332e302e3130
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x6acaf5586a72ef8f5a9065fc047e5dca
(7) eap_peap: Got tunneled reply code 11
(7) eap_peap:   EAP-Message = 
0x01b8002b1a01b80026105bfb592d949a07337487f04e29ae52d6667265657261646975732d332e302e3130
(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap:   State = 0x6acaf5586a72ef8f5a9065fc047e5dca
(7) eap_peap: Got tunneled reply RADIUS code 11
(7) eap_peap:   EAP-Message = 
0x01b8002b1a01b80026105bfb592d949a07337487f04e29ae52d6667265657261646975732d332e302e3130
(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap:   State = 0x6acaf5586a72ef8f5a9065fc047e5dca
(7) eap_peap: Got tunneled Access-Challenge
UNKNOWN TLS VERSION ?0000? [length 0005]
(7) eap: Sending EAP Request (code 1) ID 184 length 74
(7) eap: EAP session adding &reply:State = 0x371139a630a920eb
(7)     [eap] = handled
(7)   } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) Post-Auth-Type sub-section not found.  Ignoring.
(7) # Executing group from file /etc/raddb/sites-enabled/default
(7) Sent Access-Challenge Id 30 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(7)   EAP-Message = 
0x01b8004a1900170303003f19fa6702ec138e0c536800d9d5ced7bd70afb619033c72af968647d5307fc71f005af6cd9215d9bed609acf02f8fdaf77a0a3dfabe2e6aee80a6ae98bee09e
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x371139a630a920eb21d5bd1c31ccd110
(7)   Proxy-State = 0x323532
(7)   Proxy-State = 0x3434
(7) Finished request
Waking up in 4.9 seconds.
(8) Received Access-Request Id 160 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 350
(8)   User-Name = "test@networks.com"
(8)   NAS-IP-Address = 127.0.0.1
(8)   NAS-Identifier = "ap.example.com"
(8)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(8)   NAS-Port-Type = Wireless-802.11
(8)   NAS-Port = 0
(8)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(8)   Connect-Info = "CONNECT 0Mbps 802.11b"
(8)   Acct-Session-Id = "57B6BC2F-0000000D"
(8)   Framed-MTU = 1400
(8)   EAP-Message = 
0x02b8006f1900170303006454efea8e9a013208355dff9768cc5d8e739f25705b7908f290d247df2b9ac39661bbc4a139775a32a685b2089e2b3eeed5f9fd5d4ebab3ca9f3b3d2488df364b63f752d275b0d8f9fd93187bfed1fa6aa834f3af579332a2f5a250037e116beecf3dea07
(8)   State = 0x371139a630a920eb21d5bd1c31ccd110
(8)   Message-Authenticator = 0x4d68c50f8a015c5d7d59694445580188
(8)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(8)   Proxy-State = 0x323533
(8)   NET-NodeID = "ndid-00000001"
(8)   Proxy-State = 0x323133
(8) session-state: No cached attributes
(8) # Executing section authorize from file /etc/raddb/sites-enabled/default
(8)   authorize {
(8)     policy filter_username {
(8)       if (!&User-Name) {
(8)       if (!&User-Name)  -> FALSE
(8)       if (&User-Name =~ / /) {
(8)       if (&User-Name =~ / /)  -> FALSE
(8)       if (&User-Name =~ /@.*@/ ) {
(8)       if (&User-Name =~ /@.*@/ )  -> FALSE
(8)       if (&User-Name =~ /\.\./ ) {
(8)       if (&User-Name =~ /\.\./ )  -> FALSE
(8)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(8)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(8)       if (&User-Name =~ /\.$/)  {
(8)       if (&User-Name =~ /\.$/)   -> FALSE
(8)       if (&User-Name =~ /@\./)  {
(8)       if (&User-Name =~ /@\./)   -> FALSE
(8)     } # policy filter_username = notfound
(8)     [preprocess] = ok
(8)     [chap] = noop
(8)     [mschap] = noop
(8)     [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(8) suffix: No such realm "networks.com"
(8)     [suffix] = noop
(8) eap: Peer sent EAP Response (code 2) ID 184 length 111
(8) eap: Continuing tunnel setup
(8)     [eap] = ok
(8)   } # authorize = ok
(8) Found Auth-Type = EAP
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8)   authenticate {
(8) eap: Expiring EAP session with state 0x6acaf5586a72ef8f
(8) eap: Finished EAP session with state 0x371139a630a920eb
(8) eap: Previous EAP request found for state 0x371139a630a920eb, 
