I see PAP supports them all, So how do i utilize this? Does windows, android, and ios not support PAP?<br><br><div class="gmail_quote">On Sun, Nov 4, 2012 at 4:20 PM, Ryan Summey <span dir="ltr">&lt;<a href="mailto:ryan.summey@gmail.com" target="_blank">ryan.summey@gmail.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">So how do we secure the user accounts in the database?<div class="HOEnZb"><div class="h5"><br><br><div class="gmail_quote">
On Sun, Nov 4, 2012 at 4:11 PM, Blake Covarrubias <span dir="ltr">&lt;<a href="mailto:blake@covarrubi.as" target="_blank">blake@covarrubi.as</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="auto"><div><span style="font-family:&#39;.HelveticaNeueUI&#39;;font-size:15px;line-height:19px;white-space:nowrap"><a href="http://deployingradius.com/documents/protocols/compatibility.html" target="_blank">http://deployingradius.com/documents/protocols/compatibility.html</a></span></div>

<div><font face=".HelveticaNeueUI"><span style="font-size:15px;line-height:19px;white-space:nowrap"><br></span></font></div><div><font face=".HelveticaNeueUI"><span style="font-size:15px;line-height:19px;white-space:nowrap">md5 passwords are not compatible with MS-CHAP.<br>

</span></font><br><span>--</span><div>Blake Covarrubias</div></div><div><div><div><br>On Nov 4, 2012, at 13:56, Ryan Summey &lt;<a href="mailto:ryan.summey@gmail.com" target="_blank">ryan.summey@gmail.com</a>&gt; wrote:<br>

<br></div><blockquote type="cite"><div><div> Below is the log. I am able to connect using clear-text passwords but not encrypted passwords... What is confusing me is if i do a radtest it works fine using the users credentials that are encrypted...  But as you can see below ths is me trying to connecting from my phone using the account i created in the databse with the password md5. Again this works when i do a radtest but not in a real world test. Only clear-text pw work in the realworld test. </div>


<div><br></div><div>Thank you for your time.</div><div><br></div><div><br></div><div><br></div><div><br></div><div>freeradius -X</div><div>FreeRADIUS Version 2.1.12, for host i686-pc-linux-gnu, built on Sep 11 2012 at 22:27:08</div>


<div>Copyright (C) 1999-2009 The FreeRADIUS server project and contributors.</div><div>There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A</div><div>PARTICULAR PURPOSE.</div><div>You may redistribute copies of FreeRADIUS under the terms of the</div>


<div>GNU General Public License v2.</div><div>Starting - reading configuration files ...</div><div>including configuration file /etc/freeradius/radiusd.conf</div><div>including configuration file /etc/freeradius/proxy.conf</div>


<div>including configuration file /etc/freeradius/clients.conf</div><div>including files in directory /etc/freeradius/modules/</div><div>including configuration file /etc/freeradius/modules/always</div><div>including configuration file /etc/freeradius/modules/mac2ip</div>


<div>including configuration file /etc/freeradius/modules/sql_log</div><div>including configuration file /etc/freeradius/modules/smbpasswd</div><div>including configuration file /etc/freeradius/modules/detail</div><div>including configuration file /etc/freeradius/modules/smsotp</div>


<div>including configuration file /etc/freeradius/modules/cui</div><div>including configuration file /etc/freeradius/modules/wimax</div><div>including configuration file /etc/freeradius/modules/replicate</div><div>including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login</div>


<div>including configuration file /etc/freeradius/modules/sradutmp</div><div>including configuration file /etc/freeradius/modules/pap</div><div>including configuration file /etc/freeradius/modules/echo</div><div>including configuration file /etc/freeradius/modules/expiration</div>


<div>including configuration file /etc/freeradius/modules/files</div><div>including configuration file /etc/freeradius/modules/mac2vlan</div><div>including configuration file /etc/freeradius/modules/acct_unique</div><div>


including configuration file /etc/freeradius/modules/krb5</div><div>including configuration file /etc/freeradius/modules/mschap</div><div>including configuration file /etc/freeradius/modules/checkval</div><div>including configuration file /etc/freeradius/modules/preprocess</div>


<div>including configuration file /etc/freeradius/modules/logintime</div><div>including configuration file /etc/freeradius/modules/pam</div><div>including configuration file /etc/freeradius/modules/passwd</div><div>including configuration file /etc/freeradius/modules/etc_group</div>


<div>including configuration file /etc/freeradius/modules/opendirectory</div><div>including configuration file /etc/freeradius/modules/attr_filter</div><div>including configuration file /etc/freeradius/modules/linelog</div>


<div>including configuration file /etc/freeradius/modules/soh</div><div>including configuration file /etc/freeradius/modules/attr_rewrite</div><div>including configuration file /etc/freeradius/modules/chap</div><div>including configuration file /etc/freeradius/modules/rediswho</div>


