Hi, I have Windows 10 correctly connecting to my WAP with a domain login, but if I then disconnect the WiFi then reconnect manually it never logs in. I've fixed the CN, SubjectAltName and certificate constraints at it was throwing a warning or error which has now gone. Below is the debug log. Sections (0) to (9) are the successful log in. I then manually disconnected and reconnected which are sections (10) onwards. I've cut the log at (30) but it keeps going. FreeRADIUS Version 3.0.13 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/raddb/dictionary including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clearos-proxy.conf including configuration file /etc/raddb/clearos-clients.conf including files in directory /etc/raddb/mods-enabled/ including configuration file /etc/raddb/mods-enabled/linelog including configuration file /etc/raddb/mods-enabled/radutmp including configuration file /etc/raddb/mods-enabled/preprocess including configuration file /etc/raddb/mods-enabled/dynamic_clients including configuration file /etc/raddb/mods-enabled/expr including configuration file /etc/raddb/mods-enabled/realm including configuration file /etc/raddb/mods-enabled/detail including configuration file /etc/raddb/mods-enabled/expiration including configuration file /etc/raddb/mods-enabled/dhcp including configuration file /etc/raddb/mods-enabled/echo including configuration file /etc/raddb/mods-enabled/pap including configuration file /etc/raddb/mods-enabled/sradutmp including configuration file /etc/raddb/mods-enabled/detail.log including configuration file /etc/raddb/mods-enabled/mschap including configuration file /etc/raddb/mods-enabled/logintime including configuration file /etc/raddb/mods-enabled/unpack including configuration file /etc/raddb/mods-enabled/eap including configuration file /etc/raddb/mods-enabled/always including configuration file /etc/raddb/mods-enabled/exec including configuration file /etc/raddb/mods-enabled/cache_eap including configuration file /etc/raddb/mods-enabled/files including configuration file /etc/raddb/mods-enabled/utf8 including configuration file /etc/raddb/mods-enabled/ldap including configuration file /etc/raddb/mods-enabled/passwd including configuration file /etc/raddb/mods-enabled/ntlm_auth including configuration file /etc/raddb/mods-enabled/replicate including configuration file /etc/raddb/mods-enabled/digest including configuration file /etc/raddb/mods-enabled/soh including configuration file /etc/raddb/mods-enabled/date including configuration file /etc/raddb/mods-enabled/attr_filter including configuration file /etc/raddb/mods-enabled/unix including configuration file /etc/raddb/mods-enabled/chap including files in directory /etc/raddb/policy.d/ including configuration file /etc/raddb/policy.d/debug including configuration file /etc/raddb/policy.d/control including configuration file /etc/raddb/policy.d/dhcp including configuration file /etc/raddb/policy.d/filter including configuration file /etc/raddb/policy.d/eap including configuration file /etc/raddb/policy.d/cui including configuration file /etc/raddb/policy.d/operator-name including configuration file /etc/raddb/policy.d/canonicalization including configuration file /etc/raddb/policy.d/accounting including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main {  security {      user = "radiusd"      group = "radiusd"      allow_core_dumps = no  }     name = "radiusd"     prefix = "/usr"     localstatedir = "/var"     logdir = "/var/log/radius"     run_dir = "/var/run/radiusd" } main {     name = "radiusd"     prefix = "/usr"     localstatedir = "/var"     sbindir = "/usr/sbin"     logdir = "/var/log/radius"     run_dir = "/var/run/radiusd"     libdir = "/usr/lib64/freeradius"     radacctdir = "/var/log/radius/radacct"     hostname_lookups = no     max_request_time = 30     cleanup_delay = 5     max_requests = 16384     pidfile = "/var/run/radiusd/radiusd.pid"     checkrad = "/usr/sbin/checkrad"     debug_level = 0     proxy_requests = yes  log {      stripped_names = no      auth = no      auth_badpass = no      auth_goodpass = no      colourise = yes      msg_denied = "You are already logged in - access denied"  }  resources {  }  security {      max_attributes = 200      reject_delay = 1.000000      status_server = yes  } } radiusd: #### Loading Realms and Home Servers ####  proxy server {      retry_delay = 5      retry_count = 3      default_fallback = no      dead_time = 120      wake_all_if_all_dead = no  }  home_server localhost {      ipaddr = 127.0.0.1      port = 1812      type = "auth"      secret = <<< secret >>>      response_window = 20.000000      response_timeouts = 1      max_outstanding = 65536      zombie_period = 40      status_check = "status-server"      ping_interval = 30      check_interval = 30      check_timeout = 4      num_answers_to_alive = 3      revive_interval = 120   limit {       max_connections = 16       max_requests = 0       lifetime = 0       idle_timeout = 0   }   coa {       irt = 2       mrt = 16       mrc = 5       mrd = 30   }  }  home_server_pool my_auth_failover {     type = fail-over     home_server = localhost  }  realm example.com {     auth_pool = my_auth_failover  }  realm LOCAL {  }  realm CLEARSYSTEM {  } radiusd: #### Loading Clients ####  client 10.0.2.15 {      require_message_authenticator = no      secret = <<< secret >>>      shortname = "eapol_test1"   limit {       max_connections = 16       lifetime = 0       idle_timeout = 30   }  } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 10.0.2.15. Please fix your configuration Support for old-style clients will be removed in a future release  client 172.17.2.5 {      require_message_authenticator = no      secret = <<< secret >>>      shortname = "eapol_test2"   limit {       max_connections = 16       lifetime = 0       idle_timeout = 30   }  } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 172.17.2.5. Please fix your configuration Support for old-style clients will be removed in a future release  client 172.22.22.2 {      require_message_authenticator = no      secret = <<< secret >>>      shortname = "Draytek"   limit {       max_connections = 16       lifetime = 0       idle_timeout = 30   }  } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 172.22.22.2. Please fix your configuration Support for old-style clients will be removed in a future release  client 172.22.22.3 {      require_message_authenticator = no      secret = <<< secret >>>      shortname = "eapol_test"   limit {       max_connections = 16       lifetime = 0       idle_timeout = 30   }  } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 172.22.22.3. Please fix your configuration Support for old-style clients will be removed in a future release  client 172.22.22.254 {      require_message_authenticator = no      secret = <<< secret >>>      shortname = "Tomato"   limit {       max_connections = 16       lifetime = 0       idle_timeout = 30   }  } No 'ipaddr' or 'ipv4addr' or 'ipv6addr' field found in client 172.22.22.254. Please fix your configuration Support for old-style clients will be removed in a future release Debugger not attached  # Creating Auth-Type = mschap  # Creating Auth-Type = eap  # Creating Auth-Type = PAP  # Creating Auth-Type = CHAP  # Creating Auth-Type = MS-CHAP  # Creating Auth-Type = digest radiusd: #### Instantiating modules ####  modules {   # Loaded module rlm_linelog   # Loading module "linelog" from file /etc/raddb/mods-enabled/linelog   linelog {       filename = "/var/log/radius/linelog"       escape_filenames = no       syslog_severity = "info"       permissions = 384       format = "This is a log message for %{User-Name}"       reference = "messages.%{%{reply:Packet-Type}:-default}"   }   # Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog   linelog log_accounting {       filename = "/var/log/radius/linelog-accounting"       escape_filenames = no       syslog_severity = "info"       permissions = 384       format = ""       reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"   }   # Loaded module rlm_radutmp   # Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp   radutmp {       filename = "/var/log/radius/radutmp"       username = "%{User-Name}"       case_sensitive = yes       check_with_nas = yes       permissions = 384       caller_id = yes   }   # Loaded module rlm_preprocess   # Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess   preprocess {       huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups"       hints = "/etc/raddb/mods-config/preprocess/hints"       with_ascend_hack = no       ascend_channels_per_line = 23       with_ntdomain_hack = no       with_specialix_jetstream_hack = no       with_cisco_vsa_hack = no       with_alvarion_vsa_hack = no   }   # Loaded module rlm_dynamic_clients   # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled/dynamic_clients   # Loaded module rlm_expr   # Loading module "expr" from file /etc/raddb/mods-enabled/expr   expr {       safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"   }   # Loaded module rlm_realm   # Loading module "IPASS" from file /etc/raddb/mods-enabled/realm   realm IPASS {       format = "prefix"       delimiter = "/"       ignore_default = no       ignore_null = no   }   # Loading module "suffix" from file /etc/raddb/mods-enabled/realm   realm suffix {       format = "suffix"       delimiter = "@"       ignore_default = no       ignore_null = no   }   # Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm   realm realmpercent {       format = "suffix"       delimiter = "%"       ignore_default = no       ignore_null = no   }   # Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm   realm ntdomain {       format = "prefix"       delimiter = "\\"       ignore_default = no       ignore_null = no   }   # Loaded module rlm_detail   # Loading module "detail" from file /etc/raddb/mods-enabled/detail   detail {       filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"       header = "%t"       permissions = 384       locking = no       escape_filenames = no       log_packet_header = no   }   # Loaded module rlm_expiration   # Loading module "expiration" from file /etc/raddb/mods-enabled/expiration   # Loaded module rlm_dhcp   # Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp   # Loaded module rlm_exec   # Loading module "echo" from file /etc/raddb/mods-enabled/echo   exec echo {       wait = yes       program = "/bin/echo %{User-Name}"       input_pairs = "request"       output_pairs = "reply"       shell_escape = yes   }   # Loaded module rlm_pap   # Loading module "pap" from file /etc/raddb/mods-enabled/pap   pap {       normalise = yes   }   # Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp   radutmp sradutmp {       filename = "/var/log/radius/sradutmp"       username = "%{User-Name}"       case_sensitive = yes       check_with_nas = yes       permissions = 420       caller_id = no   }   # Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log   detail auth_log {       filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"       header = "%t"       permissions = 384       locking = no       escape_filenames = no       log_packet_header = no   }   # Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log   detail reply_log {       filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"       header = "%t"       permissions = 384       locking = no       escape_filenames = no       log_packet_header = no   }   # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log   detail pre_proxy_log {       filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"       header = "%t"       permissions = 384       locking = no       escape_filenames = no       log_packet_header = no   }   # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log   detail post_proxy_log {       filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"       header = "%t"       permissions = 384       locking = no       escape_filenames = no       log_packet_header = no   }   # Loaded module rlm_mschap   # Loading module "mschap" from file /etc/raddb/mods-enabled/mschap   mschap {       use_mppe = yes       require_encryption = no       require_strong = no       with_ntdomain_hack = yes       ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}"    passchange {    }       allow_retry = yes       winbind_retry_with_normalised_username = no   }   # Loaded module rlm_logintime   # Loading module "logintime" from file /etc/raddb/mods-enabled/logintime   logintime {       minimum_timeout = 60   }   # Loaded module rlm_unpack   # Loading module "unpack" from file /etc/raddb/mods-enabled/unpack   # Loaded module rlm_eap   # Loading module "eap" from file /etc/raddb/mods-enabled/eap   eap {       default_eap_type = "peap"       timer_expire = 60       ignore_unknown_eap_types = no       cisco_accounting_username_bug = no       max_sessions = 16384   }   # Loaded module rlm_always   # Loading module "reject" from file /etc/raddb/mods-enabled/always   always reject {       rcode = "reject"       simulcount = 0       mpp = no   }   # Loading module "fail" from file /etc/raddb/mods-enabled/always   always fail {       rcode = "fail"       simulcount = 0       mpp = no   }   # Loading module "ok" from file /etc/raddb/mods-enabled/always   always ok {       rcode = "ok"       simulcount = 0       mpp = no   }   # Loading module "handled" from file /etc/raddb/mods-enabled/always   always handled {       rcode = "handled"       simulcount = 0       mpp = no   }   # Loading module "invalid" from file /etc/raddb/mods-enabled/always   always invalid {       rcode = "invalid"       simulcount = 0       mpp = no   }   # Loading module "userlock" from file /etc/raddb/mods-enabled/always   always userlock {       rcode = "userlock"       simulcount = 0       mpp = no   }   # Loading module "notfound" from file /etc/raddb/mods-enabled/always   always notfound {       rcode = "notfound"       simulcount = 0       mpp = no   }   # Loading module "noop" from file /etc/raddb/mods-enabled/always   always noop {       rcode = "noop"       simulcount = 0       mpp = no   }   # Loading module "updated" from file /etc/raddb/mods-enabled/always   always updated {       rcode = "updated"       simulcount = 0       mpp = no   }   # Loading module "exec" from file /etc/raddb/mods-enabled/exec   exec {       wait = no       input_pairs = "request"       shell_escape = yes       timeout = 10   }   # Loaded module rlm_cache   # Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap   cache cache_eap {       driver = "rlm_cache_rbtree"       key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"       ttl = 15       max_entries = 0       epoch = 0       add_stats = no   }   # Loaded module rlm_files   # Loading module "files" from file /etc/raddb/mods-enabled/files   files {       filename = "/etc/raddb/mods-config/files/authorize"       acctusersfile = "/etc/raddb/mods-config/files/accounting"       preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy"   }   # Loaded module rlm_utf8   # Loading module "utf8" from file /etc/raddb/mods-enabled/utf8   # Loaded module rlm_ldap   # Loading module "ldap" from file /etc/raddb/mods-enabled/ldap   ldap {       server = "localhost"       identity = "cn=manager,ou=Internal,dc=system,dc=lan"       password = <<< secret >>>    sasl {    }    user {        scope = "sub"        access_positive = yes     sasl {     }    }    group {        filter = "(objectClass=posixGroup)"        scope = "sub"        name_attribute = "cn"        membership_attribute = "memberOf"        cacheable_name = no        cacheable_dn = no    }    client {        filter = "(objectClass=frClient)"        scope = "sub"        base_dn = "dc=system,dc=lan"    }    profile {    }    options {        ldap_debug = 40        chase_referrals = yes        rebind = yes        net_timeout = 1        res_timeout = 20        srv_timelimit = 20        idle = 60        probes = 3        interval = 3    }    tls {        start_tls = no    }   } Creating attribute LDAP-Group   # Loaded module rlm_passwd   # Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd   passwd etc_passwd {       filename = "/etc/passwd"       format = "*User-Name:Crypt-Password:"       delimiter = ":"       ignore_nislike = no       ignore_empty = yes       allow_multiple_keys = no       hash_size = 100   }   # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth   exec ntlm_auth {       wait = yes       program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"       shell_escape = yes   }   # Loaded module rlm_replicate   # Loading module "replicate" from file /etc/raddb/mods-enabled/replicate   # Loaded module rlm_digest   # Loading module "digest" from file /etc/raddb/mods-enabled/digest   # Loaded module rlm_soh   # Loading module "soh" from file /etc/raddb/mods-enabled/soh   soh {       dhcp = yes   }   # Loaded module rlm_date   # Loading module "date" from file /etc/raddb/mods-enabled/date   date {       format = "%b %e %Y %H:%M:%S %Z"   }   # Loaded module rlm_attr_filter   # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.post-proxy {       filename = "/etc/raddb/mods-config/attr_filter/post-proxy"       key = "%{Realm}"       relaxed = no   }   # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.pre-proxy {       filename = "/etc/raddb/mods-config/attr_filter/pre-proxy"       key = "%{Realm}"       relaxed = no   }   # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.access_reject {       filename = "/etc/raddb/mods-config/attr_filter/access_reject"       key = "%{User-Name}"       relaxed = no   }   # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.access_challenge {       filename = "/etc/raddb/mods-config/attr_filter/access_challenge"       key = "%{User-Name}"       relaxed = no   }   # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter   attr_filter attr_filter.accounting_response {       filename = "/etc/raddb/mods-config/attr_filter/accounting_response"       key = "%{User-Name}"       relaxed = no   }   # Loaded module rlm_unix   # Loading module "unix" from file /etc/raddb/mods-enabled/unix   unix {       radwtmp = "/var/log/radius/radwtmp"   } Creating attribute Unix-Group   # Loaded module rlm_chap   # Loading module "chap" from file /etc/raddb/mods-enabled/chap   instantiate {   }   # Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog   # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled/linelog   # Instantiating module "preprocess" from file /etc/raddb/mods-enabled/preprocess reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /etc/raddb/mods-config/preprocess/hints   # Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm   # Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm   # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm   # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm   # Instantiating module "detail" from file /etc/raddb/mods-enabled/detail   # Instantiating module "expiration" from file /etc/raddb/mods-enabled/expiration   # Instantiating module "pap" from file /etc/raddb/mods-enabled/pap   # Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output   # Instantiating module "reply_log" from file /etc/raddb/mods-enabled/detail.log   # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log   # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log   # Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap rlm_mschap (mschap): authenticating by calling 'ntlm_auth'   # Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime   # Instantiating module "eap" from file /etc/raddb/mods-enabled/eap    # Linked to sub-module rlm_eap_md5    # Linked to sub-module rlm_eap_leap    # Linked to sub-module rlm_eap_gtc    gtc {        challenge = "Password: "        auth_type = "PAP"    }    # Linked to sub-module rlm_eap_tls    tls {        tls = "tls-common"    }    tls-config tls-common {        verify_depth = 0        ca_path = "/etc/raddb/certs"        pem_file_type = yes        private_key_file = "/etc/raddb/certs/server.pem"        certificate_file = "/etc/raddb/certs/server.pem"        ca_file = "/etc/raddb/certs/ca.pem"        private_key_password = <<< secret >>>        dh_file = "/etc/raddb/certs/dh"        fragment_size = 1024        include_length = yes        auto_chain = yes        check_crl = no        check_all_crl = no        cipher_list = "DEFAULT"        cipher_server_preference = no        ecdh_curve = "prime256v1"     cache {         enable = no         lifetime = 24         max_entries = 255     }     verify {         skip_if_ocsp_ok = no     }     ocsp {         enable = no         override_cert_url = yes         url = "http://127.0.0.1/ocsp/"         use_nonce = yes         timeout = 0         softfail = no     }    }    # Linked to sub-module rlm_eap_ttls    ttls {        tls = "tls-common"        default_eap_type = "md5"        copy_request_to_tunnel = no        use_tunneled_reply = no        virtual_server = "inner-tunnel"        include_length = yes        require_client_cert = no    } tls: Using cached TLS configuration from previous invocation    # Linked to sub-module rlm_eap_peap    peap {        tls = "tls-common"        default_eap_type = "mschapv2"        copy_request_to_tunnel = no        use_tunneled_reply = no        proxy_tunneled_request_as_eap = yes        virtual_server = "inner-tunnel"        soh = no        require_client_cert = no    } tls: Using cached TLS configuration from previous invocation    # Linked to sub-module rlm_eap_mschapv2    mschapv2 {        with_ntdomain_hack = no        send_error = no    }   # Instantiating module "reject" from file /etc/raddb/mods-enabled/always   # Instantiating module "fail" from file /etc/raddb/mods-enabled/always   # Instantiating module "ok" from file /etc/raddb/mods-enabled/always   # Instantiating module "handled" from file /etc/raddb/mods-enabled/always   # Instantiating module "invalid" from file /etc/raddb/mods-enabled/always   # Instantiating module "userlock" from file /etc/raddb/mods-enabled/always   # Instantiating module "notfound" from file /etc/raddb/mods-enabled/always   # Instantiating module "noop" from file /etc/raddb/mods-enabled/always   # Instantiating module "updated" from file /etc/raddb/mods-enabled/always   # Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked   # Instantiating module "files" from file /etc/raddb/mods-enabled/files reading pairlist file /etc/raddb/mods-config/files/authorize reading pairlist file /etc/raddb/clearos-users reading pairlist file /etc/raddb/mods-config/files/accounting reading pairlist file /etc/raddb/mods-config/files/pre-proxy   # Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap rlm_ldap: libldap vendor: OpenLDAP, version: 20444    accounting {        reference = "%{tolower:type.%{Acct-Status-Type}}"    }    post-auth {        reference = "."    } rlm_ldap (ldap): Initialising connection pool    pool {        start = 5        min = 4        max = 32        spare = 3        uses = 0        lifetime = 0        cleanup_interval = 30        idle_timeout = 60        retry_delay = 1        spread = no    } rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used rlm_ldap (ldap): Connecting to ldap://localhost:389 rlm_ldap (ldap): Waiting for bind result... rlm_ldap (ldap): Bind successful   # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no   # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy   # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy   # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay"     found in filter list for realm "DEFAULT". [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec"     found in filter list for realm "DEFAULT".   # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge   # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled/attr_filter reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response  } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel  # Loading authenticate {...}  # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst)  # Loading session {...}  # Loading post-proxy {...}  # Loading post-auth {...}  # Skipping contents of 'if' as it is always 'false' -- /etc/raddb/sites-enabled/inner-tunnel:331 } # server inner-tunnel server default { # from file /etc/raddb/sites-enabled/default  # Loading authenticate {...}  # Loading authorize {...}  # Loading preacct {...}  # Loading accounting {...}  # Loading post-proxy {...}  # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen {       type = "auth"       ipaddr = 127.0.0.1       port = 18120 } listen {       type = "auth"       ipaddr = *       port = 0    limit {        max_connections = 16        lifetime = 0        idle_timeout = 30    } } listen {       type = "acct"       ipaddr = *       port = 0    limit {        max_connections = 16        lifetime = 0        idle_timeout = 30    } } listen {       type = "auth"       ipv6addr = ::       port = 0    limit {        max_connections = 16        lifetime = 0        idle_timeout = 30    } } listen {       type = "acct"       ipv6addr = ::       port = 0    limit {        max_connections = 16        lifetime = 0        idle_timeout = 30    } } Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 57252 Listening on proxy address :: port 47451 Ready to process requests (0) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 147 (0)   User-Name = "CLEARSYSTEM\\test1" (0)   NAS-IP-Address = 172.22.22.254 (0)   Called-Station-Id = "001601dfe596" (0)   Calling-Station-Id = "74da38d41a8b" (0)   NAS-Identifier = "001601dfe596" (0)   NAS-Port = 5 (0)   Framed-MTU = 1400 (0)   NAS-Port-Type = Wireless-802.11 (0)   EAP-Message = 0x0200001601434c45415253595354454d5c7465737431 (0)   Message-Authenticator = 0x1d84b5eda6657fc2b0664d6a26fab7c9 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0)   authorize { (0)     policy filter_username { (0)       if (&User-Name) { (0)       if (&User-Name)  -> TRUE (0)       if (&User-Name)  { (0)         if (&User-Name =~ / /) { (0)         if (&User-Name =~ / /)  -> FALSE (0)         if (&User-Name =~ /@[^@]*@/ ) { (0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (0)         if (&User-Name =~ /\.\./ ) { (0)         if (&User-Name =~ /\.\./ )  -> FALSE (0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (0)         if (&User-Name =~ /\.$/)  { (0)         if (&User-Name =~ /\.$/)   -> FALSE (0)         if (&User-Name =~ /@\./)  { (0)         if (&User-Name =~ /@\./)   -> FALSE (0)       } # if (&User-Name)  = notfound (0)     } # policy filter_username = notfound (0)     [preprocess] = ok (0)     [chap] = noop (0)     [mschap] = noop (0)     [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (0) suffix: No such realm "NULL" (0)     [suffix] = noop (0) ntdomain: Checking for prefix before "\" (0) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (0) ntdomain: Found realm "CLEARSYSTEM" (0) ntdomain: Adding Stripped-User-Name = "test1" (0) ntdomain: Adding Realm = "CLEARSYSTEM" (0) ntdomain: Authentication realm is LOCAL (0)     [ntdomain] = ok (0) eap: Peer sent EAP Response (code 2) ID 0 length 22 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0)     [eap] = ok (0)   } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/raddb/sites-enabled/default (0)   authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_peap to process data (0) eap_peap: Initiating new EAP-TLS session (0) eap_peap: [eaptls start] = request (0) eap: Sending EAP Request (code 1) ID 1 length 6 (0) eap: EAP session adding &reply:State = 0x6d805dd76d814438 (0)     [eap] = handled (0)   } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/raddb/sites-enabled/default (0)   Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (0)   EAP-Message = 0x010100061920 (0)   Message-Authenticator = 0x00000000000000000000000000000000 (0)   State = 0x6d805dd76d814438dc40c2ae6afa62ac (0) Finished request Waking up in 4.9 seconds. (0) Cleaning up request packet ID 0 with timestamp +13 (1) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 309 (1)   User-Name = "CLEARSYSTEM\\test1" (1)   NAS-IP-Address = 172.22.22.254 (1)   Called-Station-Id = "001601dfe596" (1)   Calling-Station-Id = "74da38d41a8b" (1)   NAS-Identifier = "001601dfe596" (1)   NAS-Port = 5 (1)   Framed-MTU = 1400 (1)   State = 0x6d805dd76d814438dc40c2ae6afa62ac (1)   NAS-Port-Type = Wireless-802.11 (1)   EAP-Message = 0x020100a619800000009c16030300970100009303035af2cd197aa9b2ed29f9de90733a7f3238b0584cd2319b55c1e84641e62ee34f00002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d (1)   Message-Authenticator = 0x7fb87a121953bf0a44ec6a8e8af28586 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/raddb/sites-enabled/default (1)   authorize { (1)     policy filter_username { (1)       if (&User-Name) { (1)       if (&User-Name)  -> TRUE (1)       if (&User-Name)  { (1)         if (&User-Name =~ / /) { (1)         if (&User-Name =~ / /)  -> FALSE (1)         if (&User-Name =~ /@[^@]*@/ ) { (1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (1)         if (&User-Name =~ /\.\./ ) { (1)         if (&User-Name =~ /\.\./ )  -> FALSE (1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (1)         if (&User-Name =~ /\.$/)  { (1)         if (&User-Name =~ /\.$/)   -> FALSE (1)         if (&User-Name =~ /@\./)  { (1)         if (&User-Name =~ /@\./)   -> FALSE (1)       } # if (&User-Name)  = notfound (1)     } # policy filter_username = notfound (1)     [preprocess] = ok (1)     [chap] = noop (1)     [mschap] = noop (1)     [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (1) suffix: No such realm "NULL" (1)     [suffix] = noop (1) ntdomain: Checking for prefix before "\" (1) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (1) ntdomain: Found realm "CLEARSYSTEM" (1) ntdomain: Adding Stripped-User-Name = "test1" (1) ntdomain: Adding Realm = "CLEARSYSTEM" (1) ntdomain: Authentication realm is LOCAL (1)     [ntdomain] = ok (1) eap: Peer sent EAP Response (code 2) ID 1 length 166 (1) eap: Continuing tunnel setup (1)     [eap] = ok (1)   } # authorize = ok (1) Found Auth-Type = eap (1) # Executing group from file /etc/raddb/sites-enabled/default (1)   authenticate { (1) eap: Expiring EAP session with state 0x6d805dd76d814438 (1) eap: Finished EAP session with state 0x6d805dd76d814438 (1) eap: Previous EAP request found for state 0x6d805dd76d814438, released from the list (1) eap: Peer sent packet with method EAP PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Continuing EAP-TLS (1) eap_peap: Peer indicated complete TLS record size will be 156 bytes (1) eap_peap: Got complete TLS record (156 bytes) (1) eap_peap: [eaptls verify] = length included (1) eap_peap: (other): before/accept initialization (1) eap_peap: TLS_accept: before/accept initialization (1) eap_peap: <<< recv TLS 1.2  [length 0097] (1) eap_peap: TLS_accept: SSLv3 read client hello A (1) eap_peap: >>> send TLS 1.2  [length 0039] (1) eap_peap: TLS_accept: SSLv3 write server hello A (1) eap_peap: >>> send TLS 1.2  [length 08bd] (1) eap_peap: TLS_accept: SSLv3 write certificate A (1) eap_peap: >>> send TLS 1.2  [length 014d] (1) eap_peap: TLS_accept: SSLv3 write key exchange A (1) eap_peap: >>> send TLS 1.2  [length 0004] (1) eap_peap: TLS_accept: SSLv3 write server done A (1) eap_peap: TLS_accept: SSLv3 flush data (1) eap_peap: TLS_accept: SSLv3 read client certificate A (1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key exchange A (1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key exchange A (1) eap_peap: In SSL Handshake Phase (1) eap_peap: In SSL Accept mode (1) eap_peap: [eaptls process] = handled (1) eap: Sending EAP Request (code 1) ID 2 length 1004 (1) eap: EAP session adding &reply:State = 0x6d805dd76c824438 (1)     [eap] = handled (1)   } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/raddb/sites-enabled/default (1)   Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (1)   EAP-Message = 0x010203ec19c000000a5b160303003902000035030316a54dc3118ee9fa4b5f98e46a2b32d5ddecf2a97c4f67ea076f396d6ac2104e00c03000000dff01000100000b00040300010216030308bd0b0008b90008b60003fb308203f7308202dfa003020102020101300d06092a864886f70d01010b050030 (1)   Message-Authenticator = 0x00000000000000000000000000000000 (1)   State = 0x6d805dd76c824438dc40c2ae6afa62ac (1) Finished request Waking up in 4.9 seconds. (1) Cleaning up request packet ID 0 with timestamp +13 (2) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (2)   User-Name = "CLEARSYSTEM\\test1" (2)   NAS-IP-Address = 172.22.22.254 (2)   Called-Station-Id = "001601dfe596" (2)   Calling-Station-Id = "74da38d41a8b" (2)   NAS-Identifier = "001601dfe596" (2)   NAS-Port = 5 (2)   Framed-MTU = 1400 (2)   State = 0x6d805dd76c824438dc40c2ae6afa62ac (2)   NAS-Port-Type = Wireless-802.11 (2)   EAP-Message = 0x020200061900 (2)   Message-Authenticator = 0x8c79c6a2fb19c89ac4017cfaee83ebeb (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/raddb/sites-enabled/default (2)   authorize { (2)     policy filter_username { (2)       if (&User-Name) { (2)       if (&User-Name)  -> TRUE (2)       if (&User-Name)  { (2)         if (&User-Name =~ / /) { (2)         if (&User-Name =~ / /)  -> FALSE (2)         if (&User-Name =~ /@[^@]*@/ ) { (2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (2)         if (&User-Name =~ /\.