released from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: Continuing EAP-TLS
(8) eap_peap: [eaptls verify] = ok
(8) eap_peap: Done initial handshake
(8) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(8) eap_peap: [eaptls process] = ok
(8) eap_peap: Session established.  Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP method MSCHAPv2 (26)
(8) eap_peap: Got tunneled request
(8) eap_peap:   EAP-Message = 
0x02b800501a02b8004b31e5be1e11d18807778bc19fe7531a54b0000000000000000098bc551349efb4dd87d29014b47dc0a43454a137e8f759d600746573744062796f2d6e6574776f726b732e636f6d
(8) eap_peap: Setting User-Name to test@networks.com
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap:   EAP-Message = 
0x02b800501a02b8004b31e5be1e11d18807778bc19fe7531a54b0000000000000000098bc551349efb4dd87d29014b47dc0a43454a137e8f759d600746573744062796f2d6e6574776f726b732e636f6d
(8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap:   User-Name = "test@networks.com"
(8) eap_peap:   State = 0x6acaf5586a72ef8f5a9065fc047e5dca
(8) eap_peap:   NAS-IP-Address = 127.0.0.1
(8) eap_peap:   NAS-Identifier = "ap.example.com"
(8) eap_peap:   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(8) eap_peap:   NAS-Port-Type = Wireless-802.11
(8) eap_peap:   NAS-Port = 0
(8) eap_peap:   Calling-Station-Id = "2A-72-E8-47-76-FE"
(8) eap_peap:   Connect-Info = "CONNECT 0Mbps 802.11b"
(8) eap_peap:   Acct-Session-Id = "57B6BC2F-0000000D"
(8) eap_peap:   Framed-MTU = 1400
(8) eap_peap:   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(8) Virtual server inner-tunnel received request
(8)   EAP-Message = 
0x02b800501a02b8004b31e5be1e11d18807778bc19fe7531a54b0000000000000000098bc551349efb4dd87d29014b47dc0a43454a137e8f759d600746573744062796f2d6e6574776f726b732e636f6d
(8)   FreeRADIUS-Proxied-To = 127.0.0.1
(8)   User-Name = "test@networks.com"
(8)   State = 0x6acaf5586a72ef8f5a9065fc047e5dca
(8)   NAS-IP-Address = 127.0.0.1
(8)   NAS-Identifier = "ap.example.com"
(8)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(8)   NAS-Port-Type = Wireless-802.11
(8)   NAS-Port = 0
(8)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(8)   Connect-Info = "CONNECT 0Mbps 802.11b"
(8)   Acct-Session-Id = "57B6BC2F-0000000D"
(8)   Framed-MTU = 1400
(8)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(8) server inner-tunnel {
(8)   session-state: No cached attributes
(8)   # Executing section authorize from file 
/etc/raddb/sites-enabled/inner-tunnel
(8)     authorize {
(8)       policy split_username_nai {
(8)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(8)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(8)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(8)           update request {
(8)             EXPAND %{1}
(8)                --> test
(8)             &Stripped-User-Name := test
(8)             EXPAND %{3}
(8)                --> networks.com
(8)             &Stripped-User-Domain = networks.com
(8)           } # update request = noop
(8)           [updated] = updated
(8)         } # if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(8)         ... skipping else for request 8: Preceding "if" was taken
(8)       } # policy split_username_nai = updated
(8)       [chap] = noop
(8)       [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "test", looking up realm NULL
(8) suffix: No such realm "NULL"
(8)       [suffix] = noop
(8)       update control {
(8)         &Proxy-To-Realm := LOCAL
(8)       } # update control = noop
(8) eap: Peer sent EAP Response (code 2) ID 184 length 80
(8) eap: No EAP Start, assuming it's an on-going EAP conversation
(8)       [eap] = updated
(8)       [files] = noop
rlm_ldap (ldap): Reserved connection (1)
(8) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(8) ldap:    --> (uid=test)
(8) ldap: Performing search in 
"uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos" with 
filter "(uid=test)", scope "sub"
(8) ldap: Waiting for search result...
