OK here is the debug output from the NAS requiring those two entries commented out. The CPE are authenticated and the Framed-Filter-Id is sent back properly but the subscribers never receive service. EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}E16C264A7784B7B86380C1087F7143C2" WiMAX-IP-Technology = CMIP4 WiMAX-FA-RK-Key = 0x557aa1e75f677ac869ea7cddad1d4d8eb4bc1c15 WiMAX-MSK = 0x WiMAX-MSK = 0x9ff71c6efbd6db6fa56de244f7863855f2570a0f9e50fb08175e5570da3741de219a8f6a79 353d50a443488d7ad3631e896684d3c4e360c2e8dc9d7b2faae2c0 WiMAX-FA-RK-SPI = 4080449119 Finished request 546. Going to the next request Waking up in 3.1 seconds. Cleaning up request 539 ID 126 with timestamp +8431 Cleaning up request 540 ID 127 with timestamp +8431 Cleaning up request 541 ID 128 with timestamp +8431 Cleaning up request 542 ID 129 with timestamp +8431 Cleaning up request 543 ID 130 with timestamp +8431 Waking up in 1.3 seconds. Cleaning up request 544 ID 131 with timestamp +8433 Waking up in 0.1 seconds. Cleaning up request 545 ID 132 with timestamp +8433 Cleaning up request 546 ID 133 with timestamp +8433 Ready to process requests. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=134, length=252 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x02010035017b616d3d317d3137324533464144323738393746424232394430313630353943 3632314230334057694d61782e636f6d Message-Authenticator = 0xbcad3e78aa2580a803ec6771574f8b1d NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 53 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com [sql] sql_set_user escaped user --> '{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 134 to 172.16.4.2 port 1812 EAP-Message = 0x0102001604106f87eaef5fb2c869f5ea9cc7bbd6f167 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12478ecf59ab6dcf8f64d052f7 Finished request 547. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=135, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020200060315 Message-Authenticator = 0x5c7b646a4e15bcaa02ab2fba84de80bc NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12478ecf59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com [sql] sql_set_user escaped user --> '{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 [sql] User {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 135 to 172.16.4.2 port 1812 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12468fde59ab6dcf8f64d052f7 Finished request 548. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=136, length=305 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x0203005815800000004e16030100490100004503014ba56db22185a9f76d29a4d2adb55f14 98e0cf24850e4500ca78d654b408fc0000001e00390038003500160013000a00330032002f00 15001200090014001100080100 Message-Authenticator = 0x88f33e618e713504847509a6e0d3150b NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12468fde59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 88 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 78 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0049], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 136 to 172.16.4.2 port 1812 EAP-Message = 0x0104040015c000000aad160301002a0200002603014cbf28a1c3eb9d327ad351652f04cabf 9821f3c17dc245ad28145764c786e7f900003900160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3130303632313139303034345a170d3131303632313139303034345a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100a22c435dd3157a79c141fdc1a3ee89f7661a09187b958a5816beff7591e4b6aa37f7f256 cb182fffd65c4000a1498020aea03360223fad98df86a01d7b3c EAP-Message = 0xea1055ffdadbf60a2ea1b7af5a728cb75ec7e06ee90c39a9d6b1bdef454343d51c4f489be8 d3e17f545a9e8b7ac612dba36cf14c1a7709651d1bf04a057c4188fecee0dd6d80b9d5cca836 5e3e0aeccf0deef1f7516cce7d30fbe1271f8fcb25be192fbaf623340024debf13487225fead 75a4e557f21cb9707d519d2ad8de57eeda2c8b6afc7fc2b0e1a890fec212c80455a83a8b41bb b35fc6420b167139c6033757b38124c971da04bd1c6da985c65077f55bee5b37c65e1f8cefa3 25c1672bff0203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d01010405000382010100c21ae0152cdbce17a1 EAP-Message = 0x55233bf585be76ec2a3265e3e6ee7132890dc68d37c1864b08ba53f34c358953c528f8ab14 4716d17ebcd4f1b86f53522ce118b1a8932dfe4e3234137e94aecc3737c66d07405c9c369d2a 04f4d11c96685996d95313a35fde3b433d15eb93c915814fca156b6c5fcff010968ef7613142 d4cd95da673bdc1217739a88f8d43bb6ca26bee37a64f8ce1b50ec1b8e7c11c5291c88b5ebea 2e766bc31139fc03482232660ea54c22273996250eab67b9198b4ad378c5e1635162ffc5e382 bf5d60dd149e6c1b9f05eb5e94824b103f77e6e5875f6f8beeb48302defec698296f20c9ba78 9341834806deb515116aedc41d90bfebfaf0bea20004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb124588de59ab6dcf8f64d052f7 Finished request 549. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=137, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020400061500 Message-Authenticator = 0x0f160700bd7a7dde77c1dbac4e9ca0bd NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb124588de59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 137 to 172.16.4.2 port 1812 EAP-Message = 0x0105040015c000000aad00b7ca1f4a75b65c48300d06092a864886f70d0101050500308193 310b3009060355040613024652310f300d060355040813065261646975733112301006035504 071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d31 30303632313139303034345a170d3131303632313139303034345a308193310b300906035504 0613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e 632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126 30240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 30820122300d06092a864886f70d01010105000382010f003082010a0282010100e3290705c4 fbb8ba17c01180a24b51b68fd9807e4a28e561d5d344b2baf607eda92d77219aa57c54c52b8b d9a1f00f4d4e63f193d3089c1a396bc81a9fc88206480dc4a57b5b488fb34e9ac384ce919b94 567443f6fe9eb3199ef1cfec5cf3343d1003de5a824a6b4ff7ae EAP-Message = 0x783711920d724d0c6d8215edc2c8106d2d5bdb5c0db3438661f24fa3325a92e0959ca3b202 333824e1799e966f487857983c73b9477548cc8430cb1d94afb8751ace106e5401388bb34457 7f99fa44d7daa1e3b429f24bcdfd74c26813fbb390a65854d14ce5b3f9a8a06830f6deea9271 b7f09a8f2786d0bda65dad5733155c3028f318317133f2fdaa4c8687ab457f4cc9f6d1f90203 010001a381fb3081f8301d0603551d0e04160414c653e0f09e4775e74119ec9d2ca877eea7d7 857c3081c80603551d230481c03081bd8014c653e0f09e4775e74119ec9d2ca877eea7d7857c a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013 060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01090116116164 6d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479820900b7ca1f4a75b65c48300c0603551d13040530 030101ff300d06092a864886f70d0101050500038201010054813204c14a1e24209f2775a069 ec1ef24c75af5aeae0cd8fd867228eb1053d085cb7a41f825bef7c00509b6c16f5418140dd84 d04a6470f0066b95863ebdd930d7137d4b269a127b5ac5d8bb54 EAP-Message = 0xa450a87daa867321e3c885c3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb124489de59ab6dcf8f64d052f7 Finished request 550. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=138, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020500061500 Message-Authenticator = 0x650835cee90bb974cdf638b73fcd2a0b NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb124489de59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 138 to 172.16.4.2 port 1812 EAP-Message = 0x010602cb158000000aad9c453583b6807402da0b0d8c90c139a9a0ddef70b01c5fa9ee8ac5 1255bf935d536f69d45b60a86ca871ddfc2c67c15cd531a3fae5cf5dfccf9170560759968f21 e6020052bf6baeb29ebcd3e174c16a36a30ef060c4d110b63cea4f16a115717fa6a8ba515021 0f86dd7f31bde3a3c35117d3d0b991763b97041453c7aa22a068e26a3b931dddbc429d8bdc75 66b6077f51717c612d206261f862b672cff53abfb016b9b839160301020d0c0002090080f5bd 24429f55049a0764bc935fbb95edf33bca4152a811bf1895e8dbfebd93cebc81616f548086f0 fb025058c15c8cc5f35dad890892db51c300b8fd6b7ecd9001da EAP-Message = 0xbe526cba14255c8cec05d51acdc7c0aa97a19bf634ee550c72543d1d4927b0819129b99790 32cf1d098638b89741798e7e2c6854e368448190fa73d3b68b0001020080d14954812608d3ee 2cd467c9d9cc82e9b8985d9697a37d6f55a4ccec638fb00acb0c1fcc319ecf2424ef63f34a9e ae614ac737a8196c7e812ef9421575874140c65ab0d8ac4d092541e4a6ea37180b0022ba3083 9099dfe279acb9694005ffc1a0c9c5c73fe8d0fbc365f4e8bd850ab91c4101a621bf6a9ce40e e60977746c3c0100293beb89c04468412b3fb9cc298d4655c621ae4e66cfcbc5d4f32d45b2d1 2ac7d25539fa6d95a5b8c499e342a5b65b1c5106c99d1b35e9da EAP-Message = 0x835db11a36f83ca100b5b2ca091706d1d6d179ca093f0c058400ccdffc2c9e20bcbea1410c ee9ae316b7346db3a6a222e773195dec7a26a2932522619bda9f577ad01aef49ca5dbef3cbd7 d2e58d2d77480dc5ea7040a7aa59be3be18d24d027b0d8d79d963301447928b6451b9aec63b0 65706957f8cdb30bf7be9aea5a8efe74d2bc279981e3c7856170d926575e9451606996ddc012 9bfaa37c7ee0a86b308ba5a214bf361376c1f72a082220dbdd4e1753c7b5f792b67886f083f9 29c881afc50ff4c103b34416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12438ade59ab6dcf8f64d052f7 Finished request 551. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=139, length=425 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020600d01580000000c6160301008610000082008019091b56b93c2dd93d6750a96e9c9dc6 04a460123d8d6b72a95bddc2b80645b03c1adad01f5fb131822813ade7a1d1db4799be842683 a508e70cb22e0f19ebbb0161140dc4320cc74a6898a57ec9a4ba09afdcb04900f900b9153f7d 6f221e485ada8f7fe9e836370dce412cafc5b7650f5cdefabfce5b8e83eef7c41c1b29451403 0100010116030100301d1813cf79828a23207e419b22109258f0bb833fc4a7dbf259c9276eb4 af13242a5d16fa9fcb25b2e9e60bc90d9151d0 Message-Authenticator = 0x3dbbb76e82f0635a2a42821991fc3aa4 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12438ade59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 139 to 172.16.4.2 port 1812 EAP-Message = 0x0107004515800000003b1403010001011603010030dca979f044c0aeda0da67eb60b0d7a02 7265933c924dd92c1d3ba9e02c7c623ff4a863c6d2033b2a97888d48714b8802 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12428bde59ab6dcf8f64d052f7 Finished request 552. Going to the next request Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=140, length=409 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020700c015001703010020c45c7d140d8783a758c9ecb656e69f1b4fc3cbc22382dbe0caff 1673e827cdfb17030100902d218bc577d463a8b1e2b50ab09206f3daeef02fcd91bd52e90f23 819f1a07654a3ba1a711f59e431ab93d3189dc860a74b9cd67febcb621a9438f8fd16160dec8 cbab6c3a21ef49c52939a6e98c56edf4d47e23ec0a53c3e15dbae0b28e92b68073bc17c0a95c e757a5c183d05966cf63b4e0080127996ee7300527111c5e478bca2b1fedc90fdaace5a2bbe1 d46f1a Message-Authenticator = 0x31d57333c56c4b226b3665b572620ba2 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12428bde59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0xd9f370a27454c8f24cb516abd89c288d MS-CHAP2-Response = 0x8b00d9f370a27454c8f24cb516abd89c288d00000000000000003d35ec9cbd8b5be8ba199d 30326911e6075fe803c3a48a5d FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0xd9f370a27454c8f24cb516abd89c288d MS-CHAP2-Response = 0x8b00d9f370a27454c8f24cb516abd89c288d00000000000000003d35ec9cbd8b5be8ba199d 30326911e6075fe803c3a48a5d FreeRADIUS-Proxied-To = 127.0.0.1 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "Silver2@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "Silver2" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '4M-Silver' ORDER BY id [sql] User found in group 4M-Silver [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '4M-Silver' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for Silver2@WiMax.com with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:35') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:35') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> Silver2@WiMax.com [sql_log] expand: %{%{User-Name}:-DEFAULT} -> Silver2@WiMax.com [sql_log] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('Silver2@WiMax.com', 'Chap-Password', 'Access-Accept', '2010-10-20 13:36:35'); [sql_log] expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Framed-Filter-Id = "Silver" MS-CHAP2-Success = 0x8b533d38433645334446453936303744394437333431414438434335394545304644394637 443543463442 MS-MPPE-Recv-Key = 0x6120b81ed669fe9f25bc6f78b2e3f860 MS-MPPE-Send-Key = 0x8607a38d1b37202ce93c2b3eaa59349e MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 140 to 172.16.4.2 port 1812 EAP-Message = 0x0108005f1580000000551703010050732325854414b144cb0eec24b7c8109439fe1a8b2861 2081fe9cc5091d883358215d4490c6a18f408959f4bfe9364db18ba45720b7aaafaf32c3268d 