<div>including configuration file /etc/freeradius/modules/counter</div><div>including configuration file /etc/freeradius/modules/digest</div><div>including configuration file /etc/freeradius/modules/policy</div><div>including configuration file /etc/freeradius/modules/unix</div>


<div>including configuration file /etc/freeradius/modules/ldap</div><div>including configuration file /etc/freeradius/modules/otp</div><div>including configuration file /etc/freeradius/modules/radutmp</div><div>including configuration file /etc/freeradius/modules/perl</div>


<div>including configuration file /etc/freeradius/modules/dynamic_clients</div><div>including configuration file /etc/freeradius/modules/<a href="http://detail.example.com" target="_blank">detail.example.com</a></div><div>

including configuration file /etc/freeradius/modules/redis</div>
<div>including configuration file /etc/freeradius/modules/ntlm_auth</div><div>including configuration file /etc/freeradius/modules/inner-eap</div><div>including configuration file /etc/freeradius/modules/ippool</div><div>


including configuration file /etc/freeradius/modules/realm</div><div>including configuration file /etc/freeradius/modules/detail.log</div><div>including configuration file /etc/freeradius/modules/exec</div><div>including configuration file /etc/freeradius/modules/expr</div>


<div>including configuration file /etc/freeradius/eap.conf</div><div>including configuration file /etc/freeradius/sql.conf</div><div>including configuration file /etc/freeradius/sql/mysql/dialup.conf</div><div>including configuration file /etc/freeradius/policy.conf</div>


<div>including files in directory /etc/freeradius/sites-enabled/</div><div>including configuration file /etc/freeradius/sites-enabled/default</div><div>including configuration file /etc/freeradius/sites-enabled/inner-tunnel</div>


<div>main {</div><div>        user = &quot;freerad&quot;</div><div>        group = &quot;freerad&quot;</div><div>        allow_core_dumps = no</div><div>}</div><div>including dictionary file /etc/freeradius/dictionary</div>


<div>main {</div><div>        name = &quot;freeradius&quot;</div><div>        prefix = &quot;/usr&quot;</div><div>        localstatedir = &quot;/var&quot;</div><div>        sbindir = &quot;/usr/sbin&quot;</div><div>        logdir = &quot;/var/log/freeradius&quot;</div>


<div>        run_dir = &quot;/var/run/freeradius&quot;</div><div>        libdir = &quot;/usr/lib/freeradius&quot;</div><div>        radacctdir = &quot;/var/log/freeradius/radacct&quot;</div><div>        hostname_lookups = no</div>


<div>        max_request_time = 30</div><div>        cleanup_delay = 5</div><div>        max_requests = 1024</div><div>        pidfile = &quot;/var/run/freeradius/freeradius.pid&quot;</div><div>        checkrad = &quot;/usr/sbin/checkrad&quot;</div>


<div>        debug_level = 0</div><div>        proxy_requests = yes</div><div> log {</div><div>        stripped_names = no</div><div>        auth = no</div><div>        auth_badpass = no</div><div>        auth_goodpass = no</div>


<div> }</div><div> security {</div><div>        max_attributes = 200</div><div>        reject_delay = 1</div><div>        status_server = yes</div><div> }</div><div>}</div><div>radiusd: #### Loading Realms and Home Servers ####</div>


<div> proxy server {</div><div>        retry_delay = 5</div><div>        retry_count = 3</div><div>        default_fallback = no</div><div>        dead_time = 120</div><div>        wake_all_if_all_dead = no</div><div> }</div>


<div> home_server localhost {</div><div>        ipaddr = 127.0.0.1</div><div>        port = 1812</div><div>        type = &quot;auth&quot;</div><div>        secret = &quot;testing123&quot;</div><div>        response_window = 20</div>


<div>        max_outstanding = 65536</div><div>        require_message_authenticator = yes</div><div>        zombie_period = 40</div><div>        status_check = &quot;status-server&quot;</div><div>        ping_interval = 30</div>


<div>        check_interval = 30</div><div>        num_answers_to_alive = 3</div><div>        num_pings_to_alive = 3</div><div>        revive_interval = 120</div><div>        status_check_timeout = 4</div><div>  coa {</div>


<div>        irt = 2</div><div>        mrt = 16</div><div>        mrc = 5</div><div>        mrd = 30</div><div>  }</div><div> }</div><div> home_server_pool my_auth_failover {</div><div>        type = fail-over</div><div>

        home_server = localhost</div>
<div> }</div><div> realm <a href="http://example.com" target="_blank">example.com</a> {</div><div>        auth_pool = my_auth_failover</div><div> }</div><div> realm LOCAL {</div><div> }</div><div>radiusd: #### Loading Clients ####</div>

<div>
 client localhost {</div><div>        ipaddr = 127.0.0.1</div><div>        require_message_authenticator = no</div><div>        secret = &quot;testsecret&quot;</div><div>        nastype = &quot;other&quot;</div><div> }</div>