(8) ldap: User object found at DN 
"uid=test,ou=People,uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos"
(8) ldap: Processing user attributes
(8) ldap: control:NT-Password := 
0x3345363738423236364431443434394535333145393242454333334236443237
(8) ldap: control:LM-Password := 
0x3244353534353037374437423744324143434639313535453345374442343533
(8) ldap: control:NET-NodeID += 'ndid-00000002'
(8) ldap: reply:NET-SubnetID := 'snid-00000001'
rlm_ldap (ldap): Released connection (1)
(8)       [ldap] = updated
(8)       [expiration] = noop
(8)       [logintime] = noop
(8) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes
(8) pap: Normalizing LM-Password from hex encoding, 32 bytes -> 16 bytes
(8) pap: WARNING: Auth-Type already set.  Not setting to PAP
(8)       [pap] = noop
(8)     } # authorize = updated
(8)   Found Auth-Type = EAP
(8)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(8)     authenticate {
(8) eap: Expiring EAP session with state 0x6acaf5586a72ef8f
(8) eap: Finished EAP session with state 0x6acaf5586a72ef8f
(8) eap: Previous EAP request found for state 0x6acaf5586a72ef8f, 
released from the list
(8) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(8) eap: Calling submodule eap_mschapv2 to process data
(8) eap_mschapv2: # Executing group from file 
/etc/raddb/sites-enabled/inner-tunnel
(8) eap_mschapv2:   Auth-Type MS-CHAP {
(8) mschap: Found NT-Password
(8) mschap: Found LM-Password
(8) mschap: Creating challenge hash with username: test@networks.com
(8) mschap: Client is using MS-CHAPv2
(8) mschap: Adding MS-CHAPv2 MPPE keys
(8)     [mschap] = ok
(8)   } # Auth-Type MS-CHAP = ok
(8) MSCHAP Success
(8) eap: Sending EAP Request (code 1) ID 185 length 51
(8) eap: EAP session adding &reply:State = 0x6acaf5586b73ef8f
(8)       [eap] = handled
(8)     } # authenticate = handled
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8)   NET-SubnetID := "snid-00000001"
(8)   EAP-Message = 
0x01b900331a03b8002e533d39434145374544443534353436313834434239323442434136314332304541424332384242424643
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x6acaf5586b73ef8f5a9065fc047e5dca
(8) eap_peap: Got tunneled reply code 11
(8) eap_peap:   NET-SubnetID := "snid-00000001"
(8) eap_peap:   EAP-Message = 
0x01b900331a03b8002e533d39434145374544443534353436313834434239323442434136314332304541424332384242424643
(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap:   State = 0x6acaf5586b73ef8f5a9065fc047e5dca
(8) eap_peap: Got tunneled reply RADIUS code 11
(8) eap_peap:   NET-SubnetID := "snid-00000001"
(8) eap_peap:   EAP-Message = 
0x01b900331a03b8002e533d39434145374544443534353436313834434239323442434136314332304541424332384242424643
(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap:   State = 0x6acaf5586b73ef8f5a9065fc047e5dca
(8) eap_peap: Got tunneled Access-Challenge
UNKNOWN TLS VERSION ?0000? [length 0005]
(8) eap: Sending EAP Request (code 1) ID 185 length 82
(8) eap: EAP session adding &reply:State = 0x371139a63fa820eb
(8)     [eap] = handled
(8)   } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) Post-Auth-Type sub-section not found.  Ignoring.
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8) Sent Access-Challenge Id 160 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(8)   EAP-Message = 
0x01b900521900170303004719fa6702ec138e0dbb62bdc689253a37c4b61c61dbc428b7385d110ab351c05bdf45278b7eda6b459fcbfbd1cc111a57013b5df5b9f5a7f36f7f0b780e49283e3e8c7d355f9ae1
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x371139a63fa820eb21d5bd1c31ccd110
(8)   Proxy-State = 0x323533
(8)   Proxy-State = 0x323133
(8) Finished request
Waking up in 4.9 seconds.
