I have 2 NAS with different requirements in their WiMax handling. One requires me to have: update request { WiMAX-MN-NAI = "%{User-Name}" } update reply { WiMax-MN-NAI = "%{User-Name}" WiMax-IP-Technology = "CMIP4" WiMAX-FA-RK-Key = 0x00 WiMAX-MSK = "%{EAP-MSK}" } Enabled in order to work and the other requires those commented out. Is there a way to identify the NAS type to elegantly have those properly set? David
David Peterson wrote:
I have 2 NAS with different requirements in their WiMax handling. One requires me to have: ... Enabled in order to work and the other requires those commented out. Is there a way to identify the NAS type to elegantly have those properly set?
What is different between the requests that are sent by the two NAS devices? Alan DeKok.
I am not 100% sure why this happens. I will see if I can capture some debug information, but I do know that if I don't comment that text out of sites-available/default then the one NAS just retries the auth over and over again. The inverse is true on the other NAS if it is commented out. David -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Wednesday, October 20, 2010 12:15 PM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: A tale of 2 WiMax NAS David Peterson wrote:
I have 2 NAS with different requirements in their WiMax handling. One requires me to have: ... Enabled in order to work and the other requires those commented out. Is there a way to identify the NAS type to elegantly have those properly set?
What is different between the requests that are sent by the two NAS devices? Alan DeKok.
OK here is the debug output from the NAS requiring those two entries commented out. The CPE are authenticated and the Framed-Filter-Id is sent back properly but the subscribers never receive service. EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}E16C264A7784B7B86380C1087F7143C2" WiMAX-IP-Technology = CMIP4 WiMAX-FA-RK-Key = 0x557aa1e75f677ac869ea7cddad1d4d8eb4bc1c15 WiMAX-MSK = 0x WiMAX-MSK = 0x9ff71c6efbd6db6fa56de244f7863855f2570a0f9e50fb08175e5570da3741de219a8f6a79 353d50a443488d7ad3631e896684d3c4e360c2e8dc9d7b2faae2c0 WiMAX-FA-RK-SPI = 4080449119 Finished request 546. Going to the next request Waking up in 3.1 seconds. Cleaning up request 539 ID 126 with timestamp +8431 Cleaning up request 540 ID 127 with timestamp +8431 Cleaning up request 541 ID 128 with timestamp +8431 Cleaning up request 542 ID 129 with timestamp +8431 Cleaning up request 543 ID 130 with timestamp +8431 Waking up in 1.3 seconds. Cleaning up request 544 ID 131 with timestamp +8433 Waking up in 0.1 seconds. Cleaning up request 545 ID 132 with timestamp +8433 Cleaning up request 546 ID 133 with timestamp +8433 Ready to process requests. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=134, length=252 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x02010035017b616d3d317d3137324533464144323738393746424232394430313630353943 3632314230334057694d61782e636f6d Message-Authenticator = 0xbcad3e78aa2580a803ec6771574f8b1d NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 53 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com [sql] sql_set_user escaped user --> '{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 134 to 172.16.4.2 port 1812 EAP-Message = 0x0102001604106f87eaef5fb2c869f5ea9cc7bbd6f167 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12478ecf59ab6dcf8f64d052f7 Finished request 547. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=135, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020200060315 Message-Authenticator = 0x5c7b646a4e15bcaa02ab2fba84de80bc NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12478ecf59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com [sql] sql_set_user escaped user --> '{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 [sql] User {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 135 to 172.16.4.2 port 1812 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12468fde59ab6dcf8f64d052f7 Finished request 548. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=136, length=305 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x0203005815800000004e16030100490100004503014ba56db22185a9f76d29a4d2adb55f14 98e0cf24850e4500ca78d654b408fc0000001e00390038003500160013000a00330032002f00 15001200090014001100080100 Message-Authenticator = 0x88f33e618e713504847509a6e0d3150b NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12468fde59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 88 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 78 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0049], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 136 to 172.16.4.2 port 1812 EAP-Message = 0x0104040015c000000aad160301002a0200002603014cbf28a1c3eb9d327ad351652f04cabf 9821f3c17dc245ad28145764c786e7f900003900160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3130303632313139303034345a170d3131303632313139303034345a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100a22c435dd3157a79c141fdc1a3ee89f7661a09187b958a5816beff7591e4b6aa37f7f256 cb182fffd65c4000a1498020aea03360223fad98df86a01d7b3c EAP-Message = 0xea1055ffdadbf60a2ea1b7af5a728cb75ec7e06ee90c39a9d6b1bdef454343d51c4f489be8 d3e17f545a9e8b7ac612dba36cf14c1a7709651d1bf04a057c4188fecee0dd6d80b9d5cca836 5e3e0aeccf0deef1f7516cce7d30fbe1271f8fcb25be192fbaf623340024debf13487225fead 75a4e557f21cb9707d519d2ad8de57eeda2c8b6afc7fc2b0e1a890fec212c80455a83a8b41bb b35fc6420b167139c6033757b38124c971da04bd1c6da985c65077f55bee5b37c65e1f8cefa3 25c1672bff0203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d01010405000382010100c21ae0152cdbce17a1 EAP-Message = 0x55233bf585be76ec2a3265e3e6ee7132890dc68d37c1864b08ba53f34c358953c528f8ab14 4716d17ebcd4f1b86f53522ce118b1a8932dfe4e3234137e94aecc3737c66d07405c9c369d2a 04f4d11c96685996d95313a35fde3b433d15eb93c915814fca156b6c5fcff010968ef7613142 d4cd95da673bdc1217739a88f8d43bb6ca26bee37a64f8ce1b50ec1b8e7c11c5291c88b5ebea 2e766bc31139fc03482232660ea54c22273996250eab67b9198b4ad378c5e1635162ffc5e382 bf5d60dd149e6c1b9f05eb5e94824b103f77e6e5875f6f8beeb48302defec698296f20c9ba78 9341834806deb515116aedc41d90bfebfaf0bea20004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb124588de59ab6dcf8f64d052f7 Finished request 549. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=137, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020400061500 Message-Authenticator = 0x0f160700bd7a7dde77c1dbac4e9ca0bd NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb124588de59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 137 to 172.16.4.2 port 1812 EAP-Message = 0x0105040015c000000aad00b7ca1f4a75b65c48300d06092a864886f70d0101050500308193 310b3009060355040613024652310f300d060355040813065261646975733112301006035504 071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d31 30303632313139303034345a170d3131303632313139303034345a308193310b300906035504 0613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e 632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126 30240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 30820122300d06092a864886f70d01010105000382010f003082010a0282010100e3290705c4 fbb8ba17c01180a24b51b68fd9807e4a28e561d5d344b2baf607eda92d77219aa57c54c52b8b d9a1f00f4d4e63f193d3089c1a396bc81a9fc88206480dc4a57b5b488fb34e9ac384ce919b94 567443f6fe9eb3199ef1cfec5cf3343d1003de5a824a6b4ff7ae EAP-Message = 0x783711920d724d0c6d8215edc2c8106d2d5bdb5c0db3438661f24fa3325a92e0959ca3b202 333824e1799e966f487857983c73b9477548cc8430cb1d94afb8751ace106e5401388bb34457 7f99fa44d7daa1e3b429f24bcdfd74c26813fbb390a65854d14ce5b3f9a8a06830f6deea9271 b7f09a8f2786d0bda65dad5733155c3028f318317133f2fdaa4c8687ab457f4cc9f6d1f90203 010001a381fb3081f8301d0603551d0e04160414c653e0f09e4775e74119ec9d2ca877eea7d7 857c3081c80603551d230481c03081bd8014c653e0f09e4775e74119ec9d2ca877eea7d7857c a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013 060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01090116116164 6d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479820900b7ca1f4a75b65c48300c0603551d13040530 030101ff300d06092a864886f70d0101050500038201010054813204c14a1e24209f2775a069 ec1ef24c75af5aeae0cd8fd867228eb1053d085cb7a41f825bef7c00509b6c16f5418140dd84 d04a6470f0066b95863ebdd930d7137d4b269a127b5ac5d8bb54 EAP-Message = 0xa450a87daa867321e3c885c3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb124489de59ab6dcf8f64d052f7 Finished request 550. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=138, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020500061500 Message-Authenticator = 0x650835cee90bb974cdf638b73fcd2a0b NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb124489de59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 138 to 172.16.4.2 port 1812 EAP-Message = 0x010602cb158000000aad9c453583b6807402da0b0d8c90c139a9a0ddef70b01c5fa9ee8ac5 1255bf935d536f69d45b60a86ca871ddfc2c67c15cd531a3fae5cf5dfccf9170560759968f21 e6020052bf6baeb29ebcd3e174c16a36a30ef060c4d110b63cea4f16a115717fa6a8ba515021 0f86dd7f31bde3a3c35117d3d0b991763b97041453c7aa22a068e26a3b931dddbc429d8bdc75 66b6077f51717c612d206261f862b672cff53abfb016b9b839160301020d0c0002090080f5bd 24429f55049a0764bc935fbb95edf33bca4152a811bf1895e8dbfebd93cebc81616f548086f0 fb025058c15c8cc5f35dad890892db51c300b8fd6b7ecd9001da EAP-Message = 0xbe526cba14255c8cec05d51acdc7c0aa97a19bf634ee550c72543d1d4927b0819129b99790 32cf1d098638b89741798e7e2c6854e368448190fa73d3b68b0001020080d14954812608d3ee 2cd467c9d9cc82e9b8985d9697a37d6f55a4ccec638fb00acb0c1fcc319ecf2424ef63f34a9e ae614ac737a8196c7e812ef9421575874140c65ab0d8ac4d092541e4a6ea37180b0022ba3083 9099dfe279acb9694005ffc1a0c9c5c73fe8d0fbc365f4e8bd850ab91c4101a621bf6a9ce40e e60977746c3c0100293beb89c04468412b3fb9cc298d4655c621ae4e66cfcbc5d4f32d45b2d1 2ac7d25539fa6d95a5b8c499e342a5b65b1c5106c99d1b35e9da EAP-Message = 0x835db11a36f83ca100b5b2ca091706d1d6d179ca093f0c058400ccdffc2c9e20bcbea1410c ee9ae316b7346db3a6a222e773195dec7a26a2932522619bda9f577ad01aef49ca5dbef3cbd7 d2e58d2d77480dc5ea7040a7aa59be3be18d24d027b0d8d79d963301447928b6451b9aec63b0 65706957f8cdb30bf7be9aea5a8efe74d2bc279981e3c7856170d926575e9451606996ddc012 9bfaa37c7ee0a86b308ba5a214bf361376c1f72a082220dbdd4e1753c7b5f792b67886f083f9 29c881afc50ff4c103b34416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12438ade59ab6dcf8f64d052f7 Finished request 551. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=139, length=425 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020600d01580000000c6160301008610000082008019091b56b93c2dd93d6750a96e9c9dc6 04a460123d8d6b72a95bddc2b80645b03c1adad01f5fb131822813ade7a1d1db4799be842683 a508e70cb22e0f19ebbb0161140dc4320cc74a6898a57ec9a4ba09afdcb04900f900b9153f7d 6f221e485ada8f7fe9e836370dce412cafc5b7650f5cdefabfce5b8e83eef7c41c1b29451403 0100010116030100301d1813cf79828a23207e419b22109258f0bb833fc4a7dbf259c9276eb4 af13242a5d16fa9fcb25b2e9e60bc90d9151d0 Message-Authenticator = 0x3dbbb76e82f0635a2a42821991fc3aa4 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12438ade59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 139 to 172.16.4.2 port 1812 EAP-Message = 0x0107004515800000003b1403010001011603010030dca979f044c0aeda0da67eb60b0d7a02 7265933c924dd92c1d3ba9e02c7c623ff4a863c6d2033b2a97888d48714b8802 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb12428bde59ab6dcf8f64d052f7 Finished request 552. Going to the next request Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=140, length=409 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020700c015001703010020c45c7d140d8783a758c9ecb656e69f1b4fc3cbc22382dbe0caff 1673e827cdfb17030100902d218bc577d463a8b1e2b50ab09206f3daeef02fcd91bd52e90f23 819f1a07654a3ba1a711f59e431ab93d3189dc860a74b9cd67febcb621a9438f8fd16160dec8 cbab6c3a21ef49c52939a6e98c56edf4d47e23ec0a53c3e15dbae0b28e92b68073bc17c0a95c e757a5c183d05966cf63b4e0080127996ee7300527111c5e478bca2b1fedc90fdaace5a2bbe1 d46f1a Message-Authenticator = 0x31d57333c56c4b226b3665b572620ba2 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb12428bde59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0xd9f370a27454c8f24cb516abd89c288d MS-CHAP2-Response = 0x8b00d9f370a27454c8f24cb516abd89c288d00000000000000003d35ec9cbd8b5be8ba199d 30326911e6075fe803c3a48a5d FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0xd9f370a27454c8f24cb516abd89c288d MS-CHAP2-Response = 0x8b00d9f370a27454c8f24cb516abd89c288d00000000000000003d35ec9cbd8b5be8ba199d 30326911e6075fe803c3a48a5d FreeRADIUS-Proxied-To = 127.0.0.1 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "Silver2@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "Silver2" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '4M-Silver' ORDER BY id [sql] User found in group 4M-Silver [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '4M-Silver' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for Silver2@WiMax.com with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:35') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:35') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> Silver2@WiMax.com [sql_log] expand: %{%{User-Name}:-DEFAULT} -> Silver2@WiMax.com [sql_log] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('Silver2@WiMax.com', 'Chap-Password', 'Access-Accept', '2010-10-20 13:36:35'); [sql_log] expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Framed-Filter-Id = "Silver" MS-CHAP2-Success = 