28b0a59de65c8dadfadbbdd0806cb9b8595ea5d8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb124184de59ab6dcf8f64d052f7 Finished request 553. Going to the next request Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=141, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020800061500 Message-Authenticator = 0xb63cdc0036db5df04e318a3f5f952f25 NAS-Identifier = "Freeradius" ^C'' root@ubuntu:/usr/local/etc/raddb/sites-available# '' root@ubuntu:/usr/local/etc/raddb/sites-available# root@ubuntu:/usr/local/etc/raddb/sites-available# root@ubuntu:/usr/local/etc/raddb/sites-available# root@ubuntu:/usr/local/etc/raddb/sites-available# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jun 21 2010 at 14:47:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/sites-available/dynamic-clients including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### realm WiMax.com { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dynamic { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 86400 } client dynamic { ipaddr = 172.16.0.0 netmask = 16 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 86400 } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server dynamic_client_server { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "unl0ck" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_sql_log Module: Instantiating sql_log sql_log { path = "/usr/local/var/log/radius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = no safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating attr_filter.access_challenge attr_filter attr_filter.access_challenge { attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" key = "%{User-Name}" } Module: Instantiating handled always handled { rcode = "handled" simulcount = 0 mpp = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_wimax Module: Instantiating wimax wimax { delete_mppe_keys = yes } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=141, length=223 server dynamic_client_server { rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 } # server dynamic_client_server - Added client 172.16.4.2 with shared secret unl0ck rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=141, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020800061500 Message-Authenticator = 0xb63cdc0036db5df04e318a3f5f952f25 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb124184de59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [sql] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com [sql] sql_set_user escaped user --> '{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com', '', 'Access-Reject', '2010-10-20 13:36:50') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com', '', 'Access-Reject', '2010-10-20 13:36:50') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 141 to 172.16.4.2 port 1812 Waking up in 4.9 seconds. Cleaning up request 0 ID 141 with timestamp +2 Ready to process requests. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=142, length=252 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x02010035017b616d3d317d4133443232453433364230433331444143333633394443453530 4342374231454057694d61782e636f6d Message-Authenticator = 0xab8201d1c8d310374d9e9cb69c7fe45a NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 53 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 142 to 172.16.4.2 port 1812 EAP-Message = 0x010200160410e48b4edeff4bd80f302e7a0f1b529edc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890251748deb6482bebd55b3e66d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=143, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020200060315 Message-Authenticator = 0x00e934eadcef5e9a33d9b76124541842 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890251748deb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 143 to 172.16.4.2 port 1812 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890250759ceb6482bebd55b3e66d Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=144, length=305 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x0203005815800000004e16030100490100004503014ba56dc97006b3df82def037b2ef02e4 