(9) Received Access-Request Id 245 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 276
(9)   User-Name = "test@networks.com"
(9)   NAS-IP-Address = 127.0.0.1
(9)   NAS-Identifier = "ap.example.com"
(9)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(9)   NAS-Port-Type = Wireless-802.11
(9)   NAS-Port = 0
(9)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(9)   Connect-Info = "CONNECT 0Mbps 802.11b"
(9)   Acct-Session-Id = "57B6BC2F-0000000D"
(9)   Framed-MTU = 1400
(9)   EAP-Message = 
0x02b900251900170303001a54efea8e9a01320937b77a8b149b12bd12817e7e3e64dc3595af
(9)   State = 0x371139a63fa820eb21d5bd1c31ccd110
(9)   Message-Authenticator = 0x8dfa4b927cd958833034558285dccf38
(9)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(9)   Proxy-State = 0x323534
(9)   NET-NodeID = "ndid-00000001"
(9)   Proxy-State = 0x323235
(9) session-state: No cached attributes
(9) # Executing section authorize from file /etc/raddb/sites-enabled/default
(9)   authorize {
(9)     policy filter_username {
(9)       if (!&User-Name) {
(9)       if (!&User-Name)  -> FALSE
(9)       if (&User-Name =~ / /) {
(9)       if (&User-Name =~ / /)  -> FALSE
(9)       if (&User-Name =~ /@.*@/ ) {
(9)       if (&User-Name =~ /@.*@/ )  -> FALSE
(9)       if (&User-Name =~ /\.\./ ) {
(9)       if (&User-Name =~ /\.\./ )  -> FALSE
(9)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(9)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(9)       if (&User-Name =~ /\.$/)  {
(9)       if (&User-Name =~ /\.$/)   -> FALSE
(9)       if (&User-Name =~ /@\./)  {
(9)       if (&User-Name =~ /@\./)   -> FALSE
(9)     } # policy filter_username = notfound
(9)     [preprocess] = ok
(9)     [chap] = noop
(9)     [mschap] = noop
(9)     [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(9) suffix: No such realm "networks.com"
(9)     [suffix] = noop
(9) eap: Peer sent EAP Response (code 2) ID 185 length 37
(9) eap: Continuing tunnel setup
(9)     [eap] = ok
(9)   } # authorize = ok
(9) Found Auth-Type = EAP
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9)   authenticate {
(9) eap: Expiring EAP session with state 0x6acaf5586b73ef8f
(9) eap: Finished EAP session with state 0x371139a63fa820eb
(9) eap: Previous EAP request found for state 0x371139a63fa820eb, 
released from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: [eaptls verify] = ok
(9) eap_peap: Done initial handshake
(9) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(9) eap_peap: [eaptls process] = ok
(9) eap_peap: Session established.  Decoding tunneled attributes
(9) eap_peap: PEAP state phase2
(9) eap_peap: EAP method MSCHAPv2 (26)
(9) eap_peap: Got tunneled request
(9) eap_peap:   EAP-Message = 0x02b900061a03
(9) eap_peap: Setting User-Name to test@networks.com
(9) eap_peap: Sending tunneled request to inner-tunnel
(9) eap_peap:   EAP-Message = 0x02b900061a03
(9) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(9) eap_peap:   User-Name = "test@networks.com"
(9) eap_peap:   State = 0x6acaf5586b73ef8f5a9065fc047e5dca
(9) eap_peap:   NAS-IP-Address = 127.0.0.1
(9) eap_peap:   NAS-Identifier = "ap.example.com"
(9) eap_peap:   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(9) eap_peap:   NAS-Port-Type = Wireless-802.11
(9) eap_peap:   NAS-Port = 0
(9) eap_peap:   Calling-Station-Id = "2A-72-E8-47-76-FE"
(9) eap_peap:   Connect-Info = "CONNECT 0Mbps 802.11b"
(9) eap_peap:   Acct-Session-Id = "57B6BC2F-0000000D"
(9) eap_peap:   Framed-MTU = 1400
(9) eap_peap:   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(9) Virtual server inner-tunnel received request
(9)   EAP-Message = 0x02b900061a03
(9)   FreeRADIUS-Proxied-To = 127.0.0.1
(9)   User-Name = "test@networks.com"
(9)   State = 0x6acaf5586b73ef8f5a9065fc047e5dca
(9)   NAS-IP-Address = 127.0.0.1