<div> client 192.168.2.24 {</div><div>        require_message_authenticator = no</div><div>        secret = &quot;testsecret&quot;</div><div>        shortname = &quot;cvpn-pptp&quot;</div><div>        nastype = &quot;other&quot;</div>


<div> }</div><div>radiusd: #### Instantiating modules ####</div><div> instantiate {</div><div> Module: Linked to module rlm_exec</div><div> Module: Instantiating module &quot;exec&quot; from file /etc/freeradius/modules/exec</div>


<div>  exec {</div><div>        wait = no</div><div>        input_pairs = &quot;request&quot;</div><div>        shell_escape = yes</div><div>  }</div><div> Module: Linked to module rlm_expr</div><div> Module: Instantiating module &quot;expr&quot; from file /etc/freeradius/modules/expr</div>


<div> Module: Linked to module rlm_expiration</div><div> Module: Instantiating module &quot;expiration&quot; from file /etc/freeradius/modules/expiration</div><div>  expiration {</div><div>        reply-message = &quot;Password Has Expired  &quot;</div>


<div>  }</div><div> Module: Linked to module rlm_logintime</div><div> Module: Instantiating module &quot;logintime&quot; from file /etc/freeradius/modules/logintime</div><div>  logintime {</div><div>        reply-message = &quot;You are calling outside your allowed timespan  &quot;</div>


<div>        minimum-timeout = 60</div><div>  }</div><div> }</div><div>radiusd: #### Loading Virtual Servers ####</div><div>server { # from file /etc/freeradius/radiusd.conf</div><div> modules {</div><div>  Module: Creating Auth-Type = digest</div>


<div>  Module: Creating Post-Auth-Type = REJECT</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Linked to module rlm_pap</div><div> Module: Instantiating module &quot;pap&quot; from file /etc/freeradius/modules/pap</div>


<div>  pap {</div><div>        encryption_scheme = &quot;auto&quot;</div><div>        auto_header = no</div><div>  }</div><div> Module: Linked to module rlm_chap</div><div> Module: Instantiating module &quot;chap&quot; from file /etc/freeradius/modules/chap</div>


<div> Module: Linked to module rlm_mschap</div><div> Module: Instantiating module &quot;mschap&quot; from file /etc/freeradius/modules/mschap</div><div>  mschap {</div><div>        use_mppe = yes</div><div>        require_encryption = yes</div>


<div>        require_strong = yes</div><div>        with_ntdomain_hack = no</div><div>        allow_retry = yes</div><div>  }</div><div> Module: Linked to module rlm_digest</div><div> Module: Instantiating module &quot;digest&quot; from file /etc/freeradius/modules/digest</div>


<div> Module: Linked to module rlm_unix</div><div> Module: Instantiating module &quot;unix&quot; from file /etc/freeradius/modules/unix</div><div>  unix {</div><div>        radwtmp = &quot;/var/log/freeradius/radwtmp&quot;</div>


<div>  }</div><div> Module: Linked to module rlm_eap</div><div> Module: Instantiating module &quot;eap&quot; from file /etc/freeradius/eap.conf</div><div>  eap {</div><div>        default_eap_type = &quot;md5&quot;</div>

<div>
        timer_expire = 60</div><div>        ignore_unknown_eap_types = no</div><div>        cisco_accounting_username_bug = no</div><div>        max_sessions = 4096</div><div>  }</div><div> Module: Linked to sub-module rlm_eap_md5</div>


<div> Module: Instantiating eap-md5</div><div> Module: Linked to sub-module rlm_eap_leap</div><div> Module: Instantiating eap-leap</div><div> Module: Linked to sub-module rlm_eap_gtc</div><div> Module: Instantiating eap-gtc</div>


<div>   gtc {</div><div>        challenge = &quot;Password: &quot;</div><div>        auth_type = &quot;PAP&quot;</div><div>   }</div><div> Module: Linked to sub-module rlm_eap_tls</div><div> Module: Instantiating eap-tls</div>


<div>   tls {</div><div>        rsa_key_exchange = no</div><div>        dh_key_exchange = yes</div><div>        rsa_key_length = 512</div><div>        dh_key_length = 512</div><div>        verify_depth = 0</div><div>        CA_path = &quot;/etc/freeradius/certs&quot;</div>


<div>        pem_file_type = yes</div><div>        private_key_file = &quot;/etc/freeradius/certs/server.key&quot;</div><div>        certificate_file = &quot;/etc/freeradius/certs/server.pem&quot;</div><div>        CA_file = &quot;/etc/freeradius/certs/ca.pem&quot;</div>


<div>        private_key_password = &quot;whatever&quot;</div><div>        dh_file = &quot;/etc/freeradius/certs/dh&quot;</div><div>        random_file = &quot;/dev/urandom&quot;</div><div>        fragment_size = 1024</div>


<div>        include_length = yes</div><div>        check_crl = no</div><div>        cipher_list = &quot;DEFAULT&quot;</div><div>        make_cert_command = &quot;/etc/freeradius/certs/bootstrap&quot;</div><div>        ecdh_curve = &quot;prime256v1&quot;</div>