498e237e06617e6d38efab3255a9e80e00001e00390038003500160013000a00330032002f00 15001200090014001100080100 Message-Authenticator = 0x95cd7a58a5e4df3c1209216284084a22 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890250759ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 88 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 78 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0049], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 144 to 172.16.4.2 port 1812 EAP-Message = 0x0104040015c000000aad160301002a0200002603014cbf28b84a7f4d6ff4170b1f0db6e02e af9c2a9cb901ffea97b71698025d1c2500003900160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3130303632313139303034345a170d3131303632313139303034345a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100a22c435dd3157a79c141fdc1a3ee89f7661a09187b958a5816beff7591e4b6aa37f7f256 cb182fffd65c4000a1498020aea03360223fad98df86a01d7b3c EAP-Message = 0xea1055ffdadbf60a2ea1b7af5a728cb75ec7e06ee90c39a9d6b1bdef454343d51c4f489be8 d3e17f545a9e8b7ac612dba36cf14c1a7709651d1bf04a057c4188fecee0dd6d80b9d5cca836 5e3e0aeccf0deef1f7516cce7d30fbe1271f8fcb25be192fbaf623340024debf13487225fead 75a4e557f21cb9707d519d2ad8de57eeda2c8b6afc7fc2b0e1a890fec212c80455a83a8b41bb b35fc6420b167139c6033757b38124c971da04bd1c6da985c65077f55bee5b37c65e1f8cefa3 25c1672bff0203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d01010405000382010100c21ae0152cdbce17a1 EAP-Message = 0x55233bf585be76ec2a3265e3e6ee7132890dc68d37c1864b08ba53f34c358953c528f8ab14 4716d17ebcd4f1b86f53522ce118b1a8932dfe4e3234137e94aecc3737c66d07405c9c369d2a 04f4d11c96685996d95313a35fde3b433d15eb93c915814fca156b6c5fcff010968ef7613142 d4cd95da673bdc1217739a88f8d43bb6ca26bee37a64f8ce1b50ec1b8e7c11c5291c88b5ebea 2e766bc31139fc03482232660ea54c22273996250eab67b9198b4ad378c5e1635162ffc5e382 bf5d60dd149e6c1b9f05eb5e94824b103f77e6e5875f6f8beeb48302defec698296f20c9ba78 9341834806deb515116aedc41d90bfebfaf0bea20004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890253729ceb6482bebd55b3e66d Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=145, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020400061500 Message-Authenticator = 0x5d4052f0ed761d8a9cf2b3e0ddd853ce NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890253729ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 145 to 172.16.4.2 port 1812 EAP-Message = 0x0105040015c000000aad00b7ca1f4a75b65c48300d06092a864886f70d0101050500308193 310b3009060355040613024652310f300d060355040813065261646975733112301006035504 071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d31 30303632313139303034345a170d3131303632313139303034345a308193310b300906035504 0613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e 632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126 30240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 30820122300d06092a864886f70d01010105000382010f003082010a0282010100e3290705c4 fbb8ba17c01180a24b51b68fd9807e4a28e561d5d344b2baf607eda92d77219aa57c54c52b8b d9a1f00f4d4e63f193d3089c1a396bc81a9fc88206480dc4a57b5b488fb34e9ac384ce919b94 567443f6fe9eb3199ef1cfec5cf3343d1003de5a824a6b4ff7ae EAP-Message = 0x783711920d724d0c6d8215edc2c8106d2d5bdb5c0db3438661f24fa3325a92e0959ca3b202 333824e1799e966f487857983c73b9477548cc8430cb1d94afb8751ace106e5401388bb34457 7f99fa44d7daa1e3b429f24bcdfd74c26813fbb390a65854d14ce5b3f9a8a06830f6deea9271 b7f09a8f2786d0bda65dad5733155c3028f318317133f2fdaa4c8687ab457f4cc9f6d1f90203 010001a381fb3081f8301d0603551d0e04160414c653e0f09e4775e74119ec9d2ca877eea7d7 857c3081c80603551d230481c03081bd8014c653e0f09e4775e74119ec9d2ca877eea7d7857c a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013 060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01090116116164 6d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479820900b7ca1f4a75b65c48300c0603551d13040530 030101ff300d06092a864886f70d0101050500038201010054813204c14a1e24209f2775a069 ec1ef24c75af5aeae0cd8fd867228eb1053d085cb7a41f825bef7c00509b6c16f5418140dd84 d04a6470f0066b95863ebdd930d7137d4b269a127b5ac5d8bb54 