Re: User-Name attribute is not included in Access-Accept

28 Feb 2018


      Kindly use pastebin for logs sharing.
These debug logs create mess in email.

On Wed, 28 Feb 2018 1:44 pm kaoru eto, <etokaoru.frml@gmail.com> wrote:
...
Are there any reason why User-Name attribute is not included in
Access-Accept when Stripped-User-Name attribute is added by rlm_realm?
I think that RFC 3579 seems to require the User-Name attribute in
Access-Accept.
RFC3579
3.  Attributes
----------------------------------------
In order to permit forwarding of the Access-Reply by EAP-unaware proxies,
if a User-Name attribute was included in an Access-Request,
the RADIUS server MUST include the User-Name attribute in subsequent
Access-Accept packets.
----------------------------------------
Configuration for reproduce:
proxy.conf
----------------------------------------
#realm "NULL" {
# type=radius
# authhost=LOCAL
# accthost=LOCAL
#}
----------------------------------------
-> User-Name attribute is included in Access-Accept.
----------------------------------------
realm "NULL" {
type=radius
authhost=LOCAL
accthost=LOCAL
}
----------------------------------------
-> User-Name attribute is not included in Access-Accept.
Full degug log at reproduce:
----------------------------------------
/usr/local/radius316/sbin/radiusd -XX
Debug: Server was built with:
Debug:   accounting               : yes
Debug:   authentication           : yes
Debug:   ascend-binary-attributes : yes
Debug:   coa                      : yes
Debug:   control-socket           : yes
Debug:   detail                   : yes
Debug:   dhcp                     : yes
Debug:   dynamic-clients          : yes
Debug:   osfc2                    : no
Debug:   proxy                    : yes
Debug:   regex-pcre               : no
Debug:   regex-posix              : yes
Debug:   regex-posix-extended     : yes
Debug:   session-management       : yes
Debug:   stats                    : yes
Debug:   tcp                      : yes
Debug:   threads                  : yes
Debug:   tls                      : yes
Debug:   unlang                   : yes
Debug:   vmps                     : yes
Debug:   developer                : no
Debug: Server core libs:
Debug:   freeradius-server        : 3.0.16
Debug:   talloc                   : 2.0.*
Debug:   ssl                      : 1.0.1e release
Debug: Endianness:
Debug:   little
Debug: Compilation flags:
Debug:   cppflags : -isystem
/usr/local/adapter/account/php/include/php/ext/pcre/pcrelib
Debug:   cflags   : -I. -Isrc -include src/freeradius-devel/autoconf.h
-include src/freeradius-devel/build.h -include
src/freeradius-devel/features.h -include src/freeradius-devel/radpaths.h
-fno-strict-aliasing -Wno-date-time -g -O2 -Wall -std=c99 -D_GNU_SOURCE
-D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -DNDEBUG
-DIS_MODULE=1
Debug:   ldflags  :
Debug:   libs     : -lcrypto -lssl -ltalloc -lcap -lnsl -lresolv -ldl
-lpthread -lreadline
Debug:
Info: FreeRADIUS Version 3.0.16
Info: Copyright (C) 1999-2017 The FreeRADIUS server project and
contributors
Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
Info: PARTICULAR PURPOSE
Info: You may redistribute copies of FreeRADIUS under the terms of the
Info: GNU General Public License
Info: For more information about these matters, see the file named
COPYRIGHT
Info: Starting - reading configuration files ...
Debug: including dictionary file
/usr/local/radius316/share/freeradius/dictionary
Debug: including dictionary file
/usr/local/radius316/share/freeradius/dictionary.dhcp
Debug: including dictionary file
/usr/local/radius316/share/freeradius/dictionary.vqp
Debug: including dictionary file /usr/local/radius316/etc/raddb/dictionary
Debug: including configuration file
/usr/local/radius316/etc/raddb/radiusd.conf
Debug: including configuration file
/usr/local/radius316/etc/raddb/proxy.conf
Debug: including configuration file
/usr/local/radius316/etc/raddb/clients.conf
Debug: including files in directory
/usr/local/radius316/etc/raddb/mods-enabled/
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/echo
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/utf8
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/cache_eap
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/digest
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/unix
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/ntlm_auth
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/detail
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/linelog
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/expr
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/sradutmp
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/passwd
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/exec
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/pap
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/expiration
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/unpack
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/preprocess
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/radutmp
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/replicate
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/mschap
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/dynamic_clients
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/files
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/eap
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/soh
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/date
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/chap
Debug: including configuration file
/usr/local/radius316/etc/raddb/mods-enabled/logintime
Debug: including files in directory
/usr/local/radius316/etc/raddb/policy.d/
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/debug
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/abfab-tr
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/dhcp
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/operator-name
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/control
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/filter
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/canonicalization
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/moonshot-targeted-ids
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/cui
Debug: OPTIMIZING (${policy.cui_require_operator_name} == yes) --> FALSE
Debug: OPTIMIZING (no == yes) --> FALSE
Debug: OPTIMIZING (${policy.cui_require_operator_name} == yes) --> FALSE
Debug: OPTIMIZING (no == yes) --> FALSE
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/eap
Debug: including configuration file
/usr/local/radius316/etc/raddb/policy.d/accounting
Debug: including files in directory
/usr/local/radius316/etc/raddb/sites-enabled/
Debug: including configuration file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: including configuration file
/usr/local/radius316/etc/raddb/sites-enabled/inner-tunnel
Debug: main {
Debug:  security {
Debug:       allow_core_dumps = no
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[424]: The item
'max_attributes' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[442]: The item
'reject_delay' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[462]: The item
'status_server' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[472]: The item
'allow_vulnerable_openssl' is defined, but is unused by the configuration
Debug:  }
Debug:       name = "radiusd"
Debug:       prefix = "/usr/local/radius316"
Debug:       localstatedir = "/usr/local/radius316/var"
Debug:       logdir = "/usr/local/radius316/var/log/radius"
Debug:       run_dir = "/usr/local/radius316/var/run/radiusd"
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[67]: The item
'confdir' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[74]: The item 'db_dir'
is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[108]: The item
'libdir' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[119]: The item
'pidfile' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[140]: The item
'correct_escapes' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[194]: The item
'max_request_time' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[213]: The item
'cleanup_delay' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[250]: The item
'hostname_lookups' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[334]: The item
'checkrad' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[491]: The item
'proxy_requests' is defined, but is unused by the configuration
Debug: }
Debug: main {
Debug:       name = "radiusd"
Debug:       prefix = "/usr/local/radius316"
Debug:       localstatedir = "/usr/local/radius316/var"
Debug:       sbindir = "/usr/local/radius316/sbin"
Debug:       logdir = "/usr/local/radius316/var/log/radius"
Debug:       run_dir = "/usr/local/radius316/var/run/radiusd"
Debug:       libdir = "/usr/local/radius316/lib"
Debug:       radacctdir = "/usr/local/radius316/var/log/radius/radacct"
Debug:       hostname_lookups = no
Debug:       max_request_time = 30
Debug:       cleanup_delay = 5
Debug:       max_requests = 16384
Debug:       pidfile = "/usr/local/radius316/var/run/radiusd/radiusd.pid"
Debug:       checkrad = "/usr/local/radius316/sbin/checkrad"
Debug:       debug_level = 0
Debug:       proxy_requests = yes
Debug:  log {
Debug:       stripped_names = no
Debug:       auth = no
Debug:       auth_badpass = no
Debug:       auth_goodpass = no
Debug:       colourise = yes
Debug:       msg_denied = "You are already logged in - access denied"
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[268]: The item
'destination' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[285]: The item 'file'
is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[293]: The item
'syslog_facility' is defined, but is unused by the configuration
Debug:  }
Debug:  resources {
Debug:  }
Debug:  security {
Debug:       max_attributes = 200
Debug:       reject_delay = 1.000000
Debug:       status_server = yes
Debug:       allow_vulnerable_openssl = "yes"
Debug:  }
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[67]: The item
'confdir' is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[74]: The item 'db_dir'
is defined, but is unused by the configuration