<div>    cache {</div><div>        enable = no</div><div>        lifetime = 24</div><div>        max_entries = 255</div><div>    }</div><div>    verify {</div><div>    }</div><div>    ocsp {</div><div>        enable = no</div>


<div>        override_cert_url = yes</div><div>        url = &quot;<a href="http://127.0.0.1/ocsp/" target="_blank">http://127.0.0.1/ocsp/</a>&quot;</div><div>    }</div><div>   }</div><div> Module: Linked to sub-module rlm_eap_ttls</div>


<div> Module: Instantiating eap-ttls</div><div>   ttls {</div><div>        default_eap_type = &quot;md5&quot;</div><div>        copy_request_to_tunnel = no</div><div>        use_tunneled_reply = no</div><div>        virtual_server = &quot;inner-tunnel&quot;</div>


<div>        include_length = yes</div><div>   }</div><div> Module: Linked to sub-module rlm_eap_peap</div><div> Module: Instantiating eap-peap</div><div>   peap {</div><div>        default_eap_type = &quot;mschapv2&quot;</div>


<div>        copy_request_to_tunnel = no</div><div>        use_tunneled_reply = no</div><div>        proxy_tunneled_request_as_eap = yes</div><div>        virtual_server = &quot;inner-tunnel&quot;</div><div>        soh = no</div>


<div>   }</div><div> Module: Linked to sub-module rlm_eap_mschapv2</div><div> Module: Instantiating eap-mschapv2</div><div>   mschapv2 {</div><div>        with_ntdomain_hack = no</div><div>        send_error = no</div><div>


   }</div><div> Module: Checking authorize {...} for more modules to load</div><div> Module: Linked to module rlm_preprocess</div><div> Module: Instantiating module &quot;preprocess&quot; from file /etc/freeradius/modules/preprocess</div>


<div>  preprocess {</div><div>        huntgroups = &quot;/etc/freeradius/huntgroups&quot;</div><div>        hints = &quot;/etc/freeradius/hints&quot;</div><div>        with_ascend_hack = no</div><div>        ascend_channels_per_line = 23</div>


<div>        with_ntdomain_hack = no</div><div>        with_specialix_jetstream_hack = no</div><div>        with_cisco_vsa_hack = no</div><div>        with_alvarion_vsa_hack = no</div><div>  }</div><div> Module: Linked to module rlm_realm</div>


<div> Module: Instantiating module &quot;suffix&quot; from file /etc/freeradius/modules/realm</div><div>  realm suffix {</div><div>        format = &quot;suffix&quot;</div><div>        delimiter = &quot;@&quot;</div><div>


        ignore_default = no</div><div>        ignore_null = no</div><div>  }</div><div> Module: Linked to module rlm_files</div><div> Module: Instantiating module &quot;files&quot; from file /etc/freeradius/modules/files</div>


<div>  files {</div><div>        usersfile = &quot;/etc/freeradius/users&quot;</div><div>        acctusersfile = &quot;/etc/freeradius/acct_users&quot;</div><div>        preproxy_usersfile = &quot;/etc/freeradius/preproxy_users&quot;</div>


<div>        compat = &quot;no&quot;</div><div>  }</div><div> Module: Linked to module rlm_sql</div><div> Module: Instantiating module &quot;sql&quot; from file /etc/freeradius/sql.conf</div><div>  sql {</div><div>        driver = &quot;rlm_sql_mysql&quot;</div>


<div>        server = &quot;<a href="http://mysql.claravpn.com" target="_blank">mysql.claravpn.com</a>&quot;</div><div>        port = &quot;3306&quot;</div><div>        login = &quot;cvpnadmin&quot;</div><div>        password = &quot;106westwhiteoakstreet&quot;</div>


<div>        radius_db = &quot;cvpnradiusdb&quot;</div><div>        read_groups = yes</div><div>        sqltrace = no</div><div>        sqltracefile = &quot;/var/log/freeradius/sqltrace.sql&quot;</div><div>        readclients = no</div>


<div>        deletestalesessions = yes</div><div>        num_sql_socks = 5</div><div>        lifetime = 0</div><div>        max_queries = 0</div><div>        sql_user_name = &quot;%{User-Name}&quot;</div><div>        default_user_profile = &quot;&quot;</div>


<div>        nas_query = &quot;SELECT id, nasname, shortname, type, secret, server FROM nas&quot;</div><div>        authorize_check_query = &quot;SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = &#39;%{SQL-User-Name}&#39;           ORDER BY id&quot;</div>


<div>        authorize_reply_query = &quot;SELECT id, username, attribute, value, op           FROM radreply           WHERE username = &#39;%{SQL-User-Name}&#39;           ORDER BY id&quot;</div><div>        authorize_group_check_query = &quot;SELECT id, groupname, attribute,           Value, op           FROM radgroupcheck           WHERE groupname = &#39;%{Sql-Group}&#39;           ORDER BY id&quot;</div>