EAP-Message = 0xa450a87daa867321e3c885c3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890252739ceb6482bebd55b3e66d Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=146, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020500061500 Message-Authenticator = 0xb01b4f195810b67967253ba37ea524b7 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890252739ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 146 to 172.16.4.2 port 1812 EAP-Message = 0x010602cb158000000aad9c453583b6807402da0b0d8c90c139a9a0ddef70b01c5fa9ee8ac5 1255bf935d536f69d45b60a86ca871ddfc2c67c15cd531a3fae5cf5dfccf9170560759968f21 e6020052bf6baeb29ebcd3e174c16a36a30ef060c4d110b63cea4f16a115717fa6a8ba515021 0f86dd7f31bde3a3c35117d3d0b991763b97041453c7aa22a068e26a3b931dddbc429d8bdc75 66b6077f51717c612d206261f862b672cff53abfb016b9b839160301020d0c0002090080f5bd 24429f55049a0764bc935fbb95edf33bca4152a811bf1895e8dbfebd93cebc81616f548086f0 fb025058c15c8cc5f35dad890892db51c300b8fd6b7ecd9001da EAP-Message = 0xbe526cba14255c8cec05d51acdc7c0aa97a19bf634ee550c72543d1d4927b0819129b99790 32cf1d098638b89741798e7e2c6854e368448190fa73d3b68b00010200807e81e24c1ae047d3 80990ed7c9162f401152889d037653c766f8e064ef8ecd265ee1ae14eb45ea2d439957b5a893 75215102a41f70cc49f8d10e3d2a05e409d7ca28c5b9413a5031ac6a61ea09835e2e25dca3eb f77e60594ac502a065158cdfaf1e9f8365b7087ed6116a6d02ba9f8b6cd66d1eb3fbe6437054 e3fa43851dff01001c660e9c8c92fc613d3141ec1803aa54d563c9ac308ec34d0c4ea292c532 0c62c5e26a94a4e06e9a714e1ea45a7e70c2cdb7cda733578462 EAP-Message = 0x616eb18e840e0978b436bcbff53b5354189ef60e2b04485820731e99644cf868e02de8acef 67efadda72ca042c7ac19e68dba5e1522fbc69f594995bb4eaf68ba2ff04d8370e14d9c825fa 404b90103a24031890a956eb35a468b960ef805bb7f9f114ce70b9ed1a316e94cb6812f12474 175ae46ef86162e54ba3a5f7c79a13f4184c05f3d0da9babf87ef6af1c91b52ed9bc5a922733 56c47f6a4f1a3aaa72a2b869b805be022cc5bce65f053728810bf014d3a4bcaac7db665367a9 5b1444e1af622b4edbc5df16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890255709ceb6482bebd55b3e66d Finished request 5. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=147, length=425 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020600d01580000000c61603010086100000820080e4d7807abde242d95bf6c91a2fddf6cf b57fe828e5df9422a9a8da9ef2cebb9b4645a06feb355df4b13f42ff5e57d7af163a7cffbf84 ba0f1881fcf7f19b527026980170237f9394a9432245cf5c7b522385045b63b6396d0a9b8be7 8908825dfbd6da5a1f0ea432332387160fc1cc5fd5aac8109782b0b30f939db9964cec5e1403 0100010116030100307cca567db3f81ef6a2685b75eeb16fb9aa012bd8d4f82fc4e73c026399 049ece7a5a8484487408ed2568af333cbbdb10 Message-Authenticator = 0xedc54de4eb5ffc87ca17e9c9bc5d8619 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890255709ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 147 to 172.16.4.2 port 1812 EAP-Message = 0x0107004515800000003b14030100010116030100306b50179fa6a5874892188644af581c99 82c2b832ad254213ccdefa7fe910f8bac9e23cc3cd458bedf2b89c3fed673b0a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890254719ceb6482bebd55b3e66d Finished request 6. Going to the next request Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=148, length=409 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020700c015001703010020a6ac1d7537f30019672dce1064fd2e338b680d4d58a74a47a5d7 544b1333cfdb1703010090a9c3a0e34fbc778490e986587c22b5709abb8cd73b778f28e40d3c 62af54f98b6e2f0fbcf505633e21afb5cb9bbe2f6920c64bfa1fd494ca3e54ecd2587fa9f03e d91ebcb6f1ebe05eff8582d10d9c48aa1cd50a36ec10ba7aa8d2d0859742779e56ab4f75ebee c3f45c8f186b0f113d5da41bb5d56be9d9d458663101dd212b1ec19851dadb19c6fdc6a77044 9ca909 Message-Authenticator = 0xbb5e8ee22d928eea40ce4df5ad043ce6 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890254719ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0x4accd64250fe20627d27bedcc0281bc4 MS-CHAP2-Response = 0x6a004accd64250fe20627d27bedcc0281bc40000000000000000a95f7c15e711eb1f6d0bd7 6b0bac132ed1be63f0faaf8ca7 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0x4accd64250fe20627d27bedcc0281bc4 MS-CHAP2-Response = 