\./ ) { (2)         if (&User-Name =~ /\.\./ )  -> FALSE (2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (2)         if (&User-Name =~ /\.$/)  { (2)         if (&User-Name =~ /\.$/)   -> FALSE (2)         if (&User-Name =~ /@\./)  { (2)         if (&User-Name =~ /@\./)   -> FALSE (2)       } # if (&User-Name)  = notfound (2)     } # policy filter_username = notfound (2)     [preprocess] = ok (2)     [chap] = noop (2)     [mschap] = noop (2)     [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (2) suffix: No such realm "NULL" (2)     [suffix] = noop (2) ntdomain: Checking for prefix before "\" (2) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (2) ntdomain: Found realm "CLEARSYSTEM" (2) ntdomain: Adding Stripped-User-Name = "test1" (2) ntdomain: Adding Realm = "CLEARSYSTEM" (2) ntdomain: Authentication realm is LOCAL (2)     [ntdomain] = ok (2) eap: Peer sent EAP Response (code 2) ID 2 length 6 (2) eap: Continuing tunnel setup (2)     [eap] = ok (2)   } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/raddb/sites-enabled/default (2)   authenticate { (2) eap: Expiring EAP session with state 0x6d805dd76c824438 (2) eap: Finished EAP session with state 0x6d805dd76c824438 (2) eap: Previous EAP request found for state 0x6d805dd76c824438, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer ACKed our handshake fragment (2) eap_peap: [eaptls verify] = request (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 3 length 1000 (2) eap: EAP session adding &reply:State = 0x6d805dd76f834438 (2)     [eap] = handled (2)   } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/raddb/sites-enabled/default (2)   Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (2)   EAP-Message = 0x010303e819408444f5b804aa2d65ef2b23820bb1bf1bfcb24df6bd03eabe61d7bb630cfd9fd6165d19f24d23925593c04c7ec13d5afe51369fe487605e2de3073d043a15e72448712bca946e329e81ff36cebcdfe8be08dc6490da38ed9147e7eac88af7f25487bee0ef80700004b5308204b130820399 (2)   Message-Authenticator = 0x00000000000000000000000000000000 (2)   State = 0x6d805dd76f834438dc40c2ae6afa62ac (2) Finished request Waking up in 4.9 seconds. (2) Cleaning up request packet ID 0 with timestamp +13 (3) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (3)   User-Name = "CLEARSYSTEM\\test1" (3)   NAS-IP-Address = 172.22.22.254 (3)   Called-Station-Id = "001601dfe596" (3)   Calling-Station-Id = "74da38d41a8b" (3)   NAS-Identifier = "001601dfe596" (3)   NAS-Port = 5 (3)   Framed-MTU = 1400 (3)   State = 0x6d805dd76f834438dc40c2ae6afa62ac (3)   NAS-Port-Type = Wireless-802.11 (3)   EAP-Message = 0x020300061900 (3)   Message-Authenticator = 0x35a39e6139230d22912378e6c8a35696 (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/raddb/sites-enabled/default (3)   authorize { (3)     policy filter_username { (3)       if (&User-Name) { (3)       if (&User-Name)  -> TRUE (3)       if (&User-Name)  { (3)         if (&User-Name =~ / /) { (3)         if (&User-Name =~ / /)  -> FALSE (3)         if (&User-Name =~ /@[^@]*@/ ) { (3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (3)         if (&User-Name =~ /\.\./ ) { (3)         if (&User-Name =~ /\.\./ )  -> FALSE (3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (3)         if (&User-Name =~ /\.$/)  { (3)         if (&User-Name =~ /\.$/)   -> FALSE (3)         if (&User-Name =~ /@\./)  { (3)         if (&User-Name =~ /@\./)   -> FALSE (3)       } # if (&User-Name)  = notfound (3)     } # policy filter_username = notfound (3)     [preprocess] = ok (3)     [chap] = noop (3)     [mschap] = noop (3)     [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (3) suffix: No such realm "NULL" (3)     [suffix] = noop (3) ntdomain: Checking for prefix before "\" (3) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (3) ntdomain: Found realm "CLEARSYSTEM" (3) ntdomain: Adding Stripped-User-Name = "test1" (3) ntdomain: Adding Realm = "CLEARSYSTEM" (3) ntdomain: Authentication realm is LOCAL (3)     [ntdomain] = ok (3) eap: Peer sent EAP Response (code 2) ID 3 length 6 (3) eap: Continuing tunnel setup (3)     [eap] = ok (3)   } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/raddb/sites-enabled/default (3)   authenticate { (3) eap: Expiring EAP session with state 0x6d805dd76f834438 (3) eap: Finished EAP session with state 0x6d805dd76f834438 (3) eap: Previous EAP request found for state 0x6d805dd76f834438, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 4 length 669 (3) eap: EAP session adding &reply:State = 0x6d805dd76e844438 (3)     [eap] = handled (3)   } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/raddb/sites-enabled/default (3)   Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (3)   EAP-Message = 0x0104029d1900278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b050003820101000132a42023b4da19cd0464809979cba06e09409f4cbae9db226b41b48d0c97de8fa6092c00476cb9f16399e310996fb68c40e69b10 (3)   Message-Authenticator = 0x00000000000000000000000000000000 (3)   State = 0x6d805dd76e844438dc40c2ae6afa62ac (3) Finished request Waking up in 4.9 seconds. (3) Cleaning up request packet ID 0 with timestamp +13 (4) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 279 (4)   User-Name = "CLEARSYSTEM\\test1" (4)   NAS-IP-Address = 172.22.22.254 (4)   Called-Station-Id = "001601dfe596" (4)   Calling-Station-Id = "74da38d41a8b" (4)   NAS-Identifier = "001601dfe596" (4)   NAS-Port = 5 (4)   Framed-MTU = 1400 (4)   State = 0x6d805dd76e844438dc40c2ae6afa62ac (4)   NAS-Port-Type = Wireless-802.11 (4)   EAP-Message = 0x0204008819800000007e1603030046100000424104f977f1abd9c3d74a88eac2ee83ee009474c95ec8e0d265416e7b88ea8c1109e7dc7c9d422d8eb0044f2dc31855ba3ddfd3bd4223dd12685b4b6388c6e83be67c14030300010116030300280000000000000000c9cdd6db357f227df3eaa98933ecdb (4)   Message-Authenticator = 0xefd856add429620c23bf7cba64530c9e (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/raddb/sites-enabled/default (4)   authorize { (4)     policy filter_username { (4)       if (&User-Name) { (4)       if (&User-Name)  -> TRUE (4)       if (&User-Name)  { (4)         if (&User-Name =~ / /) { (4)         if (&User-Name =~ / /)  -> FALSE (4)         if (&User-Name =~ /@[^@]*@/ ) { (4)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (4)         if (&User-Name =~ /\.\./ ) { (4)         if (&User-Name =~ /\.\./ )  -> FALSE (4)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (4)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (4)         if (&User-Name =~ /\.$/)  { (4)         if (&User-Name =~ /\.$/)   -> FALSE (4)         if (&User-Name =~ /@\./)  { (4)         if (&User-Name =~ /@\./)   -> FALSE (4)       } # if (&User-Name)  = notfound (4)     } # policy filter_username = notfound (4)     [preprocess] = ok (4)     [chap] = noop (4)     [mschap] = noop (4)     [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (4) suffix: No such realm "NULL" (4)     [suffix] = noop (4) ntdomain: Checking for prefix before "\" (4) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (4) ntdomain: Found realm "CLEARSYSTEM" (4) ntdomain: Adding Stripped-User-Name = "test1" (4) ntdomain: Adding Realm = "CLEARSYSTEM" (4) ntdomain: Authentication realm is LOCAL (4)     [ntdomain] = ok (4) eap: Peer sent EAP Response (code 2) ID 4 length 136 (4) eap: Continuing tunnel setup (4)     [eap] = ok (4)   } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/raddb/sites-enabled/default (4)   authenticate { (4) eap: Expiring EAP session with state 0x6d805dd76e844438 (4) eap: Finished EAP session with state 0x6d805dd76e844438 (4) eap: Previous EAP request found for state 0x6d805dd76e844438, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer indicated complete TLS record size will be 126 bytes (4) eap_peap: Got complete TLS record (126 bytes) (4) eap_peap: [eaptls verify] = length included (4) eap_peap: <<< recv TLS 1.2  [length 0046] (4) eap_peap: TLS_accept: SSLv3 read client key exchange A (4) eap_peap: TLS_accept: SSLv3 read certificate verify A (4) eap_peap: <<< recv TLS 1.2  [length 0001] (4) eap_peap: <<< recv TLS 1.2  [length 0010] (4) eap_peap: TLS_accept: SSLv3 read finished A (4) eap_peap: >>> send TLS 1.2  [length 0001] (4) eap_peap: TLS_accept: SSLv3 write change cipher spec A (4) eap_peap: >>> send TLS 1.2  [length 0010] (4) eap_peap: TLS_accept: SSLv3 write finished A (4) eap_peap: TLS_accept: SSLv3 flush data (4) eap_peap: (other): SSL negotiation finished successfully (4) eap_peap: SSL Connection Established (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 5 length 57 (4) eap: EAP session adding &reply:State = 0x6d805dd769854438 (4)     [eap] = handled (4)   } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/raddb/sites-enabled/default (4)   Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (4)   EAP-Message = 0x0105003919001403030001011603030028dc5fcf74a4d4eceeb580ed30367b623e9b143f2e07946b341b187a4b5ffedaff73403f3ee546b992 (4)   Message-Authenticator = 0x00000000000000000000000000000000 (4)   State = 0x6d805dd769854438dc40c2ae6afa62ac (4) Finished request Waking up in 4.9 seconds. (4) Cleaning up request packet ID 0 with timestamp +13 (5) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (5)   User-Name = "CLEARSYSTEM\\test1" (5)   NAS-IP-Address = 172.22.22.254 (5)   Called-Station-Id = "001601dfe596" (5)   Calling-Station-Id = "74da38d41a8b" (5)   NAS-Identifier = "001601dfe596" (5)   NAS-Port = 5 (5)   Framed-MTU = 1400 (5)   State = 0x6d805dd769854438dc40c2ae6afa62ac (5)   NAS-Port-Type = Wireless-802.11 (5)   EAP-Message = 0x020500061900 (5)   Message-Authenticator = 0x44670280e3acbc66b6f39801f08a9398 (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/raddb/sites-enabled/default (5)   authorize { (5)     policy filter_username { (5)       if (&User-Name) { (5)       if (&User-Name)  -> TRUE (5)       if (&User-Name)  { (5)         if (&User-Name =~ / /) { (5)         if (&User-Name =~ / /)  -> FALSE (5)         if (&User-Name =~ /@[^@]*@/ ) { (5)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (5)         if (&User-Name =~ /\.\./ ) { (5)         if (&User-Name =~ /\.\./ )  -> FALSE (5)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (5)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (5)         if (&User-Name =~ /\.$/)  { (5)         if (&User-Name =~ /\.$/)   -> FALSE (5)         if (&User-Name =~ /@\./)  { (5)         if (&User-Name =~ /@\./)   -> FALSE (5)       } # if (&User-Name)  = notfound (5)     } # policy filter_username = notfound (5)     [preprocess] = ok (5)     [chap] = noop (5)     [mschap] = noop (5)     [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (5) suffix: No such realm "NULL" (5)     [suffix] = noop (5) ntdomain: Checking for prefix before "\" (5) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (5) ntdomain: Found realm "CLEARSYSTEM" (5) ntdomain: Adding Stripped-User-Name = "test1" (5) ntdomain: Adding Realm = "CLEARSYSTEM" (5) ntdomain: Authentication realm is LOCAL (5)     [ntdomain] = ok (5) eap: Peer sent EAP Response (code 2) ID 5 length 6 (5) eap: Continuing tunnel setup (5)     [eap] = ok (5)   } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/raddb/sites-enabled/default (5)   authenticate { (5) eap: Expiring EAP session with state 0x6d805dd769854438 (5) eap: Finished EAP session with state 0x6d805dd769854438 (5) eap: Previous EAP request found for state 0x6d805dd769854438, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer ACKed our handshake fragment.  handshake is finished (5) eap_peap: [eaptls verify] = success (5) eap_peap: [eaptls process] = success (5) eap_peap: Session established.  Decoding tunneled attributes (5) eap_peap: PEAP state TUNNEL ESTABLISHED (5) eap: Sending EAP Request (code 1) ID 6 length 40 (5) eap: EAP session adding &reply:State = 0x6d805dd768864438 (5)     [eap] = handled (5)   } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/raddb/sites-enabled/default (5)   Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (5)   EAP-Message = 0x010600281900170303001ddc5fcf74a4d4eceff440279910950fcf0da56053dafc7b1a9acc0e9818 (5)   Message-Authenticator = 0x00000000000000000000000000000000 (5)   State = 0x6d805dd768864438dc40c2ae6afa62ac (5) Finished request Waking up in 4.9 seconds. (5) Cleaning up request packet ID 0 with timestamp +13 (6) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 196 (6)   User-Name = "CLEARSYSTEM\\test1" (6)   NAS-IP-Address = 172.22.22.254 (6)   Called-Station-Id = "001601dfe596" (6)   Calling-Station-Id = "74da38d41a8b" (6)   NAS-Identifier = "001601dfe596" (6)   NAS-Port = 5 (6)   Framed-MTU = 1400 (6)   State = 0x6d805dd768864438dc40c2ae6afa62ac (6)   NAS-Port-Type = Wireless-802.11 (6)   EAP-Message = 0x020600351900170303002a0000000000000001dd244541a65b0c86c71280b371970a1a1c7be8090c517215185792c4ef34ace82894 (6)   Message-Authenticator = 0xe01b3ffbd597dcf5f7f0f0dd8bc4ea9d (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/raddb/sites-enabled/default (6)   authorize { (6)     policy filter_username { (6)       if (&User-Name) { (6)       if (&User-Name)  -> TRUE (6)       if (&User-Name)  { (6)         if (&User-Name =~ / /) { (6)         if (&User-Name =~ / /)  -> FALSE (6)         if (&User-Name =~ /@[^@]*@/ ) { (6)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (6)         if (&User-Name =~ /\.\./ ) { (6)         if (&User-Name =~ /\.\./ )  -> FALSE (6)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (6)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (6)         if (&User-Name =~ /\.$/)  { (6)         if (&User-Name =~ /\.