(9)   NAS-Identifier = "ap.example.com"
(9)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(9)   NAS-Port-Type = Wireless-802.11
(9)   NAS-Port = 0
(9)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(9)   Connect-Info = "CONNECT 0Mbps 802.11b"
(9)   Acct-Session-Id = "57B6BC2F-0000000D"
(9)   Framed-MTU = 1400
(9)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(9) server inner-tunnel {
(9)   session-state: No cached attributes
(9)   # Executing section authorize from file 
/etc/raddb/sites-enabled/inner-tunnel
(9)     authorize {
(9)       policy split_username_nai {
(9)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/)) {
(9)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  -> TRUE
(9)         if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  {
(9)           update request {
(9)             EXPAND %{1}
(9)                --> test
(9)             &Stripped-User-Name := test
(9)             EXPAND %{3}
(9)                --> networks.com
(9)             &Stripped-User-Domain = networks.com
(9)           } # update request = noop
(9)           [updated] = updated
(9)         } # if (&User-Name && (&User-Name =~ 
/^([^@]*)(@([-[:alnum:]]+\.[-[:alnum:].]+))?$/))  = updated
(9)         ... skipping else for request 9: Preceding "if" was taken
(9)       } # policy split_username_nai = updated
(9)       [chap] = noop
(9)       [mschap] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "test", looking up realm NULL
(9) suffix: No such realm "NULL"
(9)       [suffix] = noop
(9)       update control {
(9)         &Proxy-To-Realm := LOCAL
(9)       } # update control = noop
(9) eap: Peer sent EAP Response (code 2) ID 185 length 6
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9)       [eap] = updated
(9)       [files] = noop
rlm_ldap (ldap): Reserved connection (2)
(9) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}})
(9) ldap:    --> (uid=test)
(9) ldap: Performing search in 
"uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos" with 
filter "(uid=test)", scope "sub"
(9) ldap: Waiting for search result...
(9) ldap: User object found at DN 
"uid=test,ou=People,uid=lakc192e,ou=auth_servers,tnid=ukjprwp3,ou=tenants,dc=netos"
(9) ldap: Processing user attributes
(9) ldap: control:NT-Password := 
0x3345363738423236364431443434394535333145393242454333334236443237
(9) ldap: control:LM-Password := 
0x3244353534353037374437423744324143434639313535453345374442343533
(9) ldap: control:NET-NodeID += 'ndid-00000002'
(9) ldap: reply:NET-SubnetID := 'snid-00000001'
rlm_ldap (ldap): Released connection (2)
(9)       [ldap] = updated
(9)       [expiration] = noop
(9)       [logintime] = noop
(9) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes
(9) pap: Normalizing LM-Password from hex encoding, 32 bytes -> 16 bytes
(9) pap: WARNING: Auth-Type already set.  Not setting to PAP
(9)       [pap] = noop
(9)     } # authorize = updated
(9)   Found Auth-Type = EAP
(9)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(9)     authenticate {
(9) eap: Expiring EAP session with state 0x6acaf5586b73ef8f
(9) eap: Finished EAP session with state 0x6acaf5586b73ef8f
(9) eap: Previous EAP request found for state 0x6acaf5586b73ef8f, 
released from the list
(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(9) eap: Calling submodule eap_mschapv2 to process data
(9) eap: Sending EAP Success (code 3) ID 185 length 4
(9) eap: Freeing handler
(9)       [eap] = ok
(9)     } # authenticate = ok
(9)   # Executing section post-auth from file 
/etc/raddb/sites-enabled/inner-tunnel
(9)     post-auth {
(9)       update reply {
(9)         No attributes updated
(9)         No attributes updated
(9)       } # update reply = noop
(9)     } # post-auth = noop
(9) } # server inner-tunnel
(9) Virtual server sending reply