<div>        authorize_group_reply_query = &quot;SELECT id, groupname, attribute,           value, op           FROM radgroupreply           WHERE groupname = &#39;%{Sql-Group}&#39;           ORDER BY id&quot;</div><div>

        accounting_onoff_query = &quot;          UPDATE radacct           SET              acctstoptime       =  &#39;%S&#39;,              acctsessiontime    =  unix_timestamp(&#39;%S&#39;) -                                    unix_timestamp(acctstarttime),              acctterminatecause =  &#39;%{Acct-Terminate-Cause}&#39;,              acctstopdelay      =  %{%{Acct-Delay-Time}:-0}           WHERE acctstoptime IS NULL           AND nasipaddress      =  &#39;%{NAS-IP-Address}&#39;           AND acctstarttime     &lt;= &#39;%S&#39;&quot;</div>


<div>        accounting_update_query = &quot;           UPDATE radacct           SET              framedipaddress = &#39;%{Framed-IP-Address}&#39;,              acctsessiontime     = &#39;%{Acct-Session-Time}&#39;,              acctinputoctets     = &#39;%{%{Acct-Input-Gigawords}:-0}&#39;  &lt;&lt; 32 |                                    &#39;%{%{Acct-Input-Octets}:-0}&#39;,              acctoutputoctets    = &#39;%{%{Acct-Output-Gigawords}:-0}&#39; &lt;&lt; 32 |                                    &#39;%{%{Acct-Output-Octets}:-0}&#39;           WHERE acctsessionid = &#39;%{Acct-Session-Id}&#39;           AND username        = &#39;%{SQL-User-Name}&#39;           AND nasipaddress    = &#39;%{NAS-IP-Address}&#39;&quot;</div>


<div>        accounting_update_query_alt = &quot;           INSERT INTO radacct             (acctsessionid,    acctuniqueid,      username,              realm,            nasipaddress,      nasportid,              nasporttype,      acctstarttime,     acctsessiontime,              acctauthentic,    connectinfo_start, acctinputoctets,              acctoutputoctets, calledstationid,   callingstationid,              servicetype,      framedprotocol,    framedipaddress,              acctstartdelay,   xascendsessionsvrkey)           VALUES             (&#39;%{Acct-Session-Id}&#39;, &#39;%{Acct-Unique-Session-Id}&#39;,              &#39;%{SQL-User-Name}&#39;,              &#39;%{Realm}&#39;, &#39;%{NAS-IP-Address}&#39;, &#39;%{NAS-Port}&#39;,              &#39;%{NAS-Port-Type}&#39;,              DATE_SUB(&#39;%S&#39;,                       INTERVAL (%{%{Acct-Session-Time}:-0} +                                 %{%{Acct-Delay-Time}:-0}) SECOND),                       &#39;%{Acct-Session-Time}&#39;,              &#39;%{Acct-Authentic}&#39;, &#39;&#39;,              &#39;%{%{Acct-Input-Gigawords}:-0}&#39; &lt;&lt; 32 |              &#39;%{%{Acct-Input-Octets}:-0}&#39;,              &#39;%{%{Acct-Output-Gigawords}:-0}&#39; &lt;&lt; 32 |              &#39;%{%{Acct-Output-Octets}:-0}&#39;,              &#39;%{Called-Station-Id}&#39;, &#39;%{Calling-Station-Id}&#39;,              &#39;%{Service-Type}&#39;, &#39;%{Framed-Protocol}&#39;,              &#39;%{Framed-IP-Address}&#39;,              &#39;0&#39;, &#39;%{X-Ascend-Session-Svr-Key}&#39;)&quot;</div>


<div>        accounting_start_query = &quot;           INSERT INTO radacct             (acctsessionid,    acctuniqueid,     username,              realm,            nasipaddress,     nasportid,              nasporttype,      acctstarttime,    acctstoptime,              acctsessiontime,  acctauthentic,    connectinfo_start,              connectinfo_stop, acctinputoctets,  acctoutputoctets,              calledstationid,  callingstationid, acctterminatecause,              servicetype,      framedprotocol,   framedipaddress,              acctstartdelay,   acctstopdelay,    xascendsessionsvrkey)           VALUES             (&#39;%{Acct-Session-Id}&#39;, &#39;%{Acct-Unique-Session-Id}&#39;,              &#39;%{SQL-User-Name}&#39;,              &#39;%{Realm}&#39;, &#39;%{NAS-IP-Address}&#39;, &#39;%{NAS-Port}&#39;,              &#39;%{NAS-Port-Type}&#39;, &#39;%S&#39;, NULL,              &#39;0&#39;, &#39;%{Acct-Authentic}&#39;, &#39;%{Connect-Info}&#39;,              &#39;&#39;, &#39;0&#39;, &#39;0&#39;,              &#39;%{Called-Station-Id}&#39;, &#39;%{Calling-Station-Id}&#39;, &#39;&#39;,              &#39;%{Service-Type}&#39;, &#39;%{Framed-Protocol}&#39;, &#39;%{Framed-IP-Address}&#39;,              &#39;%{%{Acct-Delay-Time}:-0}&#39;, &#39;0&#39;, &#39;%{X-Ascend-Session-Svr-Key}&#39;)&quot;</div>