$/)   -> FALSE (6)         if (&User-Name =~ /@\./)  { (6)         if (&User-Name =~ /@\./)   -> FALSE (6)       } # if (&User-Name)  = notfound (6)     } # policy filter_username = notfound (6)     [preprocess] = ok (6)     [chap] = noop (6)     [mschap] = noop (6)     [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (6) suffix: No such realm "NULL" (6)     [suffix] = noop (6) ntdomain: Checking for prefix before "\" (6) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (6) ntdomain: Found realm "CLEARSYSTEM" (6) ntdomain: Adding Stripped-User-Name = "test1" (6) ntdomain: Adding Realm = "CLEARSYSTEM" (6) ntdomain: Authentication realm is LOCAL (6)     [ntdomain] = ok (6) eap: Peer sent EAP Response (code 2) ID 6 length 53 (6) eap: Continuing tunnel setup (6)     [eap] = ok (6)   } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/raddb/sites-enabled/default (6)   authenticate { (6) eap: Expiring EAP session with state 0x6d805dd768864438 (6) eap: Finished EAP session with state 0x6d805dd768864438 (6) eap: Previous EAP request found for state 0x6d805dd768864438, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: [eaptls verify] = ok (6) eap_peap: Done initial handshake (6) eap_peap: [eaptls process] = ok (6) eap_peap: Session established.  Decoding tunneled attributes (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY (6) eap_peap: Identity - CLEARSYSTEM\test1 (6) eap_peap: Got inner identity 'CLEARSYSTEM\test1' (6) eap_peap: Setting default EAP type for tunneled EAP session (6) eap_peap: Got tunneled request (6) eap_peap:   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (6) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (6) eap_peap: Sending tunneled request to inner-tunnel (6) eap_peap:   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (6) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (6) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (6) Virtual server inner-tunnel received request (6)   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (6)   FreeRADIUS-Proxied-To = 127.0.0.1 (6)   User-Name = "CLEARSYSTEM\\test1" (6) WARNING: Outer and inner identities are the same.  User privacy is compromised. (6) server inner-tunnel { (6)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (6)     authorize { (6)       policy filter_username { (6)         if (&User-Name) { (6)         if (&User-Name)  -> TRUE (6)         if (&User-Name)  { (6)           if (&User-Name =~ / /) { (6)           if (&User-Name =~ / /)  -> FALSE (6)           if (&User-Name =~ /@[^@]*@/ ) { (6)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (6)           if (&User-Name =~ /\.\./ ) { (6)           if (&User-Name =~ /\.\./ )  -> FALSE (6)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (6)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (6)           if (&User-Name =~ /\.$/)  { (6)           if (&User-Name =~ /\.$/)   -> FALSE (6)           if (&User-Name =~ /@\./)  { (6)           if (&User-Name =~ /@\./)   -> FALSE (6)         } # if (&User-Name)  = notfound (6)       } # policy filter_username = notfound (6)       [chap] = noop (6)       [mschap] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (6) suffix: No such realm "NULL" (6)       [suffix] = noop (6) ntdomain: Checking for prefix before "\" (6) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (6) ntdomain: Found realm "CLEARSYSTEM" (6) ntdomain: Adding Stripped-User-Name = "test1" (6) ntdomain: Adding Realm = "CLEARSYSTEM" (6) ntdomain: Authentication realm is LOCAL (6)       [ntdomain] = ok (6)       update control { (6)         &Proxy-To-Realm := LOCAL (6)       } # update control = noop (6) eap: Peer sent EAP Response (code 2) ID 6 length 22 (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (6)       [eap] = ok (6)     } # authorize = ok (6)   Found Auth-Type = eap (6)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (6)     authenticate { (6) eap: Peer sent packet with method EAP Identity (1) (6) eap: Calling submodule eap_mschapv2 to process data (6) eap_mschapv2: Issuing Challenge (6) eap: Sending EAP Request (code 1) ID 7 length 43 (6) eap: EAP session adding &reply:State = 0x66e3bd0266e4a7fb (6)       [eap] = handled (6)     } # authenticate = handled (6) } # server inner-tunnel (6) Virtual server sending reply (6)   EAP-Message = 0x0107002b1a01070026108d0fd294b2abb0cb4390aef8e7e334f0667265657261646975732d332e302e3133 (6)   Message-Authenticator = 0x00000000000000000000000000000000 (6)   State = 0x66e3bd0266e4a7fba16dc6bfc6cef435 (6) eap_peap: Got tunneled reply code 11 (6) eap_peap:   EAP-Message = 0x0107002b1a01070026108d0fd294b2abb0cb4390aef8e7e334f0667265657261646975732d332e302e3133 (6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap:   State = 0x66e3bd0266e4a7fba16dc6bfc6cef435 (6) eap_peap: Got tunneled reply RADIUS code 11 (6) eap_peap:   EAP-Message = 0x0107002b1a01070026108d0fd294b2abb0cb4390aef8e7e334f0667265657261646975732d332e302e3133 (6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (6) eap_peap:   State = 0x66e3bd0266e4a7fba16dc6bfc6cef435 (6) eap_peap: Got tunneled Access-Challenge (6) eap: Sending EAP Request (code 1) ID 7 length 74 (6) eap: EAP session adding &reply:State = 0x6d805dd76b874438 (6)     [eap] = handled (6)   } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/raddb/sites-enabled/default (6)   Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (6)   EAP-Message = 0x0107004a1900170303003fdc5fcf74a4d4ecf07ea22af536fa57cb428f1212cc762f73aecf7876928d4f6e657779a62eef9bc148c29f051acfe8f978bf7fcb45bcb1171b30e50382d3d3 (6)   Message-Authenticator = 0x00000000000000000000000000000000 (6)   State = 0x6d805dd76b874438dc40c2ae6afa62ac (6) Finished request Waking up in 4.9 seconds. (6) Cleaning up request packet ID 0 with timestamp +13 (7) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 250 (7)   User-Name = "CLEARSYSTEM\\test1" (7)   NAS-IP-Address = 172.22.22.254 (7)   Called-Station-Id = "001601dfe596" (7)   Calling-Station-Id = "74da38d41a8b" (7)   NAS-Identifier = "001601dfe596" (7)   NAS-Port = 5 (7)   Framed-MTU = 1400 (7)   State = 0x6d805dd76b874438dc40c2ae6afa62ac (7)   NAS-Port-Type = Wireless-802.11 (7)   EAP-Message = 0x0207006b19001703030060000000000000000219bae2d0668bb3eee9ce6bb0fc2eac4874e11bb450e239ca968d6460f050052b35bc8db55c8593cd55d4c2a998164b1c6b61a943bf0ef78db528fdd3f1dca0e8e07ff24916a4c37694cb22128f00feadf1aca1c1b2490214 (7)   Message-Authenticator = 0x6f366ccc31737e80ff78cd36f016f96d (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/raddb/sites-enabled/default (7)   authorize { (7)     policy filter_username { (7)       if (&User-Name) { (7)       if (&User-Name)  -> TRUE (7)       if (&User-Name)  { (7)         if (&User-Name =~ / /) { (7)         if (&User-Name =~ / /)  -> FALSE (7)         if (&User-Name =~ /@[^@]*@/ ) { (7)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (7)         if (&User-Name =~ /\.\./ ) { (7)         if (&User-Name =~ /\.\./ )  -> FALSE (7)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (7)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (7)         if (&User-Name =~ /\.$/)  { (7)         if (&User-Name =~ /\.$/)   -> FALSE (7)         if (&User-Name =~ /@\./)  { (7)         if (&User-Name =~ /@\./)   -> FALSE (7)       } # if (&User-Name)  = notfound (7)     } # policy filter_username = notfound (7)     [preprocess] = ok (7)     [chap] = noop (7)     [mschap] = noop (7)     [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (7) suffix: No such realm "NULL" (7)     [suffix] = noop (7) ntdomain: Checking for prefix before "\" (7) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (7) ntdomain: Found realm "CLEARSYSTEM" (7) ntdomain: Adding Stripped-User-Name = "test1" (7) ntdomain: Adding Realm = "CLEARSYSTEM" (7) ntdomain: Authentication realm is LOCAL (7)     [ntdomain] = ok (7) eap: Peer sent EAP Response (code 2) ID 7 length 107 (7) eap: Continuing tunnel setup (7)     [eap] = ok (7)   } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/raddb/sites-enabled/default (7)   authenticate { (7) eap: Expiring EAP session with state 0x66e3bd0266e4a7fb (7) eap: Finished EAP session with state 0x6d805dd76b874438 (7) eap: Previous EAP request found for state 0x6d805dd76b874438, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established.  Decoding tunneled attributes (7) eap_peap: PEAP state phase2 (7) eap_peap: EAP method MSCHAPv2 (26) (7) eap_peap: Got tunneled request (7) eap_peap:   EAP-Message = 0x0207004c1a02070047313aedab25255aa4dcad5a9e911bf87fae00000000000000007d50d953955047745972cfe092bcc2c777fd52a69b03bebb00434c45415253595354454d5c7465737431 (7) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap:   EAP-Message = 0x0207004c1a02070047313aedab25255aa4dcad5a9e911bf87fae00000000000000007d50d953955047745972cfe092bcc2c777fd52a69b03bebb00434c45415253595354454d5c7465737431 (7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (7) eap_peap:   State = 0x66e3bd0266e4a7fba16dc6bfc6cef435 (7) Virtual server inner-tunnel received request (7)   EAP-Message = 0x0207004c1a02070047313aedab25255aa4dcad5a9e911bf87fae00000000000000007d50d953955047745972cfe092bcc2c777fd52a69b03bebb00434c45415253595354454d5c7465737431 (7)   FreeRADIUS-Proxied-To = 127.0.0.1 (7)   User-Name = "CLEARSYSTEM\\test1" (7)   State = 0x66e3bd0266e4a7fba16dc6bfc6cef435 (7) WARNING: Outer and inner identities are the same.  User privacy is compromised. (7) server inner-tunnel { (7)   session-state: No cached attributes (7)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (7)     authorize { (7)       policy filter_username { (7)         if (&User-Name) { (7)         if (&User-Name)  -> TRUE (7)         if (&User-Name)  { (7)           if (&User-Name =~ / /) { (7)           if (&User-Name =~ / /)  -> FALSE (7)           if (&User-Name =~ /@[^@]*@/ ) { (7)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (7)           if (&User-Name =~ /\.\./ ) { (7)           if (&User-Name =~ /\.\./ )  -> FALSE (7)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (7)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (7)           if (&User-Name =~ /\.$/)  { (7)           if (&User-Name =~ /\.$/)   -> FALSE (7)           if (&User-Name =~ /@\./)  { (7)           if (&User-Name =~ /@\./)   -> FALSE (7)         } # if (&User-Name)  = notfound (7)       } # policy filter_username = notfound (7)       [chap] = noop (7)       [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (7) suffix: No such realm "NULL" (7)       [suffix] = noop (7) ntdomain: Checking for prefix before "\" (7) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (7) ntdomain: Found realm "CLEARSYSTEM" (7) ntdomain: Adding Stripped-User-Name = "test1" (7) ntdomain: Adding Realm = "CLEARSYSTEM" (7) ntdomain: Authentication realm is LOCAL (7)       [ntdomain] = ok (7)       update control { (7)         &Proxy-To-Realm := LOCAL (7)       } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 7 length 76 (7) eap: No EAP Start, assuming it's an on-going EAP conversation (7)       [eap] = updated (7) files: Searching for user in group "allusers" rlm_ldap (ldap): Reserved connection (0) (7) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7) files:    --> (uid=test1) (7) files: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (7) files: Waiting for search result... (7) files: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (7) files: Checking user object's memberOf attributes (7) files:   Performing unfiltered search in "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan", scope "base" (7) files:   Waiting for search result... (7) files: Processing memberOf value "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (7) files:   Resolving group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (7) files:   Performing unfiltered search in "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (7) files:   Waiting for search result... (7) files:   Group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "ftp_plugin" (7) files: Processing memberOf value "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (7) files:   Resolving group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (7) files:   Performing unfiltered search in "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (7) files:   Waiting for search result... (7) files:   Group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "web_proxy_plugin" (7) files: Processing memberOf value "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (7) files:   Resolving group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (7) files:   Performing unfiltered search in "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (7) files:   Waiting for search result... (7) files:   Group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "webupload" (7) files: Processing memberOf value "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (7) files:   Resolving group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (7) files:   Performing unfiltered search in "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (7) files:   Waiting for search result... (7) files:   Group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "allusers" (7) files: User found in group "allusers". Comparison between membership: name (resolved from DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan"), check: name rlm_ldap (ldap): Released connection (0) (7)       [files] = noop rlm_ldap (ldap): Reserved connection (1) (7) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (7) ldap:    --> (uid=test1) (7) ldap: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (7) ldap: Waiting for search result... (7) ldap: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (7) ldap: Processing user attributes (7) ldap: control:Password-With-Header += '{sha}tESsBmE/yNY3lb6a0L6vVQEZNqw=' rlm_ldap (ldap): Released connection (1) (7)       [ldap] = updated (7)       [expiration] = noop (7)       [logintime] = noop (7) pap: Converted: &control:Password-With-Header -> &control:SHA1-Password (7) pap: Removing &control:Password-With-Header (7) pap: Normalizing SHA1-Password from base64 encoding, 28 bytes -> 20 bytes (7) pap: WARNING: Auth-Type already set.  Not setting to PAP (7)       [pap] = noop (7)     } # authorize = updated (7)   Found Auth-Type = eap (7)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7)     authenticate { (7) eap: Expiring EAP session with state 0x66e3bd0266e4a7fb (7) eap: Finished EAP session with state 0x66e3bd0266e4a7fb (7) eap: Previous EAP request found for state 0x66e3bd0266e4a7fb, released from the list (7) eap: Peer sent packet with method EAP MSCHAPv2 (26) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (7) eap_mschapv2:   authenticate { (7) mschap: Creating challenge hash with username: test1 (7) mschap: Client is using MS-CHAPv2 (7) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (7) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (7) mschap:    --> --username=test1 (7) mschap: Creating challenge hash with username: test1 (7) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (7) mschap:    --> --challenge=3b9d7892b41cf3b0 (7) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (7) mschap:    --> --nt-response=7d50d953955047745972cfe092bcc2c777fd52a69b03bebb (7) mschap: Program returned code (0) and output 'NT_KEY: DAE53F1776DBD0817C5639A27629A27D' (7) mschap: Adding MS-CHAPv2 MPPE keys (7)     [mschap] = ok (7)   } # authenticate = ok (7) MSCHAP Success (7) eap: Sending EAP Request (code 1) ID 8 length 51 (7) eap: EAP session adding &reply:State = 0x66e3bd0267eba7fb (7)       [eap] = handled (7)     } # authenticate = handled (7) } # server inner-tunnel (7) Virtual server sending reply (7)   EAP-Message = 0x010800331a0307002e533d39313144313544453236303432433942464146394246343432383636363746354335423938343630 (7)   Message-Authenticator = 0x00000000000000000000000000000000 (7)   State = 0x66e3bd0267eba7fba16dc6bfc6cef435 (7) eap_peap: Got tunneled reply code 11 (7) eap_peap:   EAP-Message = 0x010800331a0307002e533d39313144313544453236303432433942464146394246343432383636363746354335423938343630 (7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap:   State = 0x66e3bd0267eba7fba16dc6bfc6cef435 (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap:   EAP-Message = 0x010800331a0307002e533d39313144313544453236303432433942464146394246343432383636363746354335423938343630 (7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap:   State = 0x66e3bd0267eba7fba16dc6bfc6cef435 (7) eap_peap: Got tunneled Access-Challenge (7) eap: Sending EAP Request (code 1) ID 8 length 82 (7) eap: EAP session adding &reply:State = 0x6d805dd76a884438 (7)     [eap] = handled (7)   } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/raddb/sites-enabled/default (7)   Challenge { ... } # empty sub-section is ignored (7) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (7)   EAP-Message = 0x0108005219001703030047dc5fcf74a4d4ecf1ffeae2c864301f5752178e45427e243559fbf7f51b067715629d035309535ef9b4cbb1c8456cba01f0cd65f3a66724bec8cd596926856cc18e9a444620321d (7)   Message-Authenticator = 0x00000000000000000000000000000000 (7)   State = 0x6d805dd76a884438dc40c2ae6afa62ac (7) Finished request Waking up in 4.9 seconds. (7) Cleaning up request packet ID 0 with timestamp +13 (8) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 180 (8)   User-Name = "CLEARSYSTEM\\test1" (8)   NAS-IP-Address = 172.22.22.254 (8)   Called-Station-Id = "001601dfe596" (8)   Calling-Station-Id = "74da38d41a8b" (8)   NAS-Identifier = "001601dfe596" (8)   NAS-Port = 5 (8)   Framed-MTU = 1400 (8)   State = 0x6d805dd76a884438dc40c2ae6afa62ac (8)   NAS-Port-Type = Wireless-802.11 (8)   EAP-Message = 0x020800251900170303001a00000000000000034a80351d48d47617d97ab576bf0a41900ffa (8)   Message-Authenticator = 0x8e3a7df7c36095515fae4cc97400d895 (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/raddb/sites-enabled/default (8)   authorize { (8)     policy filter_username { (8)       if (&User-Name) { (8)       if (&User-Name)  -> TRUE (8)       if (&User-Name)  { (8)         if (&User-Name =~ / /) { (8)         if (&User-Name =~ / /)  -> FALSE (8)         if (&User-Name =~ /@[^@]*@/ ) { (8)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (8)         if (&User-Name =~ /\.