(9)   NET-SubnetID := "snid-00000001"
(9)   MS-MPPE-Encryption-Policy = Encryption-Allowed
(9)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(9)   MS-MPPE-Send-Key = 0x5d7914dc0a190da7cfe95d9457b276ff
(9)   MS-MPPE-Recv-Key = 0x9d6b9317fe2d827e2c012ec05670ec92
(9)   EAP-Message = 0x03b90004
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9)   Stripped-User-Name := "test"
(9) eap_peap: Got tunneled reply code 2
(9) eap_peap:   NET-SubnetID := "snid-00000001"
(9) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed
(9) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(9) eap_peap:   MS-MPPE-Send-Key = 0x5d7914dc0a190da7cfe95d9457b276ff
(9) eap_peap:   MS-MPPE-Recv-Key = 0x9d6b9317fe2d827e2c012ec05670ec92
(9) eap_peap:   EAP-Message = 0x03b90004
(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap:   Stripped-User-Name := "test"
(9) eap_peap: Got tunneled reply RADIUS code 2
(9) eap_peap:   NET-SubnetID := "snid-00000001"
(9) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed
(9) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(9) eap_peap:   MS-MPPE-Send-Key = 0x5d7914dc0a190da7cfe95d9457b276ff
(9) eap_peap:   MS-MPPE-Recv-Key = 0x9d6b9317fe2d827e2c012ec05670ec92
(9) eap_peap:   EAP-Message = 0x03b90004
(9) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap:   Stripped-User-Name := "test"
(9) eap_peap: Tunneled authentication was successful
(9) eap_peap: SUCCESS
UNKNOWN TLS VERSION ?0000? [length 0005]
(9) eap_peap: Saving tunneled attributes for later
(9) eap: Sending EAP Request (code 1) ID 186 length 46
(9) eap: EAP session adding &reply:State = 0x371139a63eab20eb
(9)     [eap] = handled
(9)   } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) Post-Auth-Type sub-section not found.  Ignoring.
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) Sent Access-Challenge Id 245 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(9)   EAP-Message = 
0x01ba002e1900170303002319fa6702ec138e0ebd84399adcfded8eeaba7e3b682ccfb404750f34c61f4c3cc75b3c
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9)   State = 0x371139a63eab20eb21d5bd1c31ccd110
(9)   Proxy-State = 0x323534
(9)   Proxy-State = 0x323235
(9) Finished request
Waking up in 4.9 seconds.
(1) Cleaning up request packet ID 137 with timestamp +46
(10) Received Access-Request Id 137 from 192.168.42.103:56100 to 
192.168.42.101:1812 length 285
(10)   User-Name = "test@networks.com"
(10)   NAS-IP-Address = 127.0.0.1
(10)   NAS-Identifier = "ap.example.com"
(10)   Called-Station-Id = "4E-A1-C9-31-3D-06:"
(10)   NAS-Port-Type = Wireless-802.11
(10)   NAS-Port = 0
(10)   Calling-Station-Id = "2A-72-E8-47-76-FE"
(10)   Connect-Info = "CONNECT 0Mbps 802.11b"
(10)   Acct-Session-Id = "57B6BC2F-0000000D"
(10)   Framed-MTU = 1400
(10)   EAP-Message = 
0x02ba002e1900170303002354efea8e9a01320ae16d16854eb91b6f2318d0b640331d484bef03a5c923983cb94dab
(10)   State = 0x371139a63eab20eb21d5bd1c31ccd110
(10)   Message-Authenticator = 0x5feb26a178d7c992e50cb8c8e676cdfc
(10)   Event-Timestamp = "Aug 29 2016 15:02:39 CEST"
(10)   Proxy-State = 0x323535
(10)   NET-NodeID = "ndid-00000001"
(10)   Proxy-State = 0x313532
(10) session-state: No cached attributes
(10) # Executing section authorize from file 
/etc/raddb/sites-enabled/default
(10)   authorize {
(10)     policy filter_username {
(10)       if (!&User-Name) {
(10)       if (!&User-Name)  -> FALSE
(10)       if (&User-Name =~ / /) {
(10)       if (&User-Name =~ / /)  -> FALSE
(10)       if (&User-Name =~ /@.*@/ ) {
(10)       if (&User-Name =~ /@.*@/ )  -> FALSE
(10)       if (&User-Name =~ /\.\./ ) {
(10)       if (&User-Name =~ /\.\./ )  -> FALSE
(10)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(10)       if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   
-> FALSE
(10)       if (&User-Name =~ /\.$/)  {