0x8b533d38433645334446453936303744394437333431414438434335394545304644394637 443543463442 MS-MPPE-Recv-Key = 0x6120b81ed669fe9f25bc6f78b2e3f860 MS-MPPE-Send-Key = 0x8607a38d1b37202ce93c2b3eaa59349e MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 140 to 172.16.4.2 port 1812 EAP-Message = 0x0108005f1580000000551703010050732325854414b144cb0eec24b7c8109439fe1a8b2861 2081fe9cc5091d883358215d4490c6a18f408959f4bfe9364db18ba45720b7aaafaf32c3268d 28b0a59de65c8dadfadbbdd0806cb9b8595ea5d8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x478ccb124184de59ab6dcf8f64d052f7 Finished request 553. Going to the next request Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=141, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020800061500 Message-Authenticator = 0xb63cdc0036db5df04e318a3f5f952f25 NAS-Identifier = "Freeradius" ^C'' root@ubuntu:/usr/local/etc/raddb/sites-available# '' root@ubuntu:/usr/local/etc/raddb/sites-available# root@ubuntu:/usr/local/etc/raddb/sites-available# root@ubuntu:/usr/local/etc/raddb/sites-available# root@ubuntu:/usr/local/etc/raddb/sites-available# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jun 21 2010 at 14:47:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/sites-available/dynamic-clients including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### realm WiMax.com { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client dynamic { ipaddr = 192.168.0.0 netmask = 16 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 86400 } client dynamic { ipaddr = 172.16.0.0 netmask = 16 require_message_authenticator = no dynamic_clients = "dynamic_client_server" lifetime = 86400 } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server dynamic_client_server { modules { Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating ok always ok { rcode = "ok" simulcount = 0 mpp = no } } # modules } # server server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "root" password = "unl0ck" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_sql_log Module: Instantiating sql_log sql_log { path = "/usr/local/var/log/radius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" utf8 = no safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating attr_filter.access_challenge attr_filter attr_filter.access_challenge { attrsfile = "/usr/local/etc/raddb/attrs.access_challenge" key = "%{User-Name}" } Module: Instantiating handled always handled { rcode = "handled" simulcount = 0 mpp = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_wimax Module: Instantiating wimax wimax { delete_mppe_keys = yes } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=141, length=223 server dynamic_client_server { rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 } # server dynamic_client_server - Added client 172.16.4.2 with shared secret unl0ck rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=141, length=223 User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" EAP-Message = 0x020800061500 Message-Authenticator = 0xb63cdc0036db5df04e318a3f5f952f25 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x478ccb124184de59ab6dcf8f64d052f7 +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}172E3FAD27897FBB29D016059C621B03" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: No EAP session matching the State variable. [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [sql] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com [sql] sql_set_user escaped user --> '{am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com', '', 'Access-Reject', '2010-10-20 13:36:50') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7D172E3FAD27897FBB29D016059C621B03@WiMax.com', '', 'Access-Reject', '2010-10-20 13:36:50') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [attr_filter.access_reject] expand: %{User-Name} -> {am=1}172E3FAD27897FBB29D016059C621B03@WiMax.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 141 to 172.16.4.2 port 1812 Waking up in 4.9 seconds. Cleaning up request 0 ID 141 with timestamp +2 Ready to process requests. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=142, length=252 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x02010035017b616d3d317d4133443232453433364230433331444143333633394443453530 4342374231454057694d61782e636f6d Message-Authenticator = 0xab8201d1c8d310374d9e9cb69c7fe45a NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 1 length 53 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 [sql] User {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 142 to 172.16.4.2 port 1812 EAP-Message = 0x010200160410e48b4edeff4bd80f302e7a0f1b529edc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890251748deb6482bebd55b3e66d Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=143, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020200060315 Message-Authenticator = 0x00e934eadcef5e9a33d9b76124541842 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890251748deb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [sql] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 143 to 172.16.4.2 port 1812 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890250759ceb6482bebd55b3e66d Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=144, length=305 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x0203005815800000004e16030100490100004503014ba56dc97006b3df82def037b2ef02e4 498e237e06617e6d38efab3255a9e80e00001e00390038003500160013000a00330032002f00 15001200090014001100080100 Message-Authenticator = 0x95cd7a58a5e4df3c1209216284084a22 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890250759ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 88 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 78 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0049], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 085e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [ttls] TLS_accept: SSLv3 write key exchange A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 144 to 172.16.4.2 port 1812 EAP-Message = 0x0104040015c000000aad160301002a0200002603014cbf28b84a7f4d6ff4170b1f0db6e02e af9c2a9cb901ffea97b71698025d1c2500003900160301085e0b00085a0008570003a6308203 a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355 040613024652310f300d060355040813065261646975733112301006035504071309536f6d65 776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886 f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d457861 6d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3130303632313139303034345a170d3131303632313139303034345a307c310b30 09060355040613024652310f300d0603550408130652616469757331153013060355040a130c 4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220 43657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d 706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a028201 0100a22c435dd3157a79c141fdc1a3ee89f7661a09187b958a5816beff7591e4b6aa37f7f256 cb182fffd65c4000a1498020aea03360223fad98df86a01d7b3c EAP-Message = 0xea1055ffdadbf60a2ea1b7af5a728cb75ec7e06ee90c39a9d6b1bdef454343d51c4f489be8 d3e17f545a9e8b7ac612dba36cf14c1a7709651d1bf04a057c4188fecee0dd6d80b9d5cca836 5e3e0aeccf0deef1f7516cce7d30fbe1271f8fcb25be192fbaf623340024debf13487225fead 75a4e557f21cb9707d519d2ad8de57eeda2c8b6afc7fc2b0e1a890fec212c80455a83a8b41bb b35fc6420b167139c6033757b38124c971da04bd1c6da985c65077f55bee5b37c65e1f8cefa3 25c1672bff0203010001a317301530130603551d25040c300a06082b06010505070301300d06 092a864886f70d01010405000382010100c21ae0152cdbce17a1 EAP-Message = 0x55233bf585be76ec2a3265e3e6ee7132890dc68d37c1864b08ba53f34c358953c528f8ab14 4716d17ebcd4f1b86f53522ce118b1a8932dfe4e3234137e94aecc3737c66d07405c9c369d2a 04f4d11c96685996d95313a35fde3b433d15eb93c915814fca156b6c5fcff010968ef7613142 d4cd95da673bdc1217739a88f8d43bb6ca26bee37a64f8ce1b50ec1b8e7c11c5291c88b5ebea 2e766bc31139fc03482232660ea54c22273996250eab67b9198b4ad378c5e1635162ffc5e382 bf5d60dd149e6c1b9f05eb5e94824b103f77e6e5875f6f8beeb48302defec698296f20c9ba78 9341834806deb515116aedc41d90bfebfaf0bea20004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890253729ceb6482bebd55b3e66d Finished request 3. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=145, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020400061500 Message-Authenticator = 0x5d4052f0ed761d8a9cf2b3e0ddd853ce NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890253729ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 145 to 172.16.4.2 port 1812 EAP-Message = 0x0105040015c000000aad00b7ca1f4a75b65c48300d06092a864886f70d0101050500308193 310b3009060355040613024652310f300d060355040813065261646975733112301006035504 071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d31 30303632313139303034345a170d3131303632313139303034345a308193310b300906035504 0613024652310f300d0603550408130652616469757331123010 EAP-Message = 0x06035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e 632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126 