\./ ) { (8)         if (&User-Name =~ /\.\./ )  -> FALSE (8)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (8)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (8)         if (&User-Name =~ /\.$/)  { (8)         if (&User-Name =~ /\.$/)   -> FALSE (8)         if (&User-Name =~ /@\./)  { (8)         if (&User-Name =~ /@\./)   -> FALSE (8)       } # if (&User-Name)  = notfound (8)     } # policy filter_username = notfound (8)     [preprocess] = ok (8)     [chap] = noop (8)     [mschap] = noop (8)     [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (8) suffix: No such realm "NULL" (8)     [suffix] = noop (8) ntdomain: Checking for prefix before "\" (8) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (8) ntdomain: Found realm "CLEARSYSTEM" (8) ntdomain: Adding Stripped-User-Name = "test1" (8) ntdomain: Adding Realm = "CLEARSYSTEM" (8) ntdomain: Authentication realm is LOCAL (8)     [ntdomain] = ok (8) eap: Peer sent EAP Response (code 2) ID 8 length 37 (8) eap: Continuing tunnel setup (8)     [eap] = ok (8)   } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/raddb/sites-enabled/default (8)   authenticate { (8) eap: Expiring EAP session with state 0x66e3bd0267eba7fb (8) eap: Finished EAP session with state 0x6d805dd76a884438 (8) eap: Previous EAP request found for state 0x6d805dd76a884438, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established.  Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap:   EAP-Message = 0x020800061a03 (8) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap:   EAP-Message = 0x020800061a03 (8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (8) eap_peap:   State = 0x66e3bd0267eba7fba16dc6bfc6cef435 (8) Virtual server inner-tunnel received request (8)   EAP-Message = 0x020800061a03 (8)   FreeRADIUS-Proxied-To = 127.0.0.1 (8)   User-Name = "CLEARSYSTEM\\test1" (8)   State = 0x66e3bd0267eba7fba16dc6bfc6cef435 (8) WARNING: Outer and inner identities are the same.  User privacy is compromised. (8) server inner-tunnel { (8)   session-state: No cached attributes (8)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (8)     authorize { (8)       policy filter_username { (8)         if (&User-Name) { (8)         if (&User-Name)  -> TRUE (8)         if (&User-Name)  { (8)           if (&User-Name =~ / /) { (8)           if (&User-Name =~ / /)  -> FALSE (8)           if (&User-Name =~ /@[^@]*@/ ) { (8)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (8)           if (&User-Name =~ /\.\./ ) { (8)           if (&User-Name =~ /\.\./ )  -> FALSE (8)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (8)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (8)           if (&User-Name =~ /\.$/)  { (8)           if (&User-Name =~ /\.$/)   -> FALSE (8)           if (&User-Name =~ /@\./)  { (8)           if (&User-Name =~ /@\./)   -> FALSE (8)         } # if (&User-Name)  = notfound (8)       } # policy filter_username = notfound (8)       [chap] = noop (8)       [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (8) suffix: No such realm "NULL" (8)       [suffix] = noop (8) ntdomain: Checking for prefix before "\" (8) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (8) ntdomain: Found realm "CLEARSYSTEM" (8) ntdomain: Adding Stripped-User-Name = "test1" (8) ntdomain: Adding Realm = "CLEARSYSTEM" (8) ntdomain: Authentication realm is LOCAL (8)       [ntdomain] = ok (8)       update control { (8)         &Proxy-To-Realm := LOCAL (8)       } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 8 length 6 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8)       [eap] = updated (8) files: Searching for user in group "allusers" rlm_ldap (ldap): Reserved connection (2) (8) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (8) files:    --> (uid=test1) (8) files: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (8) files: Waiting for search result... (8) files: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (8) files: Checking user object's memberOf attributes (8) files:   Performing unfiltered search in "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan", scope "base" (8) files:   Waiting for search result... (8) files: Processing memberOf value "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (8) files:   Resolving group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (8) files:   Performing unfiltered search in "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (8) files:   Waiting for search result... (8) files:   Group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "ftp_plugin" (8) files: Processing memberOf value "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (8) files:   Resolving group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (8) files:   Performing unfiltered search in "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (8) files:   Waiting for search result... (8) files:   Group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "web_proxy_plugin" (8) files: Processing memberOf value "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (8) files:   Resolving group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (8) files:   Performing unfiltered search in "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (8) files:   Waiting for search result... (8) files:   Group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "webupload" (8) files: Processing memberOf value "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (8) files:   Resolving group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (8) files:   Performing unfiltered search in "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (8) files:   Waiting for search result... (8) files:   Group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "allusers" (8) files: User found in group "allusers". Comparison between membership: name (resolved from DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan"), check: name rlm_ldap (ldap): Released connection (2) (8)       [files] = noop rlm_ldap (ldap): Reserved connection (3) (8) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (8) ldap:    --> (uid=test1) (8) ldap: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (8) ldap: Waiting for search result... (8) ldap: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (8) ldap: Processing user attributes (8) ldap: control:Password-With-Header += '{sha}tESsBmE/yNY3lb6a0L6vVQEZNqw=' rlm_ldap (ldap): Released connection (3) (8)       [ldap] = updated (8)       [expiration] = noop (8)       [logintime] = noop (8) pap: Converted: &control:Password-With-Header -> &control:SHA1-Password (8) pap: Removing &control:Password-With-Header (8) pap: Normalizing SHA1-Password from base64 encoding, 28 bytes -> 20 bytes (8) pap: WARNING: Auth-Type already set.  Not setting to PAP (8)       [pap] = noop (8)     } # authorize = updated (8)   Found Auth-Type = eap (8)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (8)     authenticate { (8) eap: Expiring EAP session with state 0x66e3bd0267eba7fb (8) eap: Finished EAP session with state 0x66e3bd0267eba7fb (8) eap: Previous EAP request found for state 0x66e3bd0267eba7fb, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap: Sending EAP Success (code 3) ID 8 length 4 (8) eap: Freeing handler (8)       [eap] = ok (8)     } # authenticate = ok (8)   # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (8)     post-auth { (8)       if (0) { (8)       if (0)  -> FALSE (8)     } # post-auth = noop (8) } # server inner-tunnel (8) Virtual server sending reply (8)   MS-MPPE-Encryption-Policy = Encryption-Allowed (8)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8)   MS-MPPE-Send-Key = 0xb0cef0c8f31ece219ae921fa8dd00a05 (8)   MS-MPPE-Recv-Key = 0x0c0cf49c321e6e908780b3c6612b6feb (8)   EAP-Message = 0x03080004 (8)   Message-Authenticator = 0x00000000000000000000000000000000 (8)   Stripped-User-Name = "test1" (8) eap_peap: Got tunneled reply code 2 (8) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed (8) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) eap_peap:   MS-MPPE-Send-Key = 0xb0cef0c8f31ece219ae921fa8dd00a05 (8) eap_peap:   MS-MPPE-Recv-Key = 0x0c0cf49c321e6e908780b3c6612b6feb (8) eap_peap:   EAP-Message = 0x03080004 (8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap:   Stripped-User-Name = "test1" (8) eap_peap: Got tunneled reply RADIUS code 2 (8) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed (8) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (8) eap_peap:   MS-MPPE-Send-Key = 0xb0cef0c8f31ece219ae921fa8dd00a05 (8) eap_peap:   MS-MPPE-Recv-Key = 0x0c0cf49c321e6e908780b3c6612b6feb (8) eap_peap:   EAP-Message = 0x03080004 (8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap:   Stripped-User-Name = "test1" (8) eap_peap: Tunneled authentication was successful (8) eap_peap: SUCCESS (8) eap: Sending EAP Request (code 1) ID 9 length 46 (8) eap: EAP session adding &reply:State = 0x6d805dd765894438 (8)     [eap] = handled (8)   } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /etc/raddb/sites-enabled/default (8)   Challenge { ... } # empty sub-section is ignored (8) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (8)   EAP-Message = 0x0109002e19001703030023dc5fcf74a4d4ecf2e22cf6f1b9c7c262e75a225086d46b3b1094d6a2e54fad0e208021 (8)   Message-Authenticator = 0x00000000000000000000000000000000 (8)   State = 0x6d805dd765894438dc40c2ae6afa62ac (8) Finished request Waking up in 4.9 seconds. (8) Cleaning up request packet ID 0 with timestamp +13 (9) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 189 (9)   User-Name = "CLEARSYSTEM\\test1" (9)   NAS-IP-Address = 172.22.22.254 (9)   Called-Station-Id = "001601dfe596" (9)   Calling-Station-Id = "74da38d41a8b" (9)   NAS-Identifier = "001601dfe596" (9)   NAS-Port = 5 (9)   Framed-MTU = 1400 (9)   State = 0x6d805dd765894438dc40c2ae6afa62ac (9)   NAS-Port-Type = Wireless-802.11 (9)   EAP-Message = 0x0209002e190017030300230000000000000004274d7c08364b6d55ee3aa706f66f7126d6c1243d8d08bdbd7a9051 (9)   Message-Authenticator = 0x36b35cb4fd0f6af8a94dfc86605dc543 (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/raddb/sites-enabled/default (9)   authorize { (9)     policy filter_username { (9)       if (&User-Name) { (9)       if (&User-Name)  -> TRUE (9)       if (&User-Name)  { (9)         if (&User-Name =~ / /) { (9)         if (&User-Name =~ / /)  -> FALSE (9)         if (&User-Name =~ /@[^@]*@/ ) { (9)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (9)         if (&User-Name =~ /\.\./ ) { (9)         if (&User-Name =~ /\.\./ )  -> FALSE (9)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (9)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (9)         if (&User-Name =~ /\.$/)  { (9)         if (&User-Name =~ /\.$/)   -> FALSE (9)         if (&User-Name =~ /@\./)  { (9)         if (&User-Name =~ /@\./)   -> FALSE (9)       } # if (&User-Name)  = notfound (9)     } # policy filter_username = notfound (9)     [preprocess] = ok (9)     [chap] = noop (9)     [mschap] = noop (9)     [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (9) suffix: No such realm "NULL" (9)     [suffix] = noop (9) ntdomain: Checking for prefix before "\" (9) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (9) ntdomain: Found realm "CLEARSYSTEM" (9) ntdomain: Adding Stripped-User-Name = "test1" (9) ntdomain: Adding Realm = "CLEARSYSTEM" (9) ntdomain: Authentication realm is LOCAL (9)     [ntdomain] = ok (9) eap: Peer sent EAP Response (code 2) ID 9 length 46 (9) eap: Continuing tunnel setup (9)     [eap] = ok (9)   } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/raddb/sites-enabled/default (9)   authenticate { (9) eap: Expiring EAP session with state 0x6d805dd765894438 (9) eap: Finished EAP session with state 0x6d805dd765894438 (9) eap: Previous EAP request found for state 0x6d805dd765894438, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established.  Decoding tunneled attributes (9) eap_peap: PEAP state send tlv success (9) eap_peap: Received EAP-TLV response (9) eap_peap: Success (9) eap: Sending EAP Success (code 3) ID 9 length 4 (9) eap: Freeing handler (9)     [eap] = ok (9)   } # authenticate = ok (9) # Executing section post-auth from file /etc/raddb/sites-enabled/default (9)   post-auth { (9)     update { (9)       No attributes updated (9)     } # update = noop (9)     [exec] = noop (9)     policy remove_reply_message_if_eap { (9)       if (&reply:EAP-Message && &reply:Reply-Message) { (9)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE (9)       else { (9)         [noop] = noop (9)       } # else = noop (9)     } # policy remove_reply_message_if_eap = noop (9)   } # post-auth = noop (9) Sent Access-Accept Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (9)   MS-MPPE-Recv-Key = 0x0790725f316f49070c1b7729230cfb972a484adc36a235b208c4550295ea4187 (9)   MS-MPPE-Send-Key = 0x92b2a51d0e06c17fdefa0e17bdc1efe33e5aae270f461bf4828d6fb2de315a80 (9)   EAP-Message = 0x03090004 (9)   Message-Authenticator = 0x00000000000000000000000000000000 (9) Finished request Waking up in 4.9 seconds. (9) Cleaning up request packet ID 0 with timestamp +13 Ready to process requests (10) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 147 (10)   User-Name = "CLEARSYSTEM\\test1" (10)   NAS-IP-Address = 172.22.22.254 (10)   Called-Station-Id = "001601dfe596" (10)   Calling-Station-Id = "74da38d41a8b" (10)   NAS-Identifier = "001601dfe596" (10)   NAS-Port = 5 (10)   Framed-MTU = 1400 (10)   NAS-Port-Type = Wireless-802.11 (10)   EAP-Message = 0x0200001601434c45415253595354454d5c7465737431 (10)   Message-Authenticator = 0x3e663781d018a3da35a626dc52214957 (10) # Executing section authorize from file /etc/raddb/sites-enabled/default (10)   authorize { (10)     policy filter_username { (10)       if (&User-Name) { (10)       if (&User-Name)  -> TRUE (10)       if (&User-Name)  { (10)         if (&User-Name =~ / /) { (10)         if (&User-Name =~ / /)  -> FALSE (10)         if (&User-Name =~ /@[^@]*@/ ) { (10)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (10)         if (&User-Name =~ /\.