Warning: /usr/local/radius316/etc/raddb/radiusd.conf[140]: The item
'correct_escapes' is defined, but is unused by the configuration
Debug: }
Debug: radiusd: #### Loading Realms and Home Servers ####
Debug:  proxy server {
Debug:       retry_delay = 5
Debug:       retry_count = 3
Debug:       default_fallback = no
Debug:       dead_time = 120
Debug:       wake_all_if_all_dead = no
Debug:  }
Debug:  home_server localhost {
Debug:       ipaddr = 127.0.0.1
Debug:       port = 1812
Debug:       type = "auth"
Debug:       secret = "testing123"
Debug:       response_window = 20.000000
Debug:       response_timeouts = 1
Debug:       max_outstanding = 65536
Debug:       zombie_period = 40
Debug:       status_check = "status-server"
Debug:       ping_interval = 30
Debug:       check_interval = 30
Debug:       check_timeout = 4
Debug:       num_answers_to_alive = 3
Debug:       revive_interval = 120
Debug:   limit {
Debug:       max_connections = 16
Debug:       max_requests = 0
Debug:       lifetime = 0
Debug:       idle_timeout = 0
Debug:   }
Debug:   coa {
Debug:       irt = 2
Debug:       mrt = 16
Debug:       mrc = 5
Debug:       mrd = 30
Debug:   }
Debug:  }
Debug:  home_server_pool my_auth_failover {
Debug:       type = fail-over
Debug:       home_server = localhost
Debug:  }
Debug:  realm example.com {
Debug:       auth_pool = my_auth_failover
Debug:  }
Debug:  realm LOCAL {
Debug:  }
Debug:  realm NULL {
Debug:       authhost = LOCAL
Debug:       accthost = LOCAL
Debug:  }
Debug: radiusd: #### Loading Clients ####
Debug:  client localhost {
Debug:       ipaddr = 127.0.0.1
Debug:       require_message_authenticator = no
Debug:       secret = "testing123"
Debug:       nas_type = "other"
Debug:       proto = "*"
Debug:   limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:   }
Debug:  }
Debug: Adding client 127.0.0.1/32 (127.0.0.1) to prefix tree 32
Debug:  client localhost_ipv6 {
Debug:       ipv6addr = ::1
Debug:       require_message_authenticator = no
Debug:       secret = "testing123"
Debug:   limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:   }
Debug:  }
Debug: Adding client ::1/128 (::1) to prefix tree 128
Debug:  client test {
Debug:       ipaddr = 192.168.0.0/16
Debug:       require_message_authenticator = no
Debug:       secret = "12345"
Debug:   limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:   }
Debug:  }
Debug: Adding client 192.168.0.0/16 (192.168.0.0) to prefix tree 16
Info: Debugger not attached
Debug:  # Creating Auth-Type = mschap
Debug:  # Creating Auth-Type = digest
Debug:  # Creating Auth-Type = eap
Debug:  # Creating Auth-Type = PAP
Debug:  # Creating Auth-Type = CHAP
Debug:  # Creating Auth-Type = MS-CHAP
Debug: radiusd: #### Instantiating modules ####
Debug:  modules {
Debug: Loading rlm_exec with path: /usr/local/radius316/lib/rlm_exec.so
Debug: Loaded rlm_exec, checking if it's valid
Debug:   # Loaded module rlm_exec
Debug:   # Loading module "echo" from file
/usr/local/radius316/etc/raddb/mods-enabled/echo
Debug:   exec echo {
Debug:       wait = yes
Debug:       program = "/bin/echo %{User-Name}"
Debug:       input_pairs = "request"
Debug:       output_pairs = "reply"
Debug:       shell_escape = yes
Debug:   }
Debug: Loading rlm_utf8 with path: /usr/local/radius316/lib/rlm_utf8.so
Debug: Loaded rlm_utf8, checking if it's valid
Debug:   # Loaded module rlm_utf8
Debug:   # Loading module "utf8" from file
/usr/local/radius316/etc/raddb/mods-enabled/utf8
Debug: Loading rlm_cache with path: /usr/local/radius316/lib/rlm_cache.so
Debug: Loaded rlm_cache, checking if it's valid
Debug:   # Loaded module rlm_cache
Debug:   # Loading module "cache_eap" from file
/usr/local/radius316/etc/raddb/mods-enabled/cache_eap
Debug:   cache cache_eap {
Debug:       driver = "rlm_cache_rbtree"
Debug:       key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
Debug:       ttl = 15
Debug:       max_entries = 0
Debug:       epoch = 0
Debug:       add_stats = no
Debug:   }
Debug: Loading rlm_digest with path: /usr/local/radius316/lib/rlm_digest.so
Debug: Loaded rlm_digest, checking if it's valid
Debug:   # Loaded module rlm_digest
Debug:   # Loading module "digest" from file
/usr/local/radius316/etc/raddb/mods-enabled/digest
Debug: Loading rlm_unix with path: /usr/local/radius316/lib/rlm_unix.so
Debug: Loaded rlm_unix, checking if it's valid
Debug:   # Loaded module rlm_unix
Debug:   # Loading module "unix" from file
/usr/local/radius316/etc/raddb/mods-enabled/unix
Debug:   unix {
Debug:       radwtmp = "/usr/local/radius316/var/log/radius/radwtmp"
Debug:   }
Debug: Creating attribute Unix-Group
Debug: Loading rlm_attr_filter with path:
/usr/local/radius316/lib/rlm_attr_filter.so
Debug: Loaded rlm_attr_filter, checking if it's valid
Debug:   # Loaded module rlm_attr_filter
Debug:   # Loading module "attr_filter.post-proxy" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug:   attr_filter attr_filter.post-proxy {
Debug:       filename =
"/usr/local/radius316/etc/raddb/mods-config/attr_filter/post-proxy"
Debug:       key = "%{Realm}"
Debug:       relaxed = no
Debug:   }
Debug:   # Loading module "attr_filter.pre-proxy" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug:   attr_filter attr_filter.pre-proxy {
Debug:       filename =
"/usr/local/radius316/etc/raddb/mods-config/attr_filter/pre-proxy"
Debug:       key = "%{Realm}"
Debug:       relaxed = no
Debug:   }
Debug:   # Loading module "attr_filter.access_reject" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug:   attr_filter attr_filter.access_reject {
Debug:       filename =
"/usr/local/radius316/etc/raddb/mods-config/attr_filter/access_reject"
Debug:       key = "%{User-Name}"
Debug:       relaxed = no
Debug:   }
Debug:   # Loading module "attr_filter.access_challenge" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug:   attr_filter attr_filter.access_challenge {
Debug:       filename =
"/usr/local/radius316/etc/raddb/mods-config/attr_filter/access_challenge"
Debug:       key = "%{User-Name}"
Debug:       relaxed = no
Debug:   }
Debug:   # Loading module "attr_filter.accounting_response" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug:   attr_filter attr_filter.accounting_response {
Debug:       filename =
"/usr/local/radius316/etc/raddb/mods-config/attr_filter/accounting_response"
Debug:       key = "%{User-Name}"
Debug:       relaxed = no
Debug:   }
Debug:   # Loading module "ntlm_auth" from file
/usr/local/radius316/etc/raddb/mods-enabled/ntlm_auth
Debug:   exec ntlm_auth {
Debug:       wait = yes
Debug:       program = "/path/to/ntlm_auth --request-nt-key
--domain=MYDOMAIN --username=%{mschap:User-Name}
--password=%{User-Password}"
Debug:       shell_escape = yes
Debug:   }
Debug: Loading rlm_detail with path: /usr/local/radius316/lib/rlm_detail.so
Debug: Loaded rlm_detail, checking if it's valid
Debug:   # Loaded module rlm_detail
Debug:   # Loading module "detail" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail
Debug:   detail {
Debug:       filename =
"/usr/local/radius316/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
Debug:       header = "%t"
Debug:       permissions = 384
Debug:       locking = no
Debug:       escape_filenames = no
Debug:       log_packet_header = no
Debug:   }
Debug: Loading rlm_linelog with path:
/usr/local/radius316/lib/rlm_linelog.so
Debug: Loaded rlm_linelog, checking if it's valid
Debug:   # Loaded module rlm_linelog
Debug:   # Loading module "linelog" from file
/usr/local/radius316/etc/raddb/mods-enabled/linelog
Debug:   linelog {
Debug:       filename = "/usr/local/radius316/var/log/radius/linelog"
Debug:       escape_filenames = no
Debug:       syslog_severity = "info"
Debug:       permissions = 384
Debug:       format = "This is a log message for %{User-Name}"
Debug:       reference = "messages.%{%{reply:Packet-Type}:-default}"
Debug:   }
Debug:   # Loading module "log_accounting" from file
/usr/local/radius316/etc/raddb/mods-enabled/linelog
Debug:   linelog log_accounting {
Debug:       filename =
"/usr/local/radius316/var/log/radius/linelog-accounting"
Debug:       escape_filenames = no
Debug:       syslog_severity = "info"
Debug:       permissions = 384
Debug:       format = ""
Debug:       reference =
"Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
Debug:   }
Debug: Loading rlm_always with path: /usr/local/radius316/lib/rlm_always.so
Debug: Loaded rlm_always, checking if it's valid
Debug:   # Loaded module rlm_always
Debug:   # Loading module "reject" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always reject {
Debug:       rcode = "reject"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "fail" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always fail {
Debug:       rcode = "fail"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "ok" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always ok {
Debug:       rcode = "ok"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "handled" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always handled {
Debug:       rcode = "handled"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "invalid" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always invalid {
Debug:       rcode = "invalid"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "userlock" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always userlock {
Debug:       rcode = "userlock"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "notfound" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always notfound {
Debug:       rcode = "notfound"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "noop" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always noop {
Debug:       rcode = "noop"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug:   # Loading module "updated" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   always updated {
Debug:       rcode = "updated"
Debug:       simulcount = 0
Debug:       mpp = no
Debug:   }
Debug: Loading rlm_expr with path: /usr/local/radius316/lib/rlm_expr.so
Debug: Loaded rlm_expr, checking if it's valid
Debug:   # Loaded module rlm_expr
Debug:   # Loading module "expr" from file
/usr/local/radius316/etc/raddb/mods-enabled/expr
Debug:   expr {
Debug:       safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/aeouaaaceeeeiio?uuuayAEOUsAAACEEEEIIO?UUU?"