0x6a004accd64250fe20627d27bedcc0281bc40000000000000000a95f7c15e711eb1f6d0bd7 6b0bac132ed1be63f0faaf8ca7 FreeRADIUS-Proxied-To = 127.0.0.1 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "Silver2@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "Silver2" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '4M-Silver' ORDER BY id [sql] User found in group 4M-Silver [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '4M-Silver' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for Silver2@WiMax.com with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> Silver2@WiMax.com [sql_log] expand: %{%{User-Name}:-DEFAULT} -> Silver2@WiMax.com [sql_log] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('Silver2@WiMax.com', 'Chap-Password', 'Access-Accept', '2010-10-20 13:36:58'); [sql_log] expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Framed-Filter-Id = "Silver" MS-CHAP2-Success = 0x6a533d46373730384443374231453134304131414141373331444432303831413142353245 324542344335 MS-MPPE-Recv-Key = 0x168ef7c1d920df032a9fd2acf0f9b82f MS-MPPE-Send-Key = 0x86034a3ca1d92388aaf58f286a9c9e02 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 148 to 172.16.4.2 port 1812 EAP-Message = 0x0108005f1580000000551703010050867c96689b4bd1574acd21f9891fa56511b9e18a9361 1d83afd8222dd04863417bf8cb57bd64ea5c7c66cb7be15247e290e85581bc1ef445dbf34f22 735c14695e5f72ad897b591bce22ad9cee638b9e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51768902577e9ceb6482bebd55b3e66d Finished request 7. Going to the next request Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=149, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020800061500 Message-Authenticator = 0x2006b33e2c36b0cd392c25f67988f668 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x51768902577e9ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql_log] expand: %{%{User-Name}:-DEFAULT} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql_log] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com', 'Chap-Password', 'Access-Accept', '2010-10-20 13:36:58'); [sql_log] expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok ++[exec] returns noop expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com ++[request] returns noop expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com expand: %{EAP-MSK} -> ++[reply] returns noop [wimax] MIP-RK = 0xc6fccac2e97b3d48060a81c368a9be35eeff4966da91a7026485ad67006af1912220236c32 d08bcb9c9d86d3aa2793cd058aea91ee6f3a2b8f9e7e0d4ea65eec [wimax] MIP-SPI = abe5d10b [wimax] WARNING: WiMAX-hHA-IP-MIP4 not found. Cannot calculate MN-HA-CMIP4 key ++[wimax] returns updated Sending Access-Accept of id 149 to 172.16.4.2 port 1812 Framed-Filter-Id = "Silver" EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" WiMAX-IP-Technology = CMIP4 WiMAX-FA-RK-Key = 0xc2d829f7e21967d6a9df3437f2b1edaeb88ef709 WiMAX-MSK = 0x WiMAX-MSK = 0x428bcfef58b8d50a5abcadfc80973cae7183c5bda974c561acd123d542bfc603ea846fa1bb 869097e3dd267abe5cb343f0cf3ab587f65006a35784f925e2723e WiMAX-FA-RK-SPI = 198305195 Finished request 8. Going to the next request Waking up in 3.1 seconds. Cleaning up request 1 ID 142 with timestamp +8 Cleaning up request 2 ID 143 with timestamp +8 Cleaning up request 3 ID 144 with timestamp +8 Cleaning up request 4 ID 145 with timestamp +8 Cleaning up request 5 ID 146 with timestamp +8 Waking up in 1.3 seconds. Cleaning up request 6 ID 147 with timestamp +10 Waking up in 0.1 seconds. Cleaning up request 7 ID 148 with timestamp +10 Cleaning up request 8 ID 149 with timestamp +10 Ready to process requests. -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Wednesday, October 20, 2010 12:15 PM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: A tale of 2 WiMax NAS David Peterson wrote:
I have 2 NAS with different requirements in their WiMax handling. One requires me to have: ... Enabled in order to work and the other requires those commented out. Is there a way to identify the NAS type to elegantly have those properly set?
What is different between the requests that are sent by the two NAS devices? Alan DeKok.