\./ ) { (10)         if (&User-Name =~ /\.\./ )  -> FALSE (10)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (10)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (10)         if (&User-Name =~ /\.$/)  { (10)         if (&User-Name =~ /\.$/)   -> FALSE (10)         if (&User-Name =~ /@\./)  { (10)         if (&User-Name =~ /@\./)   -> FALSE (10)       } # if (&User-Name)  = notfound (10)     } # policy filter_username = notfound (10)     [preprocess] = ok (10)     [chap] = noop (10)     [mschap] = noop (10)     [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (10) suffix: No such realm "NULL" (10)     [suffix] = noop (10) ntdomain: Checking for prefix before "\" (10) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (10) ntdomain: Found realm "CLEARSYSTEM" (10) ntdomain: Adding Stripped-User-Name = "test1" (10) ntdomain: Adding Realm = "CLEARSYSTEM" (10) ntdomain: Authentication realm is LOCAL (10)     [ntdomain] = ok (10) eap: Peer sent EAP Response (code 2) ID 0 length 22 (10) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (10)     [eap] = ok (10)   } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /etc/raddb/sites-enabled/default (10)   authenticate { (10) eap: Peer sent packet with method EAP Identity (1) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: Initiating new EAP-TLS session (10) eap_peap: [eaptls start] = request (10) eap: Sending EAP Request (code 1) ID 1 length 6 (10) eap: EAP session adding &reply:State = 0x5205bbdd5204a286 (10)     [eap] = handled (10)   } # authenticate = handled (10) Using Post-Auth-Type Challenge (10) # Executing group from file /etc/raddb/sites-enabled/default (10)   Challenge { ... } # empty sub-section is ignored (10) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (10)   EAP-Message = 0x010100061920 (10)   Message-Authenticator = 0x00000000000000000000000000000000 (10)   State = 0x5205bbdd5204a286e7a44a448065710e (10) Finished request Waking up in 4.9 seconds. (10) Cleaning up request packet ID 0 with timestamp +44 (11) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 309 (11)   User-Name = "CLEARSYSTEM\\test1" (11)   NAS-IP-Address = 172.22.22.254 (11)   Called-Station-Id = "001601dfe596" (11)   Calling-Station-Id = "74da38d41a8b" (11)   NAS-Identifier = "001601dfe596" (11)   NAS-Port = 5 (11)   Framed-MTU = 1400 (11)   State = 0x5205bbdd5204a286e7a44a448065710e (11)   NAS-Port-Type = Wireless-802.11 (11)   EAP-Message = 0x020100a619800000009c16030300970100009303035af2cd38a6bde90cac89c6193a2d76d271c9604c7ddfed3814c78b24ba8f7e5c00002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d (11)   Message-Authenticator = 0xaed2c29e86157e53d66c93b98a2a81d6 (11) session-state: No cached attributes (11) # Executing section authorize from file /etc/raddb/sites-enabled/default (11)   authorize { (11)     policy filter_username { (11)       if (&User-Name) { (11)       if (&User-Name)  -> TRUE (11)       if (&User-Name)  { (11)         if (&User-Name =~ / /) { (11)         if (&User-Name =~ / /)  -> FALSE (11)         if (&User-Name =~ /@[^@]*@/ ) { (11)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (11)         if (&User-Name =~ /\.\./ ) { (11)         if (&User-Name =~ /\.\./ )  -> FALSE (11)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (11)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (11)         if (&User-Name =~ /\.$/)  { (11)         if (&User-Name =~ /\.$/)   -> FALSE (11)         if (&User-Name =~ /@\./)  { (11)         if (&User-Name =~ /@\./)   -> FALSE (11)       } # if (&User-Name)  = notfound (11)     } # policy filter_username = notfound (11)     [preprocess] = ok (11)     [chap] = noop (11)     [mschap] = noop (11)     [digest] = noop (11) suffix: Checking for suffix after "@" (11) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (11) suffix: No such realm "NULL" (11)     [suffix] = noop (11) ntdomain: Checking for prefix before "\" (11) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (11) ntdomain: Found realm "CLEARSYSTEM" (11) ntdomain: Adding Stripped-User-Name = "test1" (11) ntdomain: Adding Realm = "CLEARSYSTEM" (11) ntdomain: Authentication realm is LOCAL (11)     [ntdomain] = ok (11) eap: Peer sent EAP Response (code 2) ID 1 length 166 (11) eap: Continuing tunnel setup (11)     [eap] = ok (11)   } # authorize = ok (11) Found Auth-Type = eap (11) # Executing group from file /etc/raddb/sites-enabled/default (11)   authenticate { (11) eap: Expiring EAP session with state 0x5205bbdd5204a286 (11) eap: Finished EAP session with state 0x5205bbdd5204a286 (11) eap: Previous EAP request found for state 0x5205bbdd5204a286, released from the list (11) eap: Peer sent packet with method EAP PEAP (25) (11) eap: Calling submodule eap_peap to process data (11) eap_peap: Continuing EAP-TLS (11) eap_peap: Peer indicated complete TLS record size will be 156 bytes (11) eap_peap: Got complete TLS record (156 bytes) (11) eap_peap: [eaptls verify] = length included (11) eap_peap: (other): before/accept initialization (11) eap_peap: TLS_accept: before/accept initialization (11) eap_peap: <<< recv TLS 1.2  [length 0097] (11) eap_peap: TLS_accept: SSLv3 read client hello A (11) eap_peap: >>> send TLS 1.2  [length 0039] (11) eap_peap: TLS_accept: SSLv3 write server hello A (11) eap_peap: >>> send TLS 1.2  [length 08bd] (11) eap_peap: TLS_accept: SSLv3 write certificate A (11) eap_peap: >>> send TLS 1.2  [length 014d] (11) eap_peap: TLS_accept: SSLv3 write key exchange A (11) eap_peap: >>> send TLS 1.2  [length 0004] (11) eap_peap: TLS_accept: SSLv3 write server done A (11) eap_peap: TLS_accept: SSLv3 flush data (11) eap_peap: TLS_accept: SSLv3 read client certificate A (11) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key exchange A (11) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key exchange A (11) eap_peap: In SSL Handshake Phase (11) eap_peap: In SSL Accept mode (11) eap_peap: [eaptls process] = handled (11) eap: Sending EAP Request (code 1) ID 2 length 1004 (11) eap: EAP session adding &reply:State = 0x5205bbdd5307a286 (11)     [eap] = handled (11)   } # authenticate = handled (11) Using Post-Auth-Type Challenge (11) # Executing group from file /etc/raddb/sites-enabled/default (11)   Challenge { ... } # empty sub-section is ignored (11) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (11)   EAP-Message = 0x010203ec19c000000a5b1603030039020000350303b03cc28858b129d2eb2e9017deb4a9a6acdbb87cb5a0dbbed57be74b9ad0b07800c03000000dff01000100000b00040300010216030308bd0b0008b90008b60003fb308203f7308202dfa003020102020101300d06092a864886f70d01010b050030 (11)   Message-Authenticator = 0x00000000000000000000000000000000 (11)   State = 0x5205bbdd5307a286e7a44a448065710e (11) Finished request Waking up in 4.9 seconds. (11) Cleaning up request packet ID 0 with timestamp +44 (12) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (12)   User-Name = "CLEARSYSTEM\\test1" (12)   NAS-IP-Address = 172.22.22.254 (12)   Called-Station-Id = "001601dfe596" (12)   Calling-Station-Id = "74da38d41a8b" (12)   NAS-Identifier = "001601dfe596" (12)   NAS-Port = 5 (12)   Framed-MTU = 1400 (12)   State = 0x5205bbdd5307a286e7a44a448065710e (12)   NAS-Port-Type = Wireless-802.11 (12)   EAP-Message = 0x020200061900 (12)   Message-Authenticator = 0x2316426b772c524a5666fca10c78a6f7 (12) session-state: No cached attributes (12) # Executing section authorize from file /etc/raddb/sites-enabled/default (12)   authorize { (12)     policy filter_username { (12)       if (&User-Name) { (12)       if (&User-Name)  -> TRUE (12)       if (&User-Name)  { (12)         if (&User-Name =~ / /) { (12)         if (&User-Name =~ / /)  -> FALSE (12)         if (&User-Name =~ /@[^@]*@/ ) { (12)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (12)         if (&User-Name =~ /\.\./ ) { (12)         if (&User-Name =~ /\.\./ )  -> FALSE (12)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (12)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (12)         if (&User-Name =~ /\.$/)  { (12)         if (&User-Name =~ /\.$/)   -> FALSE (12)         if (&User-Name =~ /@\./)  { (12)         if (&User-Name =~ /@\./)   -> FALSE (12)       } # if (&User-Name)  = notfound (12)     } # policy filter_username = notfound (12)     [preprocess] = ok (12)     [chap] = noop (12)     [mschap] = noop (12)     [digest] = noop (12) suffix: Checking for suffix after "@" (12) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (12) suffix: No such realm "NULL" (12)     [suffix] = noop (12) ntdomain: Checking for prefix before "\" (12) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (12) ntdomain: Found realm "CLEARSYSTEM" (12) ntdomain: Adding Stripped-User-Name = "test1" (12) ntdomain: Adding Realm = "CLEARSYSTEM" (12) ntdomain: Authentication realm is LOCAL (12)     [ntdomain] = ok (12) eap: Peer sent EAP Response (code 2) ID 2 length 6 (12) eap: Continuing tunnel setup (12)     [eap] = ok (12)   } # authorize = ok (12) Found Auth-Type = eap (12) # Executing group from file /etc/raddb/sites-enabled/default (12)   authenticate { (12) eap: Expiring EAP session with state 0x5205bbdd5307a286 (12) eap: Finished EAP session with state 0x5205bbdd5307a286 (12) eap: Previous EAP request found for state 0x5205bbdd5307a286, released from the list (12) eap: Peer sent packet with method EAP PEAP (25) (12) eap: Calling submodule eap_peap to process data (12) eap_peap: Continuing EAP-TLS (12) eap_peap: Peer ACKed our handshake fragment (12) eap_peap: [eaptls verify] = request (12) eap_peap: [eaptls process] = handled (12) eap: Sending EAP Request (code 1) ID 3 length 1000 (12) eap: EAP session adding &reply:State = 0x5205bbdd5006a286 (12)     [eap] = handled (12)   } # authenticate = handled (12) Using Post-Auth-Type Challenge (12) # Executing group from file /etc/raddb/sites-enabled/default (12)   Challenge { ... } # empty sub-section is ignored (12) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (12)   EAP-Message = 0x010303e819408444f5b804aa2d65ef2b23820bb1bf1bfcb24df6bd03eabe61d7bb630cfd9fd6165d19f24d23925593c04c7ec13d5afe51369fe487605e2de3073d043a15e72448712bca946e329e81ff36cebcdfe8be08dc6490da38ed9147e7eac88af7f25487bee0ef80700004b5308204b130820399 (12)   Message-Authenticator = 0x00000000000000000000000000000000 (12)   State = 0x5205bbdd5006a286e7a44a448065710e (12) Finished request Waking up in 4.9 seconds. (12) Cleaning up request packet ID 0 with timestamp +44 (13) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (13)   User-Name = "CLEARSYSTEM\\test1" (13)   NAS-IP-Address = 172.22.22.254 (13)   Called-Station-Id = "001601dfe596" (13)   Calling-Station-Id = "74da38d41a8b" (13)   NAS-Identifier = "001601dfe596" (13)   NAS-Port = 5 (13)   Framed-MTU = 1400 (13)   State = 0x5205bbdd5006a286e7a44a448065710e (13)   NAS-Port-Type = Wireless-802.11 (13)   EAP-Message = 0x020300061900 (13)   Message-Authenticator = 0xb6167b86da6c3a72a5fa00cbb2898a5c (13) session-state: No cached attributes (13) # Executing section authorize from file /etc/raddb/sites-enabled/default (13)   authorize { (13)     policy filter_username { (13)       if (&User-Name) { (13)       if (&User-Name)  -> TRUE (13)       if (&User-Name)  { (13)         if (&User-Name =~ / /) { (13)         if (&User-Name =~ / /)  -> FALSE (13)         if (&User-Name =~ /@[^@]*@/ ) { (13)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (13)         if (&User-Name =~ /\.\./ ) { (13)         if (&User-Name =~ /\.\./ )  -> FALSE (13)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (13)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (13)         if (&User-Name =~ /\.$/)  { (13)         if (&User-Name =~ /\.$/)   -> FALSE (13)         if (&User-Name =~ /@\./)  { (13)         if (&User-Name =~ /@\./)   -> FALSE (13)       } # if (&User-Name)  = notfound (13)     } # policy filter_username = notfound (13)     [preprocess] = ok (13)     [chap] = noop (13)     [mschap] = noop (13)     [digest] = noop (13) suffix: Checking for suffix after "@" (13) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (13) suffix: No such realm "NULL" (13)     [suffix] = noop (13) ntdomain: Checking for prefix before "\" (13) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (13) ntdomain: Found realm "CLEARSYSTEM" (13) ntdomain: Adding Stripped-User-Name = "test1" (13) ntdomain: Adding Realm = "CLEARSYSTEM" (13) ntdomain: Authentication realm is LOCAL (13)     [ntdomain] = ok (13) eap: Peer sent EAP Response (code 2) ID 3 length 6 (13) eap: Continuing tunnel setup (13)     [eap] = ok (13)   } # authorize = ok (13) Found Auth-Type = eap (13) # Executing group from file /etc/raddb/sites-enabled/default (13)   authenticate { (13) eap: Expiring EAP session with state 0x5205bbdd5006a286 (13) eap: Finished EAP session with state 0x5205bbdd5006a286 (13) eap: Previous EAP request found for state 0x5205bbdd5006a286, released from the list (13) eap: Peer sent packet with method EAP PEAP (25) (13) eap: Calling submodule eap_peap to process data (13) eap_peap: Continuing EAP-TLS (13) eap_peap: Peer ACKed our handshake fragment (13) eap_peap: [eaptls verify] = request (13) eap_peap: [eaptls process] = handled (13) eap: Sending EAP Request (code 1) ID 4 length 669 (13) eap: EAP session adding &reply:State = 0x5205bbdd5101a286 (13)     [eap] = handled (13)   } # authenticate = handled (13) Using Post-Auth-Type Challenge (13) # Executing group from file /etc/raddb/sites-enabled/default (13)   Challenge { ... } # empty sub-section is ignored (13) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (13)   EAP-Message = 0x0104029d1900278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b050003820101000132a42023b4da19cd0464809979cba06e09409f4cbae9db226b41b48d0c97de8fa6092c00476cb9f16399e310996fb68c40e69b10 (13)   Message-Authenticator = 0x00000000000000000000000000000000 (13)   State = 0x5205bbdd5101a286e7a44a448065710e (13) Finished request Waking up in 4.9 seconds. (13) Cleaning up request packet ID 0 with timestamp +44 (14) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 279 (14)   User-Name = "CLEARSYSTEM\\test1" (14)   NAS-IP-Address = 172.22.22.254 (14)   Called-Station-Id = "001601dfe596" (14)   Calling-Station-Id = "74da38d41a8b" (14)   NAS-Identifier = "001601dfe596" (14)   NAS-Port = 5 (14)   Framed-MTU = 1400 (14)   State = 0x5205bbdd5101a286e7a44a448065710e (14)   NAS-Port-Type = Wireless-802.11 (14)   EAP-Message = 0x0204008819800000007e1603030046100000424104e75ed2454d55c1c56f5300e806d9964d68478eeb7c9f1af4e5695daeb6fa5f3f968c3621984b9fc4079a2bf4e7ace9f798901c2c1b52cbad15600761a017196b14030300010116030300280000000000000000a90ea118db4e321e4fd9a1f90e76ef (14)   Message-Authenticator = 0x2254305b780a66f1e2c8b4c87549e709 (14) session-state: No cached attributes (14) # Executing section authorize from file /etc/raddb/sites-enabled/default (14)   authorize { (14)     policy filter_username { (14)       if (&User-Name) { (14)       if (&User-Name)  -> TRUE (14)       if (&User-Name)  { (14)         if (&User-Name =~ / /) { (14)         if (&User-Name =~ / /)  -> FALSE (14)         if (&User-Name =~ /@[^@]*@/ ) { (14)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (14)         if (&User-Name =~ /\.\./ ) { (14)         if (&User-Name =~ /\.\./ )  -> FALSE (14)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (14)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (14)         if (&User-Name =~ /\.$/)  { (14)         if (&User-Name =~ /\.