Debug:   }
Debug: Loading rlm_radutmp with path:
/usr/local/radius316/lib/rlm_radutmp.so
Debug: Loaded rlm_radutmp, checking if it's valid
Debug:   # Loaded module rlm_radutmp
Debug:   # Loading module "sradutmp" from file
/usr/local/radius316/etc/raddb/mods-enabled/sradutmp
Debug:   radutmp sradutmp {
Debug:       filename = "/usr/local/radius316/var/log/radius/sradutmp"
Debug:       username = "%{User-Name}"
Debug:       case_sensitive = yes
Debug:       check_with_nas = yes
Debug:       permissions = 420
Debug:       caller_id = no
Debug:   }
Debug: Loading rlm_passwd with path: /usr/local/radius316/lib/rlm_passwd.so
Debug: Loaded rlm_passwd, checking if it's valid
Debug:   # Loaded module rlm_passwd
Debug:   # Loading module "etc_passwd" from file
/usr/local/radius316/etc/raddb/mods-enabled/passwd
Debug:   passwd etc_passwd {
Debug:       filename = "/etc/passwd"
Debug:       format = "*User-Name:Crypt-Password:"
Debug:       delimiter = ":"
Debug:       ignore_nislike = no
Debug:       ignore_empty = yes
Debug:       allow_multiple_keys = no
Debug:       hash_size = 100
Debug:   }
Debug:   # Loading module "exec" from file
/usr/local/radius316/etc/raddb/mods-enabled/exec
Debug:   exec {
Debug:       wait = no
Debug:       input_pairs = "request"
Debug:       shell_escape = yes
Debug:       timeout = 10
Debug:   }
Debug: Loading rlm_pap with path: /usr/local/radius316/lib/rlm_pap.so
Debug: Loaded rlm_pap, checking if it's valid
Debug:   # Loaded module rlm_pap
Debug:   # Loading module "pap" from file
/usr/local/radius316/etc/raddb/mods-enabled/pap
Debug:   pap {
Debug:       normalise = yes
Debug:   }
Debug:   # Loading module "auth_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   detail auth_log {
Debug:       filename =
"/usr/local/radius316/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
Debug:       header = "%t"
Debug:       permissions = 384
Debug:       locking = no
Debug:       escape_filenames = no
Debug:       log_packet_header = no
Debug:   }
Debug:   # Loading module "reply_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   detail reply_log {
Debug:       filename =
"/usr/local/radius316/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
Debug:       header = "%t"
Debug:       permissions = 384
Debug:       locking = no
Debug:       escape_filenames = no
Debug:       log_packet_header = no
Debug:   }
Debug:   # Loading module "pre_proxy_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   detail pre_proxy_log {
Debug:       filename =
"/usr/local/radius316/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
Debug:       header = "%t"
Debug:       permissions = 384
Debug:       locking = no
Debug:       escape_filenames = no
Debug:       log_packet_header = no
Debug:   }
Debug:   # Loading module "post_proxy_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   detail post_proxy_log {
Debug:       filename =
"/usr/local/radius316/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
Debug:       header = "%t"
Debug:       permissions = 384
Debug:       locking = no
Debug:       escape_filenames = no
Debug:       log_packet_header = no
Debug:   }
Debug: Loading rlm_expiration with path:
/usr/local/radius316/lib/rlm_expiration.so
Debug: Loaded rlm_expiration, checking if it's valid
Debug:   # Loaded module rlm_expiration
Debug:   # Loading module "expiration" from file
/usr/local/radius316/etc/raddb/mods-enabled/expiration
Debug: Loading rlm_unpack with path: /usr/local/radius316/lib/rlm_unpack.so
Debug: Loaded rlm_unpack, checking if it's valid
Debug:   # Loaded module rlm_unpack
Debug:   # Loading module "unpack" from file
/usr/local/radius316/etc/raddb/mods-enabled/unpack
Debug: Loading rlm_preprocess with path:
/usr/local/radius316/lib/rlm_preprocess.so
Debug: Loaded rlm_preprocess, checking if it's valid
Debug:   # Loaded module rlm_preprocess
Debug:   # Loading module "preprocess" from file
/usr/local/radius316/etc/raddb/mods-enabled/preprocess
Debug:   preprocess {
Debug:       huntgroups =
"/usr/local/radius316/etc/raddb/mods-config/preprocess/huntgroups"
Debug:       hints =
"/usr/local/radius316/etc/raddb/mods-config/preprocess/hints"
Debug:       with_ascend_hack = no
Debug:       ascend_channels_per_line = 23
Debug:       with_ntdomain_hack = no
Debug:       with_specialix_jetstream_hack = no
Debug:       with_cisco_vsa_hack = no
Debug:       with_alvarion_vsa_hack = no
Debug:   }
Debug:   # Loading module "radutmp" from file
/usr/local/radius316/etc/raddb/mods-enabled/radutmp
Debug:   radutmp {
Debug:       filename = "/usr/local/radius316/var/log/radius/radutmp"
Debug:       username = "%{User-Name}"
Debug:       case_sensitive = yes
Debug:       check_with_nas = yes
Debug:       permissions = 384
Debug:       caller_id = yes
Debug:   }
Debug: Loading rlm_replicate with path:
/usr/local/radius316/lib/rlm_replicate.so
Debug: Loaded rlm_replicate, checking if it's valid
Debug:   # Loaded module rlm_replicate
Debug:   # Loading module "replicate" from file
/usr/local/radius316/etc/raddb/mods-enabled/replicate
Debug: Loading rlm_mschap with path: /usr/local/radius316/lib/rlm_mschap.so
Debug: Loaded rlm_mschap, checking if it's valid
Debug:   # Loaded module rlm_mschap
Debug:   # Loading module "mschap" from file
/usr/local/radius316/etc/raddb/mods-enabled/mschap
Debug:   mschap {
Debug:       use_mppe = yes
Debug:       require_encryption = no
Debug:       require_strong = no
Debug:       with_ntdomain_hack = yes
Debug:    passchange {
Debug:    }
Debug:       allow_retry = yes
Debug:       winbind_retry_with_normalised_username = no
Debug:   }
Debug: Loading rlm_dynamic_clients with path:
/usr/local/radius316/lib/rlm_dynamic_clients.so
Debug: Loaded rlm_dynamic_clients, checking if it's valid
Debug:   # Loaded module rlm_dynamic_clients
Debug:   # Loading module "dynamic_clients" from file
/usr/local/radius316/etc/raddb/mods-enabled/dynamic_clients
Debug: Loading rlm_realm with path: /usr/local/radius316/lib/rlm_realm.so
Debug: Loaded rlm_realm, checking if it's valid
Debug:   # Loaded module rlm_realm
Debug:   # Loading module "IPASS" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   realm IPASS {
Debug:       format = "prefix"
Debug:       delimiter = "/"
Debug:       ignore_default = no
Debug:       ignore_null = no
Debug:   }
Debug:   # Loading module "suffix" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   realm suffix {
Debug:       format = "suffix"
Debug:       delimiter = "@"
Debug:       ignore_default = no
Debug:       ignore_null = no
Debug:   }
Debug:   # Loading module "realmpercent" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   realm realmpercent {
Debug:       format = "suffix"
Debug:       delimiter = "%"
Debug:       ignore_default = no
Debug:       ignore_null = no
Debug:   }
Debug:   # Loading module "ntdomain" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   realm ntdomain {
Debug:       format = "prefix"
Debug:       delimiter = "\\"
Debug:       ignore_default = no
Debug:       ignore_null = no
Debug:   }
Debug: Loading rlm_files with path: /usr/local/radius316/lib/rlm_files.so
Debug: Loaded rlm_files, checking if it's valid
Debug:   # Loaded module rlm_files
Debug:   # Loading module "files" from file
/usr/local/radius316/etc/raddb/mods-enabled/files
Debug:   files {
Debug:       filename =
"/usr/local/radius316/etc/raddb/mods-config/files/authorize"
Debug:       acctusersfile =
"/usr/local/radius316/etc/raddb/mods-config/files/accounting"
Debug:       preproxy_usersfile =
"/usr/local/radius316/etc/raddb/mods-config/files/pre-proxy"
Debug:   }