(10)       if (&User-Name =~ /\.$/)   -> FALSE
(10)       if (&User-Name =~ /@\./)  {
(10)       if (&User-Name =~ /@\./)   -> FALSE
(10)     } # policy filter_username = notfound
(10)     [preprocess] = ok
(10)     [chap] = noop
(10)     [mschap] = noop
(10)     [digest] = noop
(10) suffix: Checking for suffix after "@"
(10) suffix: Looking up realm "networks.com" for User-Name = 
"test@networks.com"
(10) suffix: No such realm "networks.com"
(10)     [suffix] = noop
(10) eap: Peer sent EAP Response (code 2) ID 186 length 46
(10) eap: Continuing tunnel setup
(10)     [eap] = ok
(10)   } # authorize = ok
(10) Found Auth-Type = EAP
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10)   authenticate {
(10) eap: Expiring EAP session with state 0x371139a63eab20eb
(10) eap: Finished EAP session with state 0x371139a63eab20eb
(10) eap: Previous EAP request found for state 0x371139a63eab20eb, 
released from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: Continuing EAP-TLS
(10) eap_peap: [eaptls verify] = ok
(10) eap_peap: Done initial handshake
(10) eap_peap: <<< UNKNOWN TLS VERSION ?0000? [length 0005]
(10) eap_peap: [eaptls process] = ok
(10) eap_peap: Session established.  Decoding tunneled attributes
(10) eap_peap: PEAP state send tlv success
(10) eap_peap: Received EAP-TLV response
(10) eap_peap: Success
(10) eap_peap: Using saved attributes from the original Access-Accept
(10) eap_peap:   NET-SubnetID := "snid-00000001"
(10) eap_peap:   Stripped-User-Name := "test"
(10) eap_peap: No information to cache: session caching will be disabled 
for session 4a4f1a6a018245aee98f951647d5735f8bece0eed8c3f534571b6bd3cd05c9f0
(10) eap: Sending EAP Success (code 3) ID 186 length 4
(10) eap: Freeing handler
(10)     [eap] = ok
(10)   } # authenticate = ok
(10) # Executing section post-auth from file 
/etc/raddb/sites-enabled/default
(10)   post-auth {
(10)     update {
(10)       No attributes updated
(10)     } # update = noop
(10)     update reply {
(10)       &reply:NET-TenantID += 'tnid-00000001'
(10)       &reply:NET-NodeID += &request:NET-NodeID -> 'ndid-00000001'
(10)       &reply:Acct-Interim-Interval += 300
(10)     } # update reply = noop
(10)     [exec] = noop
(10)     policy remove_reply_message_if_eap {
(10)       if (&reply:EAP-Message && &reply:Reply-Message) {
(10)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(10)       else {
(10)         [noop] = noop
(10)       } # else = noop
(10)     } # policy remove_reply_message_if_eap = noop
(10)   } # post-auth = noop
(10) Sent Access-Accept Id 137 from 192.168.42.101:1812 to 
192.168.42.103:56100 length 0
(10)   NET-SubnetID := "snid-00000001"
(10)   MS-MPPE-Recv-Key = 
0x1afcb07652e3bd313b770d903028bfb75c77611ae86a7414d158de94daa5fdb9
(10)   MS-MPPE-Send-Key = 
0xbee3a883ccab88b79074fafa7d3aec7576c18de6d513bd88c5373a70ee7e519a
(10)   EAP-Message = 0x03ba0004
(10)   Message-Authenticator = 0x00000000000000000000000000000000
(10)   User-Name = "test@networks.com"
(10)   Proxy-State = 0x323535
(10)   Proxy-State = 0x313532
(10)   NET-TenantID += "tnid-00000001"
(10)   NET-NodeID += "ndid-00000001"
(10)   Acct-Interim-Interval += 300
(10) Finished request
Waking up in 4.9 seconds.
(0) Cleaning up request packet ID 43 with timestamp +46
(2) Cleaning up request packet ID 174 with timestamp +47
(3) Cleaning up request packet ID 53 with timestamp +47
(4) Cleaning up request packet ID 25 with timestamp +47
(5) Cleaning up request packet ID 38 with timestamp +47
(6) Cleaning up request packet ID 195 with timestamp +47
(7) Cleaning up request packet ID 30 with timestamp +47
(8) Cleaning up request packet ID 160 with timestamp +47
(9) Cleaning up request packet ID 245 with timestamp +47
(10) Cleaning up request packet ID 137 with timestamp +47
Ready to process requests