$/)   -> FALSE (14)         if (&User-Name =~ /@\./)  { (14)         if (&User-Name =~ /@\./)   -> FALSE (14)       } # if (&User-Name)  = notfound (14)     } # policy filter_username = notfound (14)     [preprocess] = ok (14)     [chap] = noop (14)     [mschap] = noop (14)     [digest] = noop (14) suffix: Checking for suffix after "@" (14) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (14) suffix: No such realm "NULL" (14)     [suffix] = noop (14) ntdomain: Checking for prefix before "\" (14) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (14) ntdomain: Found realm "CLEARSYSTEM" (14) ntdomain: Adding Stripped-User-Name = "test1" (14) ntdomain: Adding Realm = "CLEARSYSTEM" (14) ntdomain: Authentication realm is LOCAL (14)     [ntdomain] = ok (14) eap: Peer sent EAP Response (code 2) ID 4 length 136 (14) eap: Continuing tunnel setup (14)     [eap] = ok (14)   } # authorize = ok (14) Found Auth-Type = eap (14) # Executing group from file /etc/raddb/sites-enabled/default (14)   authenticate { (14) eap: Expiring EAP session with state 0x5205bbdd5101a286 (14) eap: Finished EAP session with state 0x5205bbdd5101a286 (14) eap: Previous EAP request found for state 0x5205bbdd5101a286, released from the list (14) eap: Peer sent packet with method EAP PEAP (25) (14) eap: Calling submodule eap_peap to process data (14) eap_peap: Continuing EAP-TLS (14) eap_peap: Peer indicated complete TLS record size will be 126 bytes (14) eap_peap: Got complete TLS record (126 bytes) (14) eap_peap: [eaptls verify] = length included (14) eap_peap: <<< recv TLS 1.2  [length 0046] (14) eap_peap: TLS_accept: SSLv3 read client key exchange A (14) eap_peap: TLS_accept: SSLv3 read certificate verify A (14) eap_peap: <<< recv TLS 1.2  [length 0001] (14) eap_peap: <<< recv TLS 1.2  [length 0010] (14) eap_peap: TLS_accept: SSLv3 read finished A (14) eap_peap: >>> send TLS 1.2  [length 0001] (14) eap_peap: TLS_accept: SSLv3 write change cipher spec A (14) eap_peap: >>> send TLS 1.2  [length 0010] (14) eap_peap: TLS_accept: SSLv3 write finished A (14) eap_peap: TLS_accept: SSLv3 flush data (14) eap_peap: (other): SSL negotiation finished successfully (14) eap_peap: SSL Connection Established (14) eap_peap: [eaptls process] = handled (14) eap: Sending EAP Request (code 1) ID 5 length 57 (14) eap: EAP session adding &reply:State = 0x5205bbdd5600a286 (14)     [eap] = handled (14)   } # authenticate = handled (14) Using Post-Auth-Type Challenge (14) # Executing group from file /etc/raddb/sites-enabled/default (14)   Challenge { ... } # empty sub-section is ignored (14) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (14)   EAP-Message = 0x0105003919001403030001011603030028122ff0483babe9a32cbc96f0d25bf63a626964a174c6d14dcb7c9b46ce542267b243424249cc2558 (14)   Message-Authenticator = 0x00000000000000000000000000000000 (14)   State = 0x5205bbdd5600a286e7a44a448065710e (14) Finished request Waking up in 4.9 seconds. (14) Cleaning up request packet ID 0 with timestamp +44 (15) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (15)   User-Name = "CLEARSYSTEM\\test1" (15)   NAS-IP-Address = 172.22.22.254 (15)   Called-Station-Id = "001601dfe596" (15)   Calling-Station-Id = "74da38d41a8b" (15)   NAS-Identifier = "001601dfe596" (15)   NAS-Port = 5 (15)   Framed-MTU = 1400 (15)   State = 0x5205bbdd5600a286e7a44a448065710e (15)   NAS-Port-Type = Wireless-802.11 (15)   EAP-Message = 0x020500061900 (15)   Message-Authenticator = 0xba0c8dd74427d48a0598d69c4d657f2e (15) session-state: No cached attributes (15) # Executing section authorize from file /etc/raddb/sites-enabled/default (15)   authorize { (15)     policy filter_username { (15)       if (&User-Name) { (15)       if (&User-Name)  -> TRUE (15)       if (&User-Name)  { (15)         if (&User-Name =~ / /) { (15)         if (&User-Name =~ / /)  -> FALSE (15)         if (&User-Name =~ /@[^@]*@/ ) { (15)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (15)         if (&User-Name =~ /\.\./ ) { (15)         if (&User-Name =~ /\.\./ )  -> FALSE (15)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (15)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (15)         if (&User-Name =~ /\.$/)  { (15)         if (&User-Name =~ /\.$/)   -> FALSE (15)         if (&User-Name =~ /@\./)  { (15)         if (&User-Name =~ /@\./)   -> FALSE (15)       } # if (&User-Name)  = notfound (15)     } # policy filter_username = notfound (15)     [preprocess] = ok (15)     [chap] = noop (15)     [mschap] = noop (15)     [digest] = noop (15) suffix: Checking for suffix after "@" (15) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (15) suffix: No such realm "NULL" (15)     [suffix] = noop (15) ntdomain: Checking for prefix before "\" (15) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (15) ntdomain: Found realm "CLEARSYSTEM" (15) ntdomain: Adding Stripped-User-Name = "test1" (15) ntdomain: Adding Realm = "CLEARSYSTEM" (15) ntdomain: Authentication realm is LOCAL (15)     [ntdomain] = ok (15) eap: Peer sent EAP Response (code 2) ID 5 length 6 (15) eap: Continuing tunnel setup (15)     [eap] = ok (15)   } # authorize = ok (15) Found Auth-Type = eap (15) # Executing group from file /etc/raddb/sites-enabled/default (15)   authenticate { (15) eap: Expiring EAP session with state 0x5205bbdd5600a286 (15) eap: Finished EAP session with state 0x5205bbdd5600a286 (15) eap: Previous EAP request found for state 0x5205bbdd5600a286, released from the list (15) eap: Peer sent packet with method EAP PEAP (25) (15) eap: Calling submodule eap_peap to process data (15) eap_peap: Continuing EAP-TLS (15) eap_peap: Peer ACKed our handshake fragment.  handshake is finished (15) eap_peap: [eaptls verify] = success (15) eap_peap: [eaptls process] = success (15) eap_peap: Session established.  Decoding tunneled attributes (15) eap_peap: PEAP state TUNNEL ESTABLISHED (15) eap: Sending EAP Request (code 1) ID 6 length 40 (15) eap: EAP session adding &reply:State = 0x5205bbdd5703a286 (15)     [eap] = handled (15)   } # authenticate = handled (15) Using Post-Auth-Type Challenge (15) # Executing group from file /etc/raddb/sites-enabled/default (15)   Challenge { ... } # empty sub-section is ignored (15) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (15)   EAP-Message = 0x010600281900170303001d122ff0483babe9a424c759d906f9537f7d767703eec2c038b2f205ea12 (15)   Message-Authenticator = 0x00000000000000000000000000000000 (15)   State = 0x5205bbdd5703a286e7a44a448065710e (15) Finished request Waking up in 4.9 seconds. (15) Cleaning up request packet ID 0 with timestamp +44 (16) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 196 (16)   User-Name = "CLEARSYSTEM\\test1" (16)   NAS-IP-Address = 172.22.22.254 (16)   Called-Station-Id = "001601dfe596" (16)   Calling-Station-Id = "74da38d41a8b" (16)   NAS-Identifier = "001601dfe596" (16)   NAS-Port = 5 (16)   Framed-MTU = 1400 (16)   State = 0x5205bbdd5703a286e7a44a448065710e (16)   NAS-Port-Type = Wireless-802.11 (16)   EAP-Message = 0x020600351900170303002a0000000000000001e9ae658790bcf508c51af80646d2e96dbcf95fbb80c7aa0688d889cbd19217068129 (16)   Message-Authenticator = 0x8a30e51d727a26dfab63163b3eca1458 (16) session-state: No cached attributes (16) # Executing section authorize from file /etc/raddb/sites-enabled/default (16)   authorize { (16)     policy filter_username { (16)       if (&User-Name) { (16)       if (&User-Name)  -> TRUE (16)       if (&User-Name)  { (16)         if (&User-Name =~ / /) { (16)         if (&User-Name =~ / /)  -> FALSE (16)         if (&User-Name =~ /@[^@]*@/ ) { (16)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (16)         if (&User-Name =~ /\.\./ ) { (16)         if (&User-Name =~ /\.\./ )  -> FALSE (16)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (16)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (16)         if (&User-Name =~ /\.$/)  { (16)         if (&User-Name =~ /\.$/)   -> FALSE (16)         if (&User-Name =~ /@\./)  { (16)         if (&User-Name =~ /@\./)   -> FALSE (16)       } # if (&User-Name)  = notfound (16)     } # policy filter_username = notfound (16)     [preprocess] = ok (16)     [chap] = noop (16)     [mschap] = noop (16)     [digest] = noop (16) suffix: Checking for suffix after "@" (16) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (16) suffix: No such realm "NULL" (16)     [suffix] = noop (16) ntdomain: Checking for prefix before "\" (16) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (16) ntdomain: Found realm "CLEARSYSTEM" (16) ntdomain: Adding Stripped-User-Name = "test1" (16) ntdomain: Adding Realm = "CLEARSYSTEM" (16) ntdomain: Authentication realm is LOCAL (16)     [ntdomain] = ok (16) eap: Peer sent EAP Response (code 2) ID 6 length 53 (16) eap: Continuing tunnel setup (16)     [eap] = ok (16)   } # authorize = ok (16) Found Auth-Type = eap (16) # Executing group from file /etc/raddb/sites-enabled/default (16)   authenticate { (16) eap: Expiring EAP session with state 0x5205bbdd5703a286 (16) eap: Finished EAP session with state 0x5205bbdd5703a286 (16) eap: Previous EAP request found for state 0x5205bbdd5703a286, released from the list (16) eap: Peer sent packet with method EAP PEAP (25) (16) eap: Calling submodule eap_peap to process data (16) eap_peap: Continuing EAP-TLS (16) eap_peap: [eaptls verify] = ok (16) eap_peap: Done initial handshake (16) eap_peap: [eaptls process] = ok (16) eap_peap: Session established.  Decoding tunneled attributes (16) eap_peap: PEAP state WAITING FOR INNER IDENTITY (16) eap_peap: Identity - CLEARSYSTEM\test1 (16) eap_peap: Got inner identity 'CLEARSYSTEM\test1' (16) eap_peap: Setting default EAP type for tunneled EAP session (16) eap_peap: Got tunneled request (16) eap_peap:   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (16) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (16) eap_peap: Sending tunneled request to inner-tunnel (16) eap_peap:   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (16) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (16) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (16) Virtual server inner-tunnel received request (16)   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (16)   FreeRADIUS-Proxied-To = 127.0.0.1 (16)   User-Name = "CLEARSYSTEM\\test1" (16) WARNING: Outer and inner identities are the same.  User privacy is compromised. (16) server inner-tunnel { (16)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (16)     authorize { (16)       policy filter_username { (16)         if (&User-Name) { (16)         if (&User-Name)  -> TRUE (16)         if (&User-Name)  { (16)           if (&User-Name =~ / /) { (16)           if (&User-Name =~ / /)  -> FALSE (16)           if (&User-Name =~ /@[^@]*@/ ) { (16)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (16)           if (&User-Name =~ /\.\./ ) { (16)           if (&User-Name =~ /\.\./ )  -> FALSE (16)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (16)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (16)           if (&User-Name =~ /\.$/)  { (16)           if (&User-Name =~ /\.$/)   -> FALSE (16)           if (&User-Name =~ /@\./)  { (16)           if (&User-Name =~ /@\./)   -> FALSE (16)         } # if (&User-Name)  = notfound (16)       } # policy filter_username = notfound (16)       [chap] = noop (16)       [mschap] = noop (16) suffix: Checking for suffix after "@" (16) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (16) suffix: No such realm "NULL" (16)       [suffix] = noop (16) ntdomain: Checking for prefix before "\" (16) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (16) ntdomain: Found realm "CLEARSYSTEM" (16) ntdomain: Adding Stripped-User-Name = "test1" (16) ntdomain: Adding Realm = "CLEARSYSTEM" (16) ntdomain: Authentication realm is LOCAL (16)       [ntdomain] = ok (16)       update control { (16)         &Proxy-To-Realm := LOCAL (16)       } # update control = noop (16) eap: Peer sent EAP Response (code 2) ID 6 length 22 (16) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (16)       [eap] = ok (16)     } # authorize = ok (16)   Found Auth-Type = eap (16)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (16)     authenticate { (16) eap: Peer sent packet with method EAP Identity (1) (16) eap: Calling submodule eap_mschapv2 to process data (16) eap_mschapv2: Issuing Challenge (16) eap: Sending EAP Request (code 1) ID 7 length 43 (16) eap: EAP session adding &reply:State = 0x9f2abfcb9f2da540 (16)       [eap] = handled (16)     } # authenticate = handled (16) } # server inner-tunnel (16) Virtual server sending reply (16)   EAP-Message = 0x0107002b1a0107002610ab071fbb0514782fb1bda2c0ac5e09c8667265657261646975732d332e302e3133 (16)   Message-Authenticator = 0x00000000000000000000000000000000 (16)   State = 0x9f2abfcb9f2da540a6c3ea21abac845a (16) eap_peap: Got tunneled reply code 11 (16) eap_peap:   EAP-Message = 0x0107002b1a0107002610ab071fbb0514782fb1bda2c0ac5e09c8667265657261646975732d332e302e3133 (16) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (16) eap_peap:   State = 0x9f2abfcb9f2da540a6c3ea21abac845a (16) eap_peap: Got tunneled reply RADIUS code 11 (16) eap_peap:   EAP-Message = 0x0107002b1a0107002610ab071fbb0514782fb1bda2c0ac5e09c8667265657261646975732d332e302e3133 (16) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (16) eap_peap:   State = 0x9f2abfcb9f2da540a6c3ea21abac845a (16) eap_peap: Got tunneled Access-Challenge (16) eap: Sending EAP Request (code 1) ID 7 length 74 (16) eap: EAP session adding &reply:State = 0x5205bbdd5402a286 (16)     [eap] = handled (16)   } # authenticate = handled (16) Using Post-Auth-Type Challenge (16) # Executing group from file /etc/raddb/sites-enabled/default (16)   Challenge { ... } # empty sub-section is ignored (16) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (16)   EAP-Message = 0x0107004a1900170303003f122ff0483babe9a513b02ec03d204efc57ab871b548e72aafff7ba98622273aa90a11010b9660956f197a045a87b30441d1c1d85195860ad5064611ed769d7 (16)   Message-Authenticator = 0x00000000000000000000000000000000 (16)   State = 0x5205bbdd5402a286e7a44a448065710e (16) Finished request Waking up in 4.9 seconds. (16) Cleaning up request packet ID 0 with timestamp +44 (17) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 250 (17)   User-Name = "CLEARSYSTEM\\test1" (17)   NAS-IP-Address = 172.22.22.254 (17)   Called-Station-Id = "001601dfe596" (17)   Calling-Station-Id = "74da38d41a8b" (17)   NAS-Identifier = "001601dfe596" (17)   NAS-Port = 5 (17)   Framed-MTU = 1400 (17)   State = 0x5205bbdd5402a286e7a44a448065710e (17)   NAS-Port-Type = Wireless-802.11 (17)   EAP-Message = 0x0207006b19001703030060000000000000000299fb53660f3339f803de24143aaa136dbbe1675bac64891edc1ae768085758bb81158d747f11b403c48bc4e5b936060a7a609a8ab04e3a89cc6b3c728d192b3da65f61401398db953f4170997389c9f34d07821ddde226e3 (17)   Message-Authenticator = 0xfa99de92a4eace1085df9e301e533682 (17) session-state: No cached attributes (17) # Executing section authorize from file /etc/raddb/sites-enabled/default (17)   authorize { (17)     policy filter_username { (17)       if (&User-Name) { (17)       if (&User-Name)  -> TRUE (17)       if (&User-Name)  { (17)         if (&User-Name =~ / /) { (17)         if (&User-Name =~ / /)  -> FALSE (17)         if (&User-Name =~ /@[^@]*@/ ) { (17)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (17)         if (&User-Name =~ /\.\./ ) { (17)         if (&User-Name =~ /\.\./ )  -> FALSE (17)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (17)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (17)         if (&User-Name =~ /\.$/)  { (17)         if (&User-Name =~ /\.