Debug: Loading rlm_eap with path: /usr/local/radius316/lib/rlm_eap.so
Debug: Loaded rlm_eap, checking if it's valid
Debug:   # Loaded module rlm_eap
Debug:   # Loading module "eap" from file
/usr/local/radius316/etc/raddb/mods-enabled/eap
Debug:   eap {
Debug:       default_eap_type = "md5"
Debug:       timer_expire = 60
Debug:       ignore_unknown_eap_types = no
Debug:       cisco_accounting_username_bug = no
Debug:       max_sessions = 16384
Debug:   }
Debug: Loading rlm_soh with path: /usr/local/radius316/lib/rlm_soh.so
Debug: Loaded rlm_soh, checking if it's valid
Debug:   # Loaded module rlm_soh
Debug:   # Loading module "soh" from file
/usr/local/radius316/etc/raddb/mods-enabled/soh
Debug:   soh {
Debug:       dhcp = yes
Debug:   }
Debug: Loading rlm_date with path: /usr/local/radius316/lib/rlm_date.so
Debug: Loaded rlm_date, checking if it's valid
Debug:   # Loaded module rlm_date
Debug:   # Loading module "date" from file
/usr/local/radius316/etc/raddb/mods-enabled/date
Debug:   date {
Debug:       format = "%b %e %Y %H:%M:%S %Z"
Debug:       utc = no
Debug:   }
Debug: Loading rlm_chap with path: /usr/local/radius316/lib/rlm_chap.so
Debug: Loaded rlm_chap, checking if it's valid
Debug:   # Loaded module rlm_chap
Debug:   # Loading module "chap" from file
/usr/local/radius316/etc/raddb/mods-enabled/chap
Debug: Loading rlm_logintime with path:
/usr/local/radius316/lib/rlm_logintime.so
Debug: Loaded rlm_logintime, checking if it's valid
Debug:   # Loaded module rlm_logintime
Debug:   # Loading module "logintime" from file
/usr/local/radius316/etc/raddb/mods-enabled/logintime
Debug:   logintime {
Debug:       minimum_timeout = 60
Debug:   }
Debug:   instantiate {
Debug:   }
Debug:   # Instantiating module "cache_eap" from file
/usr/local/radius316/etc/raddb/mods-enabled/cache_eap
Debug: Loading rlm_cache_rbtree with path:
/usr/local/radius316/lib/rlm_cache_rbtree.so
Debug: rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
rlm_cache_rbtree) loaded and linked
Debug:   # Instantiating module "attr_filter.post-proxy" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/attr_filter/post-proxy
Debug:   # Instantiating module "attr_filter.pre-proxy" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/attr_filter/pre-proxy
Debug:   # Instantiating module "attr_filter.access_reject" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/attr_filter/access_reject
Warning:
[/usr/local/radius316/etc/raddb/mods-config/attr_filter/access_reject]:11
Check item "FreeRADIUS-Response-Delay"    found in filter list for realm
"DEFAULT".
Warning:
[/usr/local/radius316/etc/raddb/mods-config/attr_filter/access_reject]:11
Check item "FreeRADIUS-Response-Delay-USec"       found in filter list for
realm "DEFAULT".
Debug:   # Instantiating module "attr_filter.access_challenge" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/attr_filter/access_challenge
Debug:   # Instantiating module "attr_filter.accounting_response" from file
/usr/local/radius316/etc/raddb/mods-enabled/attr_filter
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/attr_filter/accounting_response
Debug:   # Instantiating module "detail" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail
Debug:   # Instantiating module "linelog" from file
/usr/local/radius316/etc/raddb/mods-enabled/linelog
Debug:   # Instantiating module "log_accounting" from file
/usr/local/radius316/etc/raddb/mods-enabled/linelog
Debug:   # Instantiating module "reject" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "fail" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "ok" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "handled" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "invalid" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "userlock" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "notfound" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "noop" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "updated" from file
/usr/local/radius316/etc/raddb/mods-enabled/always
Debug:   # Instantiating module "etc_passwd" from file
/usr/local/radius316/etc/raddb/mods-enabled/passwd
Debug: rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
Debug:   # Instantiating module "pap" from file
/usr/local/radius316/etc/raddb/mods-enabled/pap
Debug:   # Instantiating module "auth_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug: rlm_detail (auth_log): 'User-Password' suppressed, will not appear
in detail output
Debug:   # Instantiating module "reply_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   # Instantiating module "pre_proxy_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   # Instantiating module "post_proxy_log" from file
/usr/local/radius316/etc/raddb/mods-enabled/detail.log
Debug:   # Instantiating module "expiration" from file
/usr/local/radius316/etc/raddb/mods-enabled/expiration
Debug:   # Instantiating module "preprocess" from file
/usr/local/radius316/etc/raddb/mods-enabled/preprocess
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/preprocess/huntgroups
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/preprocess/hints
Debug:   # Instantiating module "mschap" from file
/usr/local/radius316/etc/raddb/mods-enabled/mschap
Debug: rlm_mschap (mschap): using internal authentication
Debug:   # Instantiating module "IPASS" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   # Instantiating module "suffix" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   # Instantiating module "realmpercent" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   # Instantiating module "ntdomain" from file
/usr/local/radius316/etc/raddb/mods-enabled/realm
Debug:   # Instantiating module "files" from file
/usr/local/radius316/etc/raddb/mods-enabled/files
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/files/authorize
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/files/accounting
Debug: reading pairlist file
/usr/local/radius316/etc/raddb/mods-config/files/pre-proxy
Debug:   # Instantiating module "eap" from file
/usr/local/radius316/etc/raddb/mods-enabled/eap
Debug: Loading rlm_eap_md5 with path:
/usr/local/radius316/lib/rlm_eap_md5.so
Debug:    # Linked to sub-module rlm_eap_md5
Debug: Loading rlm_eap_leap with path:
/usr/local/radius316/lib/rlm_eap_leap.so
Debug:    # Linked to sub-module rlm_eap_leap
Debug: Loading rlm_eap_gtc with path:
/usr/local/radius316/lib/rlm_eap_gtc.so
Debug:    # Linked to sub-module rlm_eap_gtc
Debug:    gtc {
Debug:       challenge = "Password: "
Debug:       auth_type = "PAP"
Debug:    }
Debug: Loading rlm_eap_tls with path:
/usr/local/radius316/lib/rlm_eap_tls.so
Debug:    # Linked to sub-module rlm_eap_tls
Debug:    tls {
Debug:       tls = "tls-common"
Debug:    }
Debug:    tls-config tls-common {
Debug:       verify_depth = 0
Debug:       ca_path = "/usr/local/radius316/etc/raddb/certs"
Debug:       pem_file_type = yes
Debug:       private_key_file =
"/usr/local/radius316/etc/raddb/certs/server.pem"
Debug:       certificate_file =
"/usr/local/radius316/etc/raddb/certs/server.pem"
Debug:       ca_file = "/usr/local/radius316/etc/raddb/certs/ca.pem"
Debug:       private_key_password = "whatever"
Debug:       dh_file = "/usr/local/radius316/etc/raddb/certs/dh"
Debug:       fragment_size = 1024
Debug:       include_length = yes
Debug:       auto_chain = yes
Debug:       check_crl = no
Debug:       check_all_crl = no
Debug:       cipher_list = "DEFAULT"
Debug:       cipher_server_preference = no
Debug:       ecdh_curve = "prime256v1"
Debug:       tls_max_version = ""
Debug:       tls_min_version = "1.0"
Debug:     cache {
Debug:       enable = no