30240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 30820122300d06092a864886f70d01010105000382010f003082010a0282010100e3290705c4 fbb8ba17c01180a24b51b68fd9807e4a28e561d5d344b2baf607eda92d77219aa57c54c52b8b d9a1f00f4d4e63f193d3089c1a396bc81a9fc88206480dc4a57b5b488fb34e9ac384ce919b94 567443f6fe9eb3199ef1cfec5cf3343d1003de5a824a6b4ff7ae EAP-Message = 0x783711920d724d0c6d8215edc2c8106d2d5bdb5c0db3438661f24fa3325a92e0959ca3b202 333824e1799e966f487857983c73b9477548cc8430cb1d94afb8751ace106e5401388bb34457 7f99fa44d7daa1e3b429f24bcdfd74c26813fbb390a65854d14ce5b3f9a8a06830f6deea9271 b7f09a8f2786d0bda65dad5733155c3028f318317133f2fdaa4c8687ab457f4cc9f6d1f90203 010001a381fb3081f8301d0603551d0e04160414c653e0f09e4775e74119ec9d2ca877eea7d7 857c3081c80603551d230481c03081bd8014c653e0f09e4775e74119ec9d2ca877eea7d7857c a18199a48196308193310b3009060355040613024652310f300d EAP-Message = 0x060355040813065261646975733112301006035504071309536f6d65776865726531153013 060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01090116116164 6d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274 6966696361746520417574686f72697479820900b7ca1f4a75b65c48300c0603551d13040530 030101ff300d06092a864886f70d0101050500038201010054813204c14a1e24209f2775a069 ec1ef24c75af5aeae0cd8fd867228eb1053d085cb7a41f825bef7c00509b6c16f5418140dd84 d04a6470f0066b95863ebdd930d7137d4b269a127b5ac5d8bb54 EAP-Message = 0xa450a87daa867321e3c885c3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890252739ceb6482bebd55b3e66d Finished request 4. Going to the next request Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=146, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020500061500 Message-Authenticator = 0xb01b4f195810b67967253ba37ea524b7 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890252739ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake fragment handler [ttls] eaptls_verify returned 1 [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 146 to 172.16.4.2 port 1812 EAP-Message = 0x010602cb158000000aad9c453583b6807402da0b0d8c90c139a9a0ddef70b01c5fa9ee8ac5 1255bf935d536f69d45b60a86ca871ddfc2c67c15cd531a3fae5cf5dfccf9170560759968f21 e6020052bf6baeb29ebcd3e174c16a36a30ef060c4d110b63cea4f16a115717fa6a8ba515021 0f86dd7f31bde3a3c35117d3d0b991763b97041453c7aa22a068e26a3b931dddbc429d8bdc75 66b6077f51717c612d206261f862b672cff53abfb016b9b839160301020d0c0002090080f5bd 24429f55049a0764bc935fbb95edf33bca4152a811bf1895e8dbfebd93cebc81616f548086f0 fb025058c15c8cc5f35dad890892db51c300b8fd6b7ecd9001da EAP-Message = 0xbe526cba14255c8cec05d51acdc7c0aa97a19bf634ee550c72543d1d4927b0819129b99790 32cf1d098638b89741798e7e2c6854e368448190fa73d3b68b00010200807e81e24c1ae047d3 80990ed7c9162f401152889d037653c766f8e064ef8ecd265ee1ae14eb45ea2d439957b5a893 75215102a41f70cc49f8d10e3d2a05e409d7ca28c5b9413a5031ac6a61ea09835e2e25dca3eb f77e60594ac502a065158cdfaf1e9f8365b7087ed6116a6d02ba9f8b6cd66d1eb3fbe6437054 e3fa43851dff01001c660e9c8c92fc613d3141ec1803aa54d563c9ac308ec34d0c4ea292c532 0c62c5e26a94a4e06e9a714e1ea45a7e70c2cdb7cda733578462 EAP-Message = 0x616eb18e840e0978b436bcbff53b5354189ef60e2b04485820731e99644cf868e02de8acef 67efadda72ca042c7ac19e68dba5e1522fbc69f594995bb4eaf68ba2ff04d8370e14d9c825fa 404b90103a24031890a956eb35a468b960ef805bb7f9f114ce70b9ed1a316e94cb6812f12474 175ae46ef86162e54ba3a5f7c79a13f4184c05f3d0da9babf87ef6af1c91b52ed9bc5a922733 56c47f6a4f1a3aaa72a2b869b805be022cc5bce65f053728810bf014d3a4bcaac7db665367a9 5b1444e1af622b4edbc5df16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890255709ceb6482bebd55b3e66d Finished request 5. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=147, length=425 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020600d01580000000c61603010086100000820080e4d7807abde242d95bf6c91a2fddf6cf b57fe828e5df9422a9a8da9ef2cebb9b4645a06feb355df4b13f42ff5e57d7af163a7cffbf84 ba0f1881fcf7f19b527026980170237f9394a9432245cf5c7b522385045b63b6396d0a9b8be7 8908825dfbd6da5a1f0ea432332387160fc1cc5fd5aac8109782b0b30f939db9964cec5e1403 0100010116030100307cca567db3f81ef6a2685b75eeb16fb9aa012bd8d4f82fc4e73c026399 049ece7a5a8484487408ed2568af333cbbdb10 Message-Authenticator = 0xedc54de4eb5ffc87ca17e9c9bc5d8619 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890255709ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 6 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 198 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [ttls] TLS_accept: SSLv3 read client key exchange A [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [ttls] <<< TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 read finished A [ttls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [ttls] TLS_accept: SSLv3 write change cipher spec A [ttls] >>> TLS 1.0 Handshake [length 0010], Finished [ttls] TLS_accept: SSLv3 write finished A [ttls] TLS_accept: SSLv3 flush data [ttls] (other): SSL negotiation finished successfully SSL Connection Established [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 147 to 172.16.4.2 port 1812 EAP-Message = 0x0107004515800000003b14030100010116030100306b50179fa6a5874892188644af581c99 82c2b832ad254213ccdefa7fe910f8bac9e23cc3cd458bedf2b89c3fed673b0a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5176890254719ceb6482bebd55b3e66d Finished request 6. Going to the next request Waking up in 3.3 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=148, length=409 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020700c015001703010020a6ac1d7537f30019672dce1064fd2e338b680d4d58a74a47a5d7 544b1333cfdb1703010090a9c3a0e34fbc778490e986587c22b5709abb8cd73b778f28e40d3c 62af54f98b6e2f0fbcf505633e21afb5cb9bbe2f6920c64bfa1fd494ca3e54ecd2587fa9f03e d91ebcb6f1ebe05eff8582d10d9c48aa1cd50a36ec10ba7aa8d2d0859742779e56ab4f75ebee c3f45c8f186b0f113d5da41bb5d56be9d9d458663101dd212b1ec19851dadb19c6fdc6a77044 9ca909 Message-Authenticator = 0xbb5e8ee22d928eea40ce4df5ad043ce6 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x5176890254719ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 192 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Got tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0x4accd64250fe20627d27bedcc0281bc4 MS-CHAP2-Response = 0x6a004accd64250fe20627d27bedcc0281bc40000000000000000a95f7c15e711eb1f6d0bd7 6b0bac132ed1be63f0faaf8ca7 FreeRADIUS-Proxied-To = 127.0.0.1 [ttls] Sending tunneled request User-Name = "Silver2@WiMax.com" MS-CHAP-Challenge = 0x4accd64250fe20627d27bedcc0281bc4 MS-CHAP2-Response = 0x6a004accd64250fe20627d27bedcc0281bc40000000000000000a95f7c15e711eb1f6d0bd7 6b0bac132ed1be63f0faaf8ca7 FreeRADIUS-Proxied-To = 127.0.0.1 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "Silver2@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "Silver2" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = BINARY '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = BINARY 'Silver2@WiMax.com' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '4M-Silver' ORDER BY id [sql] User found in group 4M-Silver [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '4M-Silver' ORDER BY id rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for Silver2@WiMax.com with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> Silver2@WiMax.com [sql] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'Silver2@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> Silver2@WiMax.com [sql_log] expand: %{%{User-Name}:-DEFAULT} -> Silver2@WiMax.com [sql_log] sql_set_user escaped user --> 'Silver2@WiMax.com' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('Silver2@WiMax.com', 'Chap-Password', 'Access-Accept', '2010-10-20 13:36:58'); [sql_log] expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Framed-Filter-Id = "Silver" MS-CHAP2-Success = 0x6a533d46373730384443374231453134304131414141373331444432303831413142353245 324542344335 MS-MPPE-Recv-Key = 0x168ef7c1d920df032a9fd2acf0f9b82f MS-MPPE-Send-Key = 0x86034a3ca1d92388aaf58f286a9c9e02 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 [ttls] Got tunneled Access-Accept [ttls] Got MS-CHAP2-Success, tunneling it to the client in a challenge. ++[eap] returns handled Sending Access-Challenge of id 148 to 172.16.4.2 port 1812 EAP-Message = 0x0108005f1580000000551703010050867c96689b4bd1574acd21f9891fa56511b9e18a9361 1d83afd8222dd04863417bf8cb57bd64ea5c7c66cb7be15247e290e85581bc1ef445dbf34f22 735c14695e5f72ad897b591bce22ad9cee638b9e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x51768902577e9ceb6482bebd55b3e66d Finished request 7. Going to the next request Waking up in 3.2 seconds. rad_recv: Access-Request packet from host 172.16.4.2 port 1812, id=149, length=223 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" EAP-Message = 0x020800061500 Message-Authenticator = 0x2006b33e2c36b0cd392c25f67988f668 NAS-Identifier = "Freeradius" NAS-IP-Address = 172.16.4.2 Calling-Station-Id = "00-A0-0A-13-13-72" WiMAX-BS-Id = 0x000002010203 NAS-Port-Type = 27 Framed-MTU = 2000 Service-Type = Framed-User WiMAX-GMT-Timezone-offset = 0 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = IP-Session-Based WiMAX-Hotlining-Capabilities = Hotline-Profile-Id WiMAX-Attr-1793 = 0x0000028a State = 0x51768902577e9ceb6482bebd55b3e66d +- entering group authorize {...