$/)   -> FALSE (17)         if (&User-Name =~ /@\./)  { (17)         if (&User-Name =~ /@\./)   -> FALSE (17)       } # if (&User-Name)  = notfound (17)     } # policy filter_username = notfound (17)     [preprocess] = ok (17)     [chap] = noop (17)     [mschap] = noop (17)     [digest] = noop (17) suffix: Checking for suffix after "@" (17) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (17) suffix: No such realm "NULL" (17)     [suffix] = noop (17) ntdomain: Checking for prefix before "\" (17) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (17) ntdomain: Found realm "CLEARSYSTEM" (17) ntdomain: Adding Stripped-User-Name = "test1" (17) ntdomain: Adding Realm = "CLEARSYSTEM" (17) ntdomain: Authentication realm is LOCAL (17)     [ntdomain] = ok (17) eap: Peer sent EAP Response (code 2) ID 7 length 107 (17) eap: Continuing tunnel setup (17)     [eap] = ok (17)   } # authorize = ok (17) Found Auth-Type = eap (17) # Executing group from file /etc/raddb/sites-enabled/default (17)   authenticate { (17) eap: Expiring EAP session with state 0x9f2abfcb9f2da540 (17) eap: Finished EAP session with state 0x5205bbdd5402a286 (17) eap: Previous EAP request found for state 0x5205bbdd5402a286, released from the list (17) eap: Peer sent packet with method EAP PEAP (25) (17) eap: Calling submodule eap_peap to process data (17) eap_peap: Continuing EAP-TLS (17) eap_peap: [eaptls verify] = ok (17) eap_peap: Done initial handshake (17) eap_peap: [eaptls process] = ok (17) eap_peap: Session established.  Decoding tunneled attributes (17) eap_peap: PEAP state phase2 (17) eap_peap: EAP method MSCHAPv2 (26) (17) eap_peap: Got tunneled request (17) eap_peap:   EAP-Message = 0x0207004c1a020700473158997abcf14dc72e0ca245a5dee28d1900000000000000006ae124b20068086b3497643a4966950e331dae11243fcd6f00434c45415253595354454d5c7465737431 (17) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (17) eap_peap: Sending tunneled request to inner-tunnel (17) eap_peap:   EAP-Message = 0x0207004c1a020700473158997abcf14dc72e0ca245a5dee28d1900000000000000006ae124b20068086b3497643a4966950e331dae11243fcd6f00434c45415253595354454d5c7465737431 (17) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (17) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (17) eap_peap:   State = 0x9f2abfcb9f2da540a6c3ea21abac845a (17) Virtual server inner-tunnel received request (17)   EAP-Message = 0x0207004c1a020700473158997abcf14dc72e0ca245a5dee28d1900000000000000006ae124b20068086b3497643a4966950e331dae11243fcd6f00434c45415253595354454d5c7465737431 (17)   FreeRADIUS-Proxied-To = 127.0.0.1 (17)   User-Name = "CLEARSYSTEM\\test1" (17)   State = 0x9f2abfcb9f2da540a6c3ea21abac845a (17) WARNING: Outer and inner identities are the same.  User privacy is compromised. (17) server inner-tunnel { (17)   session-state: No cached attributes (17)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (17)     authorize { (17)       policy filter_username { (17)         if (&User-Name) { (17)         if (&User-Name)  -> TRUE (17)         if (&User-Name)  { (17)           if (&User-Name =~ / /) { (17)           if (&User-Name =~ / /)  -> FALSE (17)           if (&User-Name =~ /@[^@]*@/ ) { (17)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (17)           if (&User-Name =~ /\.\./ ) { (17)           if (&User-Name =~ /\.\./ )  -> FALSE (17)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (17)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (17)           if (&User-Name =~ /\.$/)  { (17)           if (&User-Name =~ /\.$/)   -> FALSE (17)           if (&User-Name =~ /@\./)  { (17)           if (&User-Name =~ /@\./)   -> FALSE (17)         } # if (&User-Name)  = notfound (17)       } # policy filter_username = notfound (17)       [chap] = noop (17)       [mschap] = noop (17) suffix: Checking for suffix after "@" (17) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (17) suffix: No such realm "NULL" (17)       [suffix] = noop (17) ntdomain: Checking for prefix before "\" (17) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (17) ntdomain: Found realm "CLEARSYSTEM" (17) ntdomain: Adding Stripped-User-Name = "test1" (17) ntdomain: Adding Realm = "CLEARSYSTEM" (17) ntdomain: Authentication realm is LOCAL (17)       [ntdomain] = ok (17)       update control { (17)         &Proxy-To-Realm := LOCAL (17)       } # update control = noop (17) eap: Peer sent EAP Response (code 2) ID 7 length 76 (17) eap: No EAP Start, assuming it's an on-going EAP conversation (17)       [eap] = updated (17) files: Searching for user in group "allusers" rlm_ldap (ldap): Reserved connection (4) (17) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (17) files:    --> (uid=test1) (17) files: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (17) files: Waiting for search result... (17) files: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (17) files: Checking user object's memberOf attributes (17) files:   Performing unfiltered search in "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan", scope "base" (17) files:   Waiting for search result... (17) files: Processing memberOf value "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (17) files:   Resolving group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (17) files:   Performing unfiltered search in "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (17) files:   Waiting for search result... (17) files:   Group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "ftp_plugin" (17) files: Processing memberOf value "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (17) files:   Resolving group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (17) files:   Performing unfiltered search in "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (17) files:   Waiting for search result... (17) files:   Group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "web_proxy_plugin" (17) files: Processing memberOf value "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (17) files:   Resolving group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (17) files:   Performing unfiltered search in "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (17) files:   Waiting for search result... (17) files:   Group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "webupload" (17) files: Processing memberOf value "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (17) files:   Resolving group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (17) files:   Performing unfiltered search in "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (17) files:   Waiting for search result... (17) files:   Group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "allusers" (17) files: User found in group "allusers". Comparison between membership: name (resolved from DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan"), check: name rlm_ldap (ldap): Released connection (4) rlm_ldap (ldap): Closing connection (0), from 1 unused connections (17)       [files] = noop rlm_ldap (ldap): Reserved connection (1) (17) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (17) ldap:    --> (uid=test1) (17) ldap: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (17) ldap: Waiting for search result... (17) ldap: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (17) ldap: Processing user attributes (17) ldap: control:Password-With-Header += '{sha}tESsBmE/yNY3lb6a0L6vVQEZNqw=' rlm_ldap (ldap): Released connection (1) (17)       [ldap] = updated (17)       [expiration] = noop (17)       [logintime] = noop (17) pap: Converted: &control:Password-With-Header -> &control:SHA1-Password (17) pap: Removing &control:Password-With-Header (17) pap: Normalizing SHA1-Password from base64 encoding, 28 bytes -> 20 bytes (17) pap: WARNING: Auth-Type already set.  Not setting to PAP (17)       [pap] = noop (17)     } # authorize = updated (17)   Found Auth-Type = eap (17)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (17)     authenticate { (17) eap: Expiring EAP session with state 0x9f2abfcb9f2da540 (17) eap: Finished EAP session with state 0x9f2abfcb9f2da540 (17) eap: Previous EAP request found for state 0x9f2abfcb9f2da540, released from the list (17) eap: Peer sent packet with method EAP MSCHAPv2 (26) (17) eap: Calling submodule eap_mschapv2 to process data (17) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (17) eap_mschapv2:   authenticate { (17) mschap: Creating challenge hash with username: test1 (17) mschap: Client is using MS-CHAPv2 (17) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (17) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (17) mschap:    --> --username=test1 (17) mschap: Creating challenge hash with username: test1 (17) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (17) mschap:    --> --challenge=259875cdeba4749e (17) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (17) mschap:    --> --nt-response=6ae124b20068086b3497643a4966950e331dae11243fcd6f (17) mschap: Program returned code (0) and output 'NT_KEY: DAE53F1776DBD0817C5639A27629A27D' (17) mschap: Adding MS-CHAPv2 MPPE keys (17)     [mschap] = ok (17)   } # authenticate = ok (17) MSCHAP Success (17) eap: Sending EAP Request (code 1) ID 8 length 51 (17) eap: EAP session adding &reply:State = 0x9f2abfcb9e22a540 (17)       [eap] = handled (17)     } # authenticate = handled (17) } # server inner-tunnel (17) Virtual server sending reply (17)   EAP-Message = 0x010800331a0307002e533d34453836303736424638434130354230383244423136383334433839364133464331464146343135 (17)   Message-Authenticator = 0x00000000000000000000000000000000 (17)   State = 0x9f2abfcb9e22a540a6c3ea21abac845a (17) eap_peap: Got tunneled reply code 11 (17) eap_peap:   EAP-Message = 0x010800331a0307002e533d34453836303736424638434130354230383244423136383334433839364133464331464146343135 (17) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (17) eap_peap:   State = 0x9f2abfcb9e22a540a6c3ea21abac845a (17) eap_peap: Got tunneled reply RADIUS code 11 (17) eap_peap:   EAP-Message = 0x010800331a0307002e533d34453836303736424638434130354230383244423136383334433839364133464331464146343135 (17) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (17) eap_peap:   State = 0x9f2abfcb9e22a540a6c3ea21abac845a (17) eap_peap: Got tunneled Access-Challenge (17) eap: Sending EAP Request (code 1) ID 8 length 82 (17) eap: EAP session adding &reply:State = 0x5205bbdd550da286 (17)     [eap] = handled (17)   } # authenticate = handled (17) Using Post-Auth-Type Challenge (17) # Executing group from file /etc/raddb/sites-enabled/default (17)   Challenge { ... } # empty sub-section is ignored (17) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (17)   EAP-Message = 0x0108005219001703030047122ff0483babe9a629ef7e39c3646169247fd488b6a98ca283175ebbc1280cb371a00156e2a8b26a3a7c4757c476af1fecdda2a199fe60a6cc1e085515cc6af0acbed0445bea81 (17)   Message-Authenticator = 0x00000000000000000000000000000000 (17)   State = 0x5205bbdd550da286e7a44a448065710e (17) Finished request Waking up in 4.9 seconds. (17) Cleaning up request packet ID 0 with timestamp +44 (18) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 180 (18)   User-Name = "CLEARSYSTEM\\test1" (18)   NAS-IP-Address = 172.22.22.254 (18)   Called-Station-Id = "001601dfe596" (18)   Calling-Station-Id = "74da38d41a8b" (18)   NAS-Identifier = "001601dfe596" (18)   NAS-Port = 5 (18)   Framed-MTU = 1400 (18)   State = 0x5205bbdd550da286e7a44a448065710e (18)   NAS-Port-Type = Wireless-802.11 (18)   EAP-Message = 0x020800251900170303001a0000000000000003ca0270723e03845843b2cb34cebae8dbe894 (18)   Message-Authenticator = 0xa3f3022ca15ddf63716794674aad60fe (18) session-state: No cached attributes (18) # Executing section authorize from file /etc/raddb/sites-enabled/default (18)   authorize { (18)     policy filter_username { (18)       if (&User-Name) { (18)       if (&User-Name)  -> TRUE (18)       if (&User-Name)  { (18)         if (&User-Name =~ / /) { (18)         if (&User-Name =~ / /)  -> FALSE (18)         if (&User-Name =~ /@[^@]*@/ ) { (18)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (18)         if (&User-Name =~ /\.\./ ) { (18)         if (&User-Name =~ /\.\./ )  -> FALSE (18)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (18)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (18)         if (&User-Name =~ /\.$/)  { (18)         if (&User-Name =~ /\.$/)   -> FALSE (18)         if (&User-Name =~ /@\./)  { (18)         if (&User-Name =~ /@\./)   -> FALSE (18)       } # if (&User-Name)  = notfound (18)     } # policy filter_username = notfound (18)     [preprocess] = ok (18)     [chap] = noop (18)     [mschap] = noop (18)     [digest] = noop (18) suffix: Checking for suffix after "@" (18) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (18) suffix: No such realm "NULL" (18)     [suffix] = noop (18) ntdomain: Checking for prefix before "\" (18) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (18) ntdomain: Found realm "CLEARSYSTEM" (18) ntdomain: Adding Stripped-User-Name = "test1" (18) ntdomain: Adding Realm = "CLEARSYSTEM" (18) ntdomain: Authentication realm is LOCAL (18)     [ntdomain] = ok (18) eap: Peer sent EAP Response (code 2) ID 8 length 37 (18) eap: Continuing tunnel setup (18)     [eap] = ok (18)   } # authorize = ok (18) Found Auth-Type = eap (18) # Executing group from file /etc/raddb/sites-enabled/default (18)   authenticate { (18) eap: Expiring EAP session with state 0x9f2abfcb9e22a540 (18) eap: Finished EAP session with state 0x5205bbdd550da286 (18) eap: Previous EAP request found for state 0x5205bbdd550da286, released from the list (18) eap: Peer sent packet with method EAP PEAP (25) (18) eap: Calling submodule eap_peap to process data (18) eap_peap: Continuing EAP-TLS (18) eap_peap: [eaptls verify] = ok (18) eap_peap: Done initial handshake (18) eap_peap: [eaptls process] = ok (18) eap_peap: Session established.  Decoding tunneled attributes (18) eap_peap: PEAP state phase2 (18) eap_peap: EAP method MSCHAPv2 (26) (18) eap_peap: Got tunneled request (18) eap_peap:   EAP-Message = 0x020800061a03 (18) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (18) eap_peap: Sending tunneled request to inner-tunnel (18) eap_peap:   EAP-Message = 0x020800061a03 (18) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (18) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (18) eap_peap:   State = 0x9f2abfcb9e22a540a6c3ea21abac845a (18) Virtual server inner-tunnel received request (18)   EAP-Message = 0x020800061a03 (18)   FreeRADIUS-Proxied-To = 127.0.0.1 (18)   User-Name = "CLEARSYSTEM\\test1" (18)   State = 0x9f2abfcb9e22a540a6c3ea21abac845a (18) WARNING: Outer and inner identities are the same.  User privacy is compromised. (18) server inner-tunnel { (18)   session-state: No cached attributes (18)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (18)     authorize { (18)       policy filter_username { (18)         if (&User-Name) { (18)         if (&User-Name)  -> TRUE (18)         if (&User-Name)  { (18)           if (&User-Name =~ / /) { (18)           if (&User-Name =~ / /)  -> FALSE (18)           if (&User-Name =~ /@[^@]*@/ ) { (18)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (18)           if (&User-Name =~ /\.\./ ) { (18)           if (&User-Name =~ /\.\./ )  -> FALSE (18)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (18)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (18)           if (&User-Name =~ /\.$/)  { (18)           if (&User-Name =~ /\.$/)   -> FALSE (18)           if (&User-Name =~ /@\./)  { (18)           if (&User-Name =~ /@\./)   -> FALSE (18)         } # if (&User-Name)  = notfound (18)       } # policy filter_username = notfound (18)       [chap] = noop (18)       [mschap] = noop (18) suffix: Checking for suffix after "@" (18) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (18) suffix: No such realm "NULL" (18)       [suffix] = noop (18) ntdomain: Checking for prefix before "\" (18) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (18) ntdomain: Found realm "CLEARSYSTEM" (18) ntdomain: Adding Stripped-User-Name = "test1" (18) ntdomain: Adding Realm = "CLEARSYSTEM" (18) ntdomain: Authentication realm is LOCAL (18)       [ntdomain] = ok (18)       update control { (18)         &Proxy-To-Realm := LOCAL (18)