Debug:       lifetime = 24
Debug:       max_entries = 255
Debug:     }
Debug:     verify {
Debug:       skip_if_ocsp_ok = no
Debug:     }
Debug:     ocsp {
Debug:       enable = no
Debug:       override_cert_url = yes
Debug:       url = "http://127.0.0.1/ocsp/"
Debug:       use_nonce = yes
Debug:       timeout = 0
Debug:       softfail = no
Debug:     }
Debug:    }
Debug: Loading rlm_eap_ttls with path:
/usr/local/radius316/lib/rlm_eap_ttls.so
Debug:    # Linked to sub-module rlm_eap_ttls
Debug:    ttls {
Debug:       tls = "tls-common"
Debug:       default_eap_type = "md5"
Debug:       copy_request_to_tunnel = no
Debug:       use_tunneled_reply = no
Debug:       virtual_server = "inner-tunnel"
Debug:       include_length = yes
Debug:       require_client_cert = no
Debug:    }
Debug: tls: Using cached TLS configuration from previous invocation
Debug: Loading rlm_eap_peap with path:
/usr/local/radius316/lib/rlm_eap_peap.so
Debug:    # Linked to sub-module rlm_eap_peap
Debug:    peap {
Debug:       tls = "tls-common"
Debug:       default_eap_type = "mschapv2"
Debug:       copy_request_to_tunnel = no
Debug:       use_tunneled_reply = no
Debug:       proxy_tunneled_request_as_eap = yes
Debug:       virtual_server = "inner-tunnel"
Debug:       soh = no
Debug:       require_client_cert = no
Debug:    }
Debug: tls: Using cached TLS configuration from previous invocation
Debug: Loading rlm_eap_mschapv2 with path:
/usr/local/radius316/lib/rlm_eap_mschapv2.so
Debug:    # Linked to sub-module rlm_eap_mschapv2
Debug:    mschapv2 {
Debug:       with_ntdomain_hack = no
Debug:       send_error = no
Debug:    }
Debug:   # Instantiating module "logintime" from file
/usr/local/radius316/etc/raddb/mods-enabled/logintime
Debug:  } # modules
Debug: radiusd: #### Loading Virtual Servers ####
Debug: server { # from file /usr/local/radius316/etc/raddb/radiusd.conf
Debug: } # server
Debug: server default { # from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug:  authenticate {
Debug:   group {
Debug:    pap
Debug:   }
Debug:   group {
Debug:    chap
Debug:   }
Debug:   group {
Debug:    mschap
Debug:   }
Debug:   mschap
Debug:   digest
Debug:   eap
Debug:  } # authenticate
Debug:  authorize {
Debug:   policy filter_username {
Debug:    if (&User-Name) {
Debug:     if (&User-Name =~ / /) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: User-Name contains
whitespace'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /@[^@]*@/) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Multiple @ in User-Name'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /\.\./) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: User-Name contains
multiple ..s'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /@/ && !&User-Name =~ /@(.+)\.(.+)$/) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Realm does not have at
least one dot separator'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /\.$/) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Realm ends with a dot'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /@\./) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Realm begins with a dot'
Debug:      }
Debug:      reject
Debug:     }
Debug:    }
Debug:   }
Debug:   preprocess
Debug:   chap
Debug:   mschap
Debug:   digest
Debug:   suffix
Debug:   eap
Debug:   files
Warning: Ignoring "sql" (see raddb/mods-available/README.rst)
Warning: Ignoring "ldap" (see raddb/mods-available/README.rst)
Debug:   expiration
Debug:   logintime
Debug:   pap
Debug:  } # authorize
Debug:  preacct {
Debug:   preprocess
Debug:   policy acct_unique {
Debug:    update {
Debug:     &Tmp-String-9 := "ai:"
Debug:    }
Debug:    if ("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/ &&
"%{string:&Class}" =~ /^ai:([0-9a-f]{32})/) {
Debug:     update {
Debug:      &Acct-Unique-Session-Id := "%{md5:%{1},%{Acct-Session-ID}}"
Debug:     }
Debug:    }
Debug:    else {
Debug:     update {
Debug:      &Acct-Unique-Session-Id :=
"%{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}"
Debug:     }
Debug:    }
Debug:   }
Debug:   suffix
Debug:   files
Debug:  } # preacct
Debug:  accounting {
Debug:   detail
Debug:   unix
Debug:   exec
Debug:   attr_filter.accounting_response
Debug:  } # accounting
Debug:  post-proxy {
Debug:   eap
Debug:  } # post-proxy
Debug:  post-auth {
Debug:   update {
Debug:    &reply:[*] += &session-state:[*]
Debug:   }
Debug:   exec
Debug:   policy remove_reply_message_if_eap {
Debug:    if (&reply:EAP-Message && &reply:Reply-Message) {
Debug:     update {
Debug:      &reply:Reply-Message !* ANY
Debug:     }
Debug:    }
Debug:    else {
Debug:     noop
Debug:    }
Debug:   }
Debug:   group {
Debug:    attr_filter.access_reject
Debug:    eap
Debug:    policy remove_reply_message_if_eap {
Debug:     if (&reply:EAP-Message && &reply:Reply-Message) {
Debug:      update {
Debug:       &reply:Reply-Message !* ANY
Debug:      }
Debug:     }
Debug:     else {
Debug:      noop
Debug:     }
Debug:    }
Debug:   }
Debug:   group {
Debug:   }
Debug:  } # post-auth
Debug: } # server default
Debug: server inner-tunnel { # from file
/usr/local/radius316/etc/raddb/sites-enabled/inner-tunnel
Debug:  authenticate {
Debug:   group {
Debug:    pap
Debug:   }
Debug:   group {
Debug:    chap
Debug:   }
Debug:   group {
Debug:    mschap
Debug:   }
Debug:   mschap
Debug:   eap
Debug:  } # authenticate
Debug:  authorize {
Debug:   policy filter_username {
Debug:    if (&User-Name) {
Debug:     if (&User-Name =~ / /) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: User-Name contains
whitespace'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /@[^@]*@/) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Multiple @ in User-Name'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /\.\./) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: User-Name contains
multiple ..s'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /@/ && !&User-Name =~ /@(.+)\.(.+)$/) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Realm does not have at
least one dot separator'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /\.$/) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Realm ends with a dot'
Debug:      }
Debug:      reject
Debug:     }
Debug:     if (&User-Name =~ /@\./) {
Debug:      update {
Debug:       &Module-Failure-Message += 'Rejected: Realm begins with a dot'
Debug:      }
Debug:      reject
Debug:     }
Debug:    }
Debug:   }
Debug:   chap
Debug:   mschap
Debug:   suffix
Debug:   update {
Debug:    &control:Proxy-To-Realm := LOCAL
Debug:   }
Debug:   eap
Debug:   files
Debug:   expiration
Debug:   logintime
Debug:   pap
Debug:  } # authorize
Debug:  session {
Debug:   radutmp
Debug:  } # session
Debug:  post-proxy {
Debug:   eap
Debug:  } # post-proxy
Debug:  post-auth {
Info:  # Skipping contents of 'if' as it is always 'false' --
/usr/local/radius316/etc/raddb/sites-enabled/inner-tunnel:331
Debug:   if (false) {
Debug:   }
Debug:   group {
Debug:    attr_filter.access_reject
Debug:    update {
Debug:     &outer.session-state:Module-Failure-Message :=
&Module-Failure-Message
Debug:    }
Debug:   }
Debug:  } # post-auth
Debug: } # server inner-tunnel
Debug: Created signal pipe.  Read end FD 5, write end FD 6
Debug: radiusd: #### Opening IP addresses and Ports ####
Debug: Loading proto_auth with path: /usr/local/radius316/lib/proto_auth.so
Debug: Loading proto_auth failed: /usr/local/radius316/lib/proto_auth.so:
cannot open shared object file: No such file or directory - No such file or
directory
Debug: Loading library using linker search path(s)
Debug: Defaults         : /lib:/usr/lib