<div>        accounting_start_query_alt = &quot;           UPDATE radacct SET              acctstarttime     = &#39;%S&#39;,              acctstartdelay    = &#39;%{%{Acct-Delay-Time}:-0}&#39;,              connectinfo_start = &#39;%{Connect-Info}&#39;           WHERE acctsessionid  = &#39;%{Acct-Session-Id}&#39;           AND username         = &#39;%{SQL-User-Name}&#39;           AND nasipaddress     = &#39;%{NAS-IP-Address}&#39;&quot;</div>


<div>        accounting_stop_query = &quot;           UPDATE radacct SET              acctstoptime       = &#39;%S&#39;,              acctsessiontime    = &#39;%{Acct-Session-Time}&#39;,              acctinputoctets    = &#39;%{%{Acct-Input-Gigawords}:-0}&#39; &lt;&lt; 32 |                                   &#39;%{%{Acct-Input-Octets}:-0}&#39;,              acctoutputoctets   = &#39;%{%{Acct-Output-Gigawords}:-0}&#39; &lt;&lt; 32 |                                   &#39;%{%{Acct-Output-Octets}:-0}&#39;,              acctterminatecause = &#39;%{Acct-Terminate-Cause}&#39;,              acctstopdelay      = &#39;%{%{Acct-Delay-Time}:-0}&#39;,              connectinfo_stop   = &#39;%{Connect-Info}&#39;           WHERE acctsessionid   = &#39;%{Acct-Session-Id}&#39;           AND username          = &#39;%{SQL-User-Name}&#39;           AND nasipaddress      = &#39;%{NAS-IP-Address}&#39;&quot;</div>


<div>        accounting_stop_query_alt = &quot;           INSERT INTO radacct             (acctsessionid, acctuniqueid, username,              realm, nasipaddress, nasportid,              nasporttype, acctstarttime, acctstoptime,              acctsessiontime, acctauthentic, connectinfo_start,              connectinfo_stop, acctinputoctets, acctoutputoctets,              calledstationid, callingstationid, acctterminatecause,              servicetype, framedprotocol, framedipaddress,              acctstartdelay, acctstopdelay)           VALUES             (&#39;%{Acct-Session-Id}&#39;, &#39;%{Acct-Unique-Session-Id}&#39;,              &#39;%{SQL-User-Name}&#39;,              &#39;%{Realm}&#39;, &#39;%{NAS-IP-Address}&#39;, &#39;%{NAS-Port}&#39;,              &#39;%{NAS-Port-Type}&#39;,              DATE_SUB(&#39;%S&#39;,                  INTERVAL (%{%{Acct-Session-Time}:-0} +                  %{%{Acct-Delay-Time}:-0}) SECOND),              &#39;%S&#39;, &#39;%{Acct-Session-Time}&#39;, &#39;%{Acct-Authentic}&#39;, &#39;&#39;,              &#39;%{Connect-Info}&#39;,              &#39;%{%{Acct-Input-Gigawords}:-0}&#39; &lt;&lt; 32 |              &#39;%{%{Acct-Input-Octets}:-0}&#39;,              &#39;%{%{Acct-Output-Gigawords}:-0}&#39; &lt;&lt; 32 |              &#39;%{%{Acct-Output-Octets}:-0}&#39;,              &#39;%{Called-Station-Id}&#39;, &#39;%{Calling-Station-Id}&#39;,              &#39;%{Acct-Terminate-Cause}&#39;,              &#39;%{Service-Type}&#39;, &#39;%{Framed-Protocol}&#39;, &#39;%{Framed-IP-Address}&#39;,              &#39;0&#39;, &#39;%{%{Acct-Delay-Time}:-0}&#39;)&quot;</div>


<div>        group_membership_query = &quot;SELECT groupname           FROM radusergroup           WHERE username = &#39;%{SQL-User-Name}&#39;           ORDER BY priority&quot;</div><div>        connect_failure_retry_delay = 60</div>


<div>        simul_count_query = &quot;SELECT COUNT(*)                              #FROM radacct                              #WHERE username = &#39;%{SQL-User-Name}&#39;                              #AND acctstoptime IS NULL&quot;</div>


<div>        simul_verify_query = &quot;SELECT radacctid, acctsessionid, username,                                nasipaddress, nasportid, framedipaddress,                                callingstationid, framedprotocol                                FROM radacct                                WHERE username = &#39;%{SQL-User-Name}&#39;                                AND acctstoptime IS NULL&quot;</div>