} ++[preprocess] returns ok ++[mschap] returns noop ++[wimax] returns ok [suffix] Looking up realm "WiMax.com" for User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com" [suffix] Found realm "WiMax.com" [suffix] Adding Stripped-User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" [suffix] Adding Realm = "WiMax.com" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 8 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS [ttls] Received TLS ACK [ttls] ACK handshake is finished [ttls] eaptls_verify returned 3 [ttls] eaptls_process returned 3 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} [sql] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com', '', 'Access-Accept', '2010-10-20 13:36:58') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok [sql_log] Processing sql_log_postauth [sql_log] expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql_log] expand: %{%{User-Name}:-DEFAULT} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com [sql_log] sql_set_user escaped user --> '{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com' [sql_log] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql_log] ... expanding second conditional [sql_log] expand: Chap-Password -> Chap-Password [sql_log] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('=7Bam=3D1=7DA3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com', 'Chap-Password', 'Access-Accept', '2010-10-20 13:36:58'); [sql_log] expand: /usr/local/var/log/radius/radacct/sql-relay -> /usr/local/var/log/radius/radacct/sql-relay ++[sql_log] returns ok ++[exec] returns noop expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com ++[request] returns noop expand: %{User-Name} -> {am=1}A3D22E436B0C31DAC3639DCE50CB7B1E@WiMax.com expand: %{EAP-MSK} -> ++[reply] returns noop [wimax] MIP-RK = 0xc6fccac2e97b3d48060a81c368a9be35eeff4966da91a7026485ad67006af1912220236c32 d08bcb9c9d86d3aa2793cd058aea91ee6f3a2b8f9e7e0d4ea65eec [wimax] MIP-SPI = abe5d10b [wimax] WARNING: WiMAX-hHA-IP-MIP4 not found. Cannot calculate MN-HA-CMIP4 key ++[wimax] returns updated Sending Access-Accept of id 149 to 172.16.4.2 port 1812 Framed-Filter-Id = "Silver" EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}A3D22E436B0C31DAC3639DCE50CB7B1E" WiMAX-IP-Technology = CMIP4 WiMAX-FA-RK-Key = 0xc2d829f7e21967d6a9df3437f2b1edaeb88ef709 WiMAX-MSK = 0x WiMAX-MSK = 0x428bcfef58b8d50a5abcadfc80973cae7183c5bda974c561acd123d542bfc603ea846fa1bb 869097e3dd267abe5cb343f0cf3ab587f65006a35784f925e2723e WiMAX-FA-RK-SPI = 198305195 Finished request 8. Going to the next request Waking up in 3.1 seconds. Cleaning up request 1 ID 142 with timestamp +8 Cleaning up request 2 ID 143 with timestamp +8 Cleaning up request 3 ID 144 with timestamp +8 Cleaning up request 4 ID 145 with timestamp +8 Cleaning up request 5 ID 146 with timestamp +8 Waking up in 1.3 seconds. Cleaning up request 6 ID 147 with timestamp +10 Waking up in 0.1 seconds. Cleaning up request 7 ID 148 with timestamp +10 Cleaning up request 8 ID 149 with timestamp +10 Ready to process requests. -----Original Message----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Wednesday, October 20, 2010 12:15 PM To: David Peterson-WirelessConnections; FreeRadius users mailing list Subject: Re: A tale of 2 WiMax NAS David Peterson wrote:
I have 2 NAS with different requirements in their WiMax handling. One requires me to have: ... Enabled in order to work and the other requires those commented out. Is there a way to identify the NAS type to elegantly have those properly set?
What is different between the requests that are sent by the two NAS devices? Alan DeKok.
David Peterson wrote:
OK here is the debug output from the NAS requiring those two entries commented out. The CPE are authenticated and the Framed-Filter-Id is sent back properly but the subscribers never receive service.
Does this mean you're willing to read the debug output to see what the differences are? Or should we do it? If it's not important enough for you to read the output, it isn't important enough for us to read it, either. Alan DeKok.
participants (2)
-
Alan DeKok -
David Peterson