Debug: Failed with error: proto_auth.so: cannot open shared object file: No
such file or directory
Debug: listen {
Debug:       type = "auth"
Debug:       ipaddr = *
Debug:       port = 0
Debug:    limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:    }
Debug: }
Debug: Loading proto_acct with path: /usr/local/radius316/lib/proto_acct.so
Debug: Loading proto_acct failed: /usr/local/radius316/lib/proto_acct.so:
cannot open shared object file: No such file or directory - No such file or
directory
Debug: Loading library using linker search path(s)
Debug: Defaults         : /lib:/usr/lib
Debug: Failed with error: proto_acct.so: cannot open shared object file: No
such file or directory
Debug: listen {
Debug:       type = "acct"
Debug:       ipaddr = *
Debug:       port = 0
Debug:    limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:    }
Debug: }
Debug: Loading proto_auth with path: /usr/local/radius316/lib/proto_auth.so
Debug: Loading proto_auth failed: /usr/local/radius316/lib/proto_auth.so:
cannot open shared object file: No such file or directory - No such file or
directory
Debug: Loading library using linker search path(s)
Debug: Defaults         : /lib:/usr/lib
Debug: Failed with error: proto_auth.so: cannot open shared object file: No
such file or directory
Debug: listen {
Debug:       type = "auth"
Debug:       ipv6addr = ::
Debug:       port = 0
Debug:    limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:    }
Debug: }
Debug: Loading proto_acct with path: /usr/local/radius316/lib/proto_acct.so
Debug: Loading proto_acct failed: /usr/local/radius316/lib/proto_acct.so:
cannot open shared object file: No such file or directory - No such file or
directory
Debug: Loading library using linker search path(s)
Debug: Defaults         : /lib:/usr/lib
Debug: Failed with error: proto_acct.so: cannot open shared object file: No
such file or directory
Debug: listen {
Debug:       type = "acct"
Debug:       ipv6addr = ::
Debug:       port = 0
Debug:    limit {
Debug:       max_connections = 16
Debug:       lifetime = 0
Debug:       idle_timeout = 30
Debug:    }
Debug: }
Debug: Loading proto_auth with path: /usr/local/radius316/lib/proto_auth.so
Debug: Loading proto_auth failed: /usr/local/radius316/lib/proto_auth.so:
cannot open shared object file: No such file or directory - No such file or
directory
Debug: Loading library using linker search path(s)
Debug: Defaults         : /lib:/usr/lib
Debug: Failed with error: proto_auth.so: cannot open shared object file: No
such file or directory
Debug: listen {
Debug:       type = "auth"
Debug:       ipaddr = 127.0.0.1
Debug:       port = 18120
Debug: }
Debug: Listening on auth address * port 1812 bound to server default
Debug: Listening on acct address * port 1813 bound to server default
Debug: Listening on auth address :: port 1812 bound to server default
Debug: Listening on acct address :: port 1813 bound to server default
Debug: Listening on auth address 127.0.0.1 port 18120 bound to server
inner-tunnel
Debug: Opened new proxy socket 'proxy address * port 53124'
Debug: Listening on proxy address * port 53124
Debug: Opened new proxy socket 'proxy address :: port 51628'
Debug: Listening on proxy address :: port 51628
Info: Ready to process requests
Debug: (0) Received Access-Request Id 0 from 192.168.103.4:35803 to
192.168.103.1:1812 length 122
Debug: (0)   User-Name = "user001"
Debug: (0)   NAS-IP-Address = 127.0.0.1
Debug: (0)   Calling-Station-Id = "02-00-00-00-00-01"
Debug: (0)   Framed-MTU = 1400
Debug: (0)   NAS-Port-Type = Wireless-802.11
Debug: (0)   Connect-Info = "CONNECT 11Mbps 802.11b"
Debug: (0)   EAP-Message = 0x0200000c0175736572303031
Debug: (0)   Message-Authenticator = 0x1b713d66546c5df82fc9440221b72bee
Debug: (0) session-state: No State attribute
Debug: (0) # Executing section authorize from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (0)   authorize {
Debug: (0)     policy filter_username {
Debug: (0)       if (&User-Name) {
Debug: (0)       if (&User-Name)  -> TRUE
Debug: (0)       if (&User-Name)  {
Debug: (0)         if (&User-Name =~ / /) {
Debug: No matches
Debug: (0)         if (&User-Name =~ / /)  -> FALSE
Debug: (0)         if (&User-Name =~ /@[^@]*@/ ) {
Debug: No matches
Debug: (0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
Debug: (0)         if (&User-Name =~ /\.\./ ) {
Debug: No matches
Debug: (0)         if (&User-Name =~ /\.\./ )  -> FALSE
Debug: (0)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
Debug: No matches
Debug: (0)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
Debug: (0)         if (&User-Name =~ /\.$/)  {
Debug: No matches
Debug: (0)         if (&User-Name =~ /\.$/)   -> FALSE
Debug: (0)         if (&User-Name =~ /@\./)  {
Debug: No matches
Debug: (0)         if (&User-Name =~ /@\./)   -> FALSE
Debug: (0)       } # if (&User-Name)  = notfound
Debug: (0)     } # policy filter_username = notfound
Debug: (0)     modsingle[authorize]: calling preprocess (rlm_preprocess)
Debug: (0)     modsingle[authorize]: returned from preprocess
(rlm_preprocess)
Debug: (0)     [preprocess] = ok
Debug: (0)     modsingle[authorize]: calling chap (rlm_chap)
Debug: (0)     modsingle[authorize]: returned from chap (rlm_chap)
Debug: (0)     [chap] = noop
Debug: (0)     modsingle[authorize]: calling mschap (rlm_mschap)
Debug: (0)     modsingle[authorize]: returned from mschap (rlm_mschap)
Debug: (0)     [mschap] = noop
Debug: (0)     modsingle[authorize]: calling digest (rlm_digest)
Debug: (0)     modsingle[authorize]: returned from digest (rlm_digest)
Debug: (0)     [digest] = noop
Debug: (0)     modsingle[authorize]: calling suffix (rlm_realm)
Debug: (0) suffix: Checking for suffix after "@"
Debug: (0) suffix: No '@' in User-Name = "user001", looking up realm NULL
Debug: (0) suffix: Found realm "NULL"
Debug: (0) suffix: Adding Stripped-User-Name = "user001"
Debug: (0) suffix: Adding Realm = "NULL"
Debug: (0) suffix: Authentication realm is LOCAL
Debug: (0)     modsingle[authorize]: returned from suffix (rlm_realm)
Debug: (0)     [suffix] = ok
Debug: (0)     modsingle[authorize]: calling eap (rlm_eap)
Debug: (0) eap: Peer sent EAP Response (code 2) ID 0 length 12
Debug: (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
Debug: (0)     modsingle[authorize]: returned from eap (rlm_eap)
Debug: (0)     [eap] = ok
Debug: (0)   } # authorize = ok
Debug: (0) Found Auth-Type = eap
Debug: (0) # Executing group from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (0)   authenticate {
Debug: (0)     modsingle[authenticate]: calling eap (rlm_eap)
Debug: (0) eap: Peer sent packet with method EAP Identity (1)
Debug: (0) eap: Calling submodule eap_md5 to process data
Debug: (0) eap_md5: Issuing MD5 Challenge
Debug: (0) eap: Sending EAP Request (code 1) ID 1 length 22
Debug: (0) eap: EAP session adding &reply:State = 0x2943cbb82942cf0f
Debug: (0)     modsingle[authenticate]: returned from eap (rlm_eap)
Debug: (0)     [eap] = handled
Debug: (0)   } # authenticate = handled
Debug: (0) Using Post-Auth-Type Challenge
Debug: (0) # Executing group from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (0)   Challenge { ... } # empty sub-section is ignored
Debug: (0) session-state: Nothing to cache
Debug: (0) Sent Access-Challenge Id 0 from 192.168.103.1:1812 to
192.168.103.4:35803 length 0
Debug: (0)   EAP-Message = 0x0101001604106467fcdc56eaf2330ba7f13f533cc588
Debug: (0)   Message-Authenticator = 0x00000000000000000000000000000000
Debug: (0)   State = 0x2943cbb82942cf0f1f4c032fd1862a21
Debug: (0) Finished request
Debug: Waking up in 4.9 seconds.