<div>        postauth_query = &quot;INSERT INTO radpostauth                           (username, pass, reply, authdate)                           VALUES (                           &#39;%{User-Name}&#39;,                           &#39;%{%{User-Password}:-%{Chap-Password}}&#39;,                           &#39;%{reply:Packet-Type}&#39;, &#39;%S&#39;)&quot;</div>


<div>        safe-characters = &quot;@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /&quot;</div><div>  }</div><div>rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked</div><div>


rlm_sql (sql): Attempting to connect to <a href="http://cvpnadmin@mysql.claravpn.com:3306/cvpnradiusdb" target="_blank">cvpnadmin@mysql.claravpn.com:3306/cvpnradiusdb</a></div><div>rlm_sql (sql): starting 0</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #0</div>


<div>rlm_sql_mysql: Starting connect to MySQL server for #0</div><div>rlm_sql (sql): Connected new DB handle, #0</div><div>rlm_sql (sql): starting 1</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #1</div><div>


rlm_sql_mysql: Starting connect to MySQL server for #1</div><div>rlm_sql (sql): Connected new DB handle, #1</div><div>rlm_sql (sql): starting 2</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #2</div><div>rlm_sql_mysql: Starting connect to MySQL server for #2</div>


<div>rlm_sql (sql): Connected new DB handle, #2</div><div>rlm_sql (sql): starting 3</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #3</div><div>rlm_sql_mysql: Starting connect to MySQL server for #3</div><div>


rlm_sql (sql): Connected new DB handle, #3</div><div>rlm_sql (sql): starting 4</div><div>rlm_sql (sql): Attempting to connect rlm_sql_mysql #4</div><div>rlm_sql_mysql: Starting connect to MySQL server for #4</div><div>rlm_sql (sql): Connected new DB handle, #4</div>


<div> Module: Checking preacct {...} for more modules to load</div><div> Module: Linked to module rlm_acct_unique</div><div> Module: Instantiating module &quot;acct_unique&quot; from file /etc/freeradius/modules/acct_unique</div>


<div>  acct_unique {</div><div>        key = &quot;User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port&quot;</div><div>  }</div><div> Module: Checking accounting {...} for more modules to load</div><div>


 Module: Linked to module rlm_detail</div><div> Module: Instantiating module &quot;detail&quot; from file /etc/freeradius/modules/detail</div><div>  detail {</div><div>        detailfile = &quot;/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d&quot;</div>


<div>        header = &quot;%t&quot;</div><div>        detailperm = 384</div><div>        dirperm = 493</div><div>        locking = no</div><div>        log_packet_header = no</div><div>  }</div><div> Module: Linked to module rlm_radutmp</div>


<div> Module: Instantiating module &quot;radutmp&quot; from file /etc/freeradius/modules/radutmp</div><div>  radutmp {</div><div>        filename = &quot;/var/log/freeradius/radutmp&quot;</div><div>        username = &quot;%{User-Name}&quot;</div>


<div>        case_sensitive = yes</div><div>        check_with_nas = yes</div><div>        perm = 384</div><div>        callerid = yes</div><div>  }</div><div> Module: Linked to module rlm_attr_filter</div><div> Module: Instantiating module &quot;attr_filter.accounting_response&quot; from file /etc/freeradius/modules/attr_filter</div>


<div>  attr_filter attr_filter.accounting_response {</div><div>        attrsfile = &quot;/etc/freeradius/attrs.accounting_response&quot;</div><div>        key = &quot;%{User-Name}&quot;</div><div>        relaxed = no</div>


<div>  }</div><div> Module: Checking session {...} for more modules to load</div><div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div>

<div>
 Module: Instantiating module &quot;attr_filter.access_reject&quot; from file /etc/freeradius/modules/attr_filter</div><div>  attr_filter attr_filter.access_reject {</div><div>        attrsfile = &quot;/etc/freeradius/attrs.access_reject&quot;</div>


<div>        key = &quot;%{User-Name}&quot;</div><div>        relaxed = no</div><div>  }</div><div> } # modules</div><div>} # server</div><div>server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel</div>


<div> modules {</div><div> Module: Checking authenticate {...} for more modules to load</div><div> Module: Checking authorize {...} for more modules to load</div><div> Module: Checking session {...} for more modules to load</div>


<div> Module: Checking post-proxy {...} for more modules to load</div><div> Module: Checking post-auth {...} for more modules to load</div><div> } # modules</div><div>} # server</div><div>radiusd: #### Opening IP addresses and Ports ####</div>


<div>listen {</div><div>        type = &quot;auth&quot;</div><div>        ipaddr = *</div><div>        port = 0</div><div>}</div><div>listen {</div><div>        type = &quot;acct&quot;</div><div>        ipaddr = *</div><div>


        port = 0</div><div>}</div><div>listen {</div><div>        type = &quot;auth&quot;</div><div>        ipaddr = 127.0.0.1</div><div>        port = 18120</div><div>}</div><div> ... adding new socket proxy address * port 48747</div>