Debug: (1) Received Access-Request Id 1 from 192.168.103.4:35803 to
192.168.103.1:1812 length 134
Debug: (1)   User-Name = "user001"
Debug: (1)   NAS-IP-Address = 127.0.0.1
Debug: (1)   Calling-Station-Id = "02-00-00-00-00-01"
Debug: (1)   Framed-MTU = 1400
Debug: (1)   NAS-Port-Type = Wireless-802.11
Debug: (1)   Connect-Info = "CONNECT 11Mbps 802.11b"
Debug: (1)   EAP-Message = 0x020100060319
Debug: (1)   State = 0x2943cbb82942cf0f1f4c032fd1862a21
Debug: (1)   Message-Authenticator = 0xc82b0685d2ea8c8d20720b0ae20b6706
Debug: (1) session-state: No cached attributes
Debug: (1) # Executing section authorize from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (1)   authorize {
Debug: (1)     policy filter_username {
Debug: (1)       if (&User-Name) {
Debug: (1)       if (&User-Name)  -> TRUE
Debug: (1)       if (&User-Name)  {
Debug: (1)         if (&User-Name =~ / /) {
Debug: No matches
Debug: (1)         if (&User-Name =~ / /)  -> FALSE
Debug: (1)         if (&User-Name =~ /@[^@]*@/ ) {
Debug: No matches
Debug: (1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
Debug: (1)         if (&User-Name =~ /\.\./ ) {
Debug: No matches
Debug: (1)         if (&User-Name =~ /\.\./ )  -> FALSE
Debug: (1)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
Debug: No matches
Debug: (1)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
Debug: (1)         if (&User-Name =~ /\.$/)  {
Debug: No matches
Debug: (1)         if (&User-Name =~ /\.$/)   -> FALSE
Debug: (1)         if (&User-Name =~ /@\./)  {
Debug: No matches
Debug: (1)         if (&User-Name =~ /@\./)   -> FALSE
Debug: (1)       } # if (&User-Name)  = notfound
Debug: (1)     } # policy filter_username = notfound
Debug: (1)     modsingle[authorize]: calling preprocess (rlm_preprocess)
Debug: (1)     modsingle[authorize]: returned from preprocess
(rlm_preprocess)
Debug: (1)     [preprocess] = ok
Debug: (1)     modsingle[authorize]: calling chap (rlm_chap)
Debug: (1)     modsingle[authorize]: returned from chap (rlm_chap)
Debug: (1)     [chap] = noop
Debug: (1)     modsingle[authorize]: calling mschap (rlm_mschap)
Debug: (1)     modsingle[authorize]: returned from mschap (rlm_mschap)
Debug: (1)     [mschap] = noop
Debug: (1)     modsingle[authorize]: calling digest (rlm_digest)
Debug: (1)     modsingle[authorize]: returned from digest (rlm_digest)
Debug: (1)     [digest] = noop
Debug: (1)     modsingle[authorize]: calling suffix (rlm_realm)
Debug: (1) suffix: Checking for suffix after "@"
Debug: (1) suffix: No '@' in User-Name = "user001", looking up realm NULL
Debug: (1) suffix: Found realm "NULL"
Debug: (1) suffix: Adding Stripped-User-Name = "user001"
Debug: (1) suffix: Adding Realm = "NULL"
Debug: (1) suffix: Authentication realm is LOCAL
Debug: (1)     modsingle[authorize]: returned from suffix (rlm_realm)
Debug: (1)     [suffix] = ok
Debug: (1)     modsingle[authorize]: calling eap (rlm_eap)
Debug: (1) eap: Peer sent EAP Response (code 2) ID 1 length 6
Debug: (1) eap: No EAP Start, assuming it's an on-going EAP conversation
Debug: (1)     modsingle[authorize]: returned from eap (rlm_eap)
Debug: (1)     [eap] = updated
Debug: (1)     modsingle[authorize]: calling files (rlm_files)
Debug: (1) files: users: Matched entry user001 at line 221
Debug: (1) files: ::: FROM 1 TO 0 MAX 1
Debug: (1) files: ::: Examining Reply-Message
Debug: Hello, %{User-Name}
Debug: Parsed xlat tree:
Debug: literal --> Hello,
Debug: attribute --> User-Name
Debug: (1) files: EXPAND Hello, %{User-Name}
Debug: (1) files:    --> Hello, user001
Debug: (1) files: ::: APPENDING Reply-Message FROM 0 TO 0
Debug: (1) files: ::: TO in 0 out 0
Debug: (1)     modsingle[authorize]: returned from files (rlm_files)
Debug: (1)     [files] = ok
Debug: (1)     modsingle[authorize]: calling expiration (rlm_expiration)
Debug: (1)     modsingle[authorize]: returned from expiration
(rlm_expiration)
Debug: (1)     [expiration] = noop
Debug: (1)     modsingle[authorize]: calling logintime (rlm_logintime)
Debug: (1)     modsingle[authorize]: returned from logintime
(rlm_logintime)
Debug: (1)     [logintime] = noop
Debug: (1)     modsingle[authorize]: calling pap (rlm_pap)
WARNING: (1) pap: Auth-Type already set.  Not setting to PAP
Debug: (1)     modsingle[authorize]: returned from pap (rlm_pap)
Debug: (1)     [pap] = noop
Debug: (1)   } # authorize = updated
Debug: (1) Found Auth-Type = eap
Debug: (1) # Executing group from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (1)   authenticate {
Debug: (1)     modsingle[authenticate]: calling eap (rlm_eap)
Debug: (1) eap: Expiring EAP session with state 0x2943cbb82942cf0f
Debug: (1) eap: Finished EAP session with state 0x2943cbb82942cf0f
Debug: (1) eap: Previous EAP request found for state 0x2943cbb82942cf0f,
released from the list
Debug: (1) eap: Peer sent packet with method EAP NAK (3)
Debug: (1) eap: Found mutually acceptable type PEAP (25)
Debug: (1) eap: Calling submodule eap_peap to process data
Debug: (1) eap_peap: Initiating new EAP-TLS session
Debug: (1) eap_peap: [eaptls start] = request
Debug: (1) eap: Sending EAP Request (code 1) ID 2 length 6
Debug: (1) eap: EAP session adding &reply:State = 0x2943cbb82841d20f
Debug: (1)     modsingle[authenticate]: returned from eap (rlm_eap)
Debug: (1)     [eap] = handled
Debug: (1)   } # authenticate = handled
Debug: (1) Using Post-Auth-Type Challenge
Debug: (1) # Executing group from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (1)   Challenge { ... } # empty sub-section is ignored
Debug: (1) session-state: Nothing to cache
Debug: (1) Sent Access-Challenge Id 1 from 192.168.103.1:1812 to
192.168.103.4:35803 length 0
Debug: (1)   Reply-Message = "Hello, user001"
Debug: (1)   EAP-Message = 0x010200061920
Debug: (1)   Message-Authenticator = 0x00000000000000000000000000000000
Debug: (1)   State = 0x2943cbb82841d20f1f4c032fd1862a21
Debug: (1) Finished request
Debug: Waking up in 4.9 seconds.
Debug: (2) Received Access-Request Id 2 from 192.168.103.4:35803 to
192.168.103.1:1812 length 293
Debug: (2)   User-Name = "user001"
Debug: (2)   NAS-IP-Address = 127.0.0.1
Debug: (2)   Calling-Station-Id = "02-00-00-00-00-01"
Debug: (2)   Framed-MTU = 1400
Debug: (2)   NAS-Port-Type = Wireless-802.11
Debug: (2)   Connect-Info = "CONNECT 11Mbps 802.11b"
Debug: (2)   EAP-Message =
0x020200a519800000009b16030100960100009203015a9650accd2e450636c95743fa5ce471555ee10a89cced36c1bbdf4e92a2a7cb00004cc014c00a0039003800880087c00fc00500350084c013c00900330032009a009900450044c00ec004002f00960041c012c00800160013c00dc003000a0007c0
Debug: (2)   State = 0x2943cbb82841d20f1f4c032fd1862a21
Debug: (2)   Message-Authenticator = 0x925091610982fc04f4f09cdf1dcf1186
Debug: (2) session-state: No cached attributes
Debug: (2) # Executing section authorize from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (2)   authorize {
Debug: (2)     policy filter_username {
Debug: (2)       if (&User-Name) {
Debug: (2)       if (&User-Name)  -> TRUE
Debug: (2)       if (&User-Name)  {
Debug: (2)         if (&User-Name =~ / /) {
Debug: No matches
Debug: (2)         if (&User-Name =~ / /)  -> FALSE
Debug: (2)         if (&User-Name =~ /@[^@]*@/ ) {
Debug: No matches
Debug: (2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
Debug: (2)         if (&User-Name =~ /\.\./ ) {
Debug: No matches
Debug: (2)         if (&User-Name =~ /\.\./ )  -> FALSE
Debug: (2)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
Debug: No matches
Debug: (2)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
Debug: (2)         if (&User-Name =~ /\.$/)  {
Debug: No matches
Debug: (2)         if (&User-Name =~ /\.$/)   -> FALSE
Debug: (2)         if (&User-Name =~ /@\./)  {
Debug: No matches
Debug: (2)         if (&User-Name =~ /@\./)   -> FALSE
Debug: (2)       } # if (&User-Name)  = notfound
Debug: (2)     } # policy filter_username = notfound
Debug: (2)     modsingle[authorize]: calling preprocess (rlm_preprocess)
Debug: (2)     modsingle[authorize]: returned from preprocess
(rlm_preprocess)
Debug: (2)     [preprocess] = ok
Debug: (2)     modsingle[authorize]: calling chap (rlm_chap)
Debug: (2)     modsingle[authorize]: returned from chap (rlm_chap)
Debug: (2)     [chap] = noop
Debug: (2)     modsingle[authorize]: calling mschap (rlm_mschap)
Debug: (2)     modsingle[authorize]: returned from mschap (rlm_mschap)
Debug: (2)     [mschap] = noop
Debug: (2)     modsingle[authorize]: calling digest (rlm_digest)
Debug: (2)     modsingle[authorize]: returned from digest (rlm_digest)
Debug: (2)     [digest] = noop
Debug: (2)     modsingle[authorize]: calling suffix (rlm_realm)
Debug: (2) suffix: Checking for suffix after "@"
Debug: (2) suffix: No '@' in User-Name = "user001", looking up realm NULL
Debug: (2) suffix: Found realm "NULL"
Debug: (2) suffix: Adding Stripped-User-Name = "user001"
Debug: (2) suffix: Adding Realm = "NULL"
Debug: (2) suffix: Authentication realm is LOCAL
Debug: (2)     modsingle[authorize]: returned from suffix (rlm_realm)
Debug: (2)     [suffix] = ok
Debug: (2)     modsingle[authorize]: calling eap (rlm_eap)
Debug: (2) eap: Peer sent EAP Response (code 2) ID 2 length 165
Debug: (2) eap: Continuing tunnel setup
Debug: (2)     modsingle[authorize]: returned from eap (rlm_eap)
Debug: (2)     [eap] = ok
Debug: (2)   } # authorize = ok
Debug: (2) Found Auth-Type = eap
Debug: (2) # Executing group from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (2)   authenticate {
Debug: (2)     modsingle[authenticate]: calling eap (rlm_eap)
Debug: (2) eap: Expiring EAP session with state 0x2943cbb82841d20f
Debug: (2) eap: Finished EAP session with state 0x2943cbb82841d20f
Debug: (2) eap: Previous EAP request found for state 0x2943cbb82841d20f,
released from the list
Debug: (2) eap: Peer sent packet with method EAP PEAP (25)
Debug: (2) eap: Calling submodule eap_peap to process data
Debug: (2) eap_peap: Continuing EAP-TLS
Debug: (2) eap_peap: Peer sent flags --L
Debug: (2) eap_peap: Peer indicated complete TLS record size will be 155
bytes
Debug: (2) eap_peap: Got complete TLS record (155 bytes)
Debug: (2) eap_peap: [eaptls verify] = length included
Debug: (2) eap_peap: (other): before/accept initialization
Debug: (2) eap_peap: TLS_accept: before/accept initialization
Debug: (2) eap_peap: <<< recv TLS 1.0 Handshake [length 0096], ClientHello
Debug: (2) eap_peap: TLS_accept: SSLv3 read client hello A
Debug: (2) eap_peap: >>> send TLS 1.0 Handshake [length 003e], ServerHello
Debug: (2) eap_peap: TLS_accept: SSLv3 write server hello A
Debug: (2) eap_peap: >>> send TLS 1.0 Handshake [length 08d3], Certificate
Debug: (2) eap_peap: TLS_accept: SSLv3 write certificate A
Debug: (2) eap_peap: >>> send TLS 1.0 Handshake [length 014b],
ServerKeyExchange
Debug: (2) eap_peap: TLS_accept: SSLv3 write key exchange A
Debug: (2) eap_peap: >>> send TLS 1.0 Handshake [length 0004],
ServerHelloDone
Debug: (2) eap_peap: TLS_accept: SSLv3 write server done A
Debug: (2) eap_peap: TLS_accept: SSLv3 flush data
Debug: (2) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
Debug: (2) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
Debug: (2) eap_peap: In SSL Handshake Phase
Debug: (2) eap_peap: In SSL Accept mode
Debug: (2) eap_peap: [eaptls process] = handled
Debug: (2) eap: Sending EAP Request (code 1) ID 3 length 1004
Debug: (2) eap: EAP session adding &reply:State = 0x2943cbb82b40d20f
Debug: (2)     modsingle[authenticate]: returned from eap (rlm_eap)
Debug: (2)     [eap] = handled
Debug: (2)   } # authenticate = handled
Debug: (2) Using Post-Auth-Type Challenge
Debug: (2) # Executing group from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (2)   Challenge { ... } # empty sub-section is ignored
Debug: (2) session-state: Nothing to cache
Debug: (2) Sent Access-Challenge Id 2 from 192.168.103.1:1812 to
192.168.103.4:35803 length 0
Debug: (2)   EAP-Message =
0x010303ec19c000000a74160301003e0200003a03015a9650c9f8406b23f795268b7d9728863db6131fbcb6bdb2f17c3b9c7a35eeba00c014000012ff01000100000b000403000102000f00010116030108d30b0008cf0008cc0003de308203da308202c2a003020102020101300d06092a864886f70d01
Debug: (2)   Message-Authenticator = 0x00000000000000000000000000000000
Debug: (2)   State = 0x2943cbb82b40d20f1f4c032fd1862a21
Debug: (2) Finished request
Debug: Waking up in 4.9 seconds.
Debug: (3) Received Access-Request Id 3 from 192.168.103.4:35803 to
192.168.103.1:1812 length 134
Debug: (3)   User-Name = "user001"
Debug: (3)   NAS-IP-Address = 127.0.0.1
Debug: (3)   Calling-Station-Id = "02-00-00-00-00-01"
Debug: (3)   Framed-MTU = 1400
Debug: (3)   NAS-Port-Type = Wireless-802.11
Debug: (3)   Connect-Info = "CONNECT 11Mbps 802.11b"
Debug: (3)   EAP-Message = 0x020300061900
Debug: (3)   State = 0x2943cbb82b40d20f1f4c032fd1862a21
Debug: (3)   Message-Authenticator = 0x13435caaa8eef5857e7508494cc1c865
Debug: (3) session-state: No cached attributes
Debug: (3) # Executing section authorize from file
/usr/local/radius316/etc/raddb/sites-enabled/default
Debug: (3)   authorize {
Debug: (3)     policy filter_username {
Debug: (3)       if (&User-Name) {
Debug: (3)       if (&User-Name)  -> TRUE
Debug: (3)       if (&User-Name)  {
Debug: (3)         if (&User-Name =~ / /) {
Debug: No matches
Debug: (3)         if (&User-Name =~ / /)  -> FALSE
Debug: (3)         if (&User-Name =~ /@[^@]*@/ ) {
Debug: No matches
Debug: (3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
Debug: (3)         if (&User-Name =~ /\.\./ ) {
Debug: No matches
Debug: (3)         if (&User-Name =~ /\.\./ )

Re: User-Name attribute is not included in Access-Accept

Abdul Basit