<div>Listening on authentication address * port 1812</div><div>Listening on accounting address * port 1813</div><div>Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel</div><div>Listening on proxy address * port 1814</div>


<div>Ready to process requests.</div><div><div>rad_recv: Access-Request packet from host 192.168.2.24 port 37360, id=33, length=151</div><div>        Service-Type = Framed-User</div><div>        Framed-Protocol = PPP</div>


<div>        User-Name = &quot;md5sonder&quot;</div><div>        MS-CHAP-Challenge = 0x0450cfc169281de4596f775878e83202</div><div>        MS-CHAP2-Response = 0x50002036d573a3f3f443f0adaaf52b1557b300000000000000004fab1da0b14e7e7827768b24019d9c9e41dec2d11872bbad</div>


<div>        Calling-Station-Id = &quot;97.218.49.75&quot;</div><div>        NAS-IP-Address = 127.0.0.1</div><div>        NAS-Port = 0</div><div># Executing section authorize from file /etc/freeradius/sites-enabled/default</div>


<div>+- entering group authorize {...}</div><div>++[preprocess] returns ok</div><div>++[chap] returns noop</div><div>[mschap] Found MS-CHAP attributes.  Setting &#39;Auth-Type  = mschap&#39;</div><div>++[mschap] returns ok</div>


<div>++[digest] returns noop</div><div>[suffix] No &#39;@&#39; in User-Name = &quot;md5sonder&quot;, looking up realm NULL</div><div>[suffix] No such realm &quot;NULL&quot;</div><div>++[suffix] returns noop</div><div>[eap] No EAP-Message, not doing EAP</div>


<div>++[eap] returns noop</div><div>[files] users: Matched entry DEFAULT at line 172</div><div>++[files] returns ok</div><div>[sql]   expand: %{User-Name} -&gt; md5sonder</div><div>[sql] sql_set_user escaped user --&gt; &#39;md5sonder&#39;</div>


<div>rlm_sql (sql): Reserving sql socket id: 4</div><div>[sql]   expand: SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = &#39;%{SQL-User-Name}&#39;           ORDER BY id -&gt; SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = &#39;md5sonder&#39;           ORDER BY id</div>


<div>[sql] User found in radcheck table</div><div>[sql]   expand: SELECT id, username, attribute, value, op           FROM radreply           WHERE username = &#39;%{SQL-User-Name}&#39;           ORDER BY id -&gt; SELECT id, username, attribute, value, op           FROM radreply           WHERE username = &#39;md5sonder&#39;           ORDER BY id</div>


<div>[sql]   expand: SELECT groupname           FROM radusergroup           WHERE username = &#39;%{SQL-User-Name}&#39;           ORDER BY priority -&gt; SELECT groupname           FROM radusergroup           WHERE username = &#39;md5sonder&#39;           ORDER BY priority</div>


<div>rlm_sql (sql): Released sql socket id: 4</div><div>++[sql] returns ok</div><div>++[expiration] returns noop</div><div>++[logintime] returns noop</div><div>[pap] Normalizing MD5-Password from hex encoding</div><div>[pap] WARNING: Auth-Type already set.  Not setting to PAP</div>


<div>++[pap] returns noop</div><div>Found Auth-Type = MSCHAP</div><div># Executing group from file /etc/freeradius/sites-enabled/default</div><div>+- entering group MS-CHAP {...}</div><div>[mschap] No Cleartext-Password configured.  Cannot create LM-Password.</div>


<div>[mschap] No Cleartext-Password configured.  Cannot create NT-Password.</div><div>[mschap] Creating challenge hash with username: md5sonder</div><div>[mschap] Told to do MS-CHAPv2 for md5sonder with NT-Password</div>

<div>
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.</div><div>[mschap] FAILED: MS-CHAP2-Response is incorrect</div><div>++[mschap] returns reject</div><div>Failed to authenticate the user.</div><div>Using Post-Auth-Type Reject</div>


<div># Executing group from file /etc/freeradius/sites-enabled/default</div><div>+- entering group REJECT {...}</div><div>[attr_filter.access_reject]     expand: %{User-Name} -&gt; md5sonder</div><div>attr_filter: Matched entry DEFAULT at line 11</div>


<div>++[attr_filter.access_reject] returns updated</div><div>Delaying reject of request 0 for 1 seconds</div><div>Going to the next request</div><div>Waking up in 0.6 seconds.</div><div>Sending delayed reject for request 0</div>


<div>Sending Access-Reject of id 33 to 192.168.2.24 port 37360</div><div>        MS-CHAP-Error = &quot;PE=691 R=1&quot;</div><div>Waking up in 4.9 seconds.</div><div>Cleaning up request 0 ID 33 with timestamp +121</div><div>


Ready to process requests.</div></div><div><br></div>
</div></blockquote></div></div><blockquote type="cite"><div><span>-</span><br><span>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a></span></div>

</blockquote></div><br>-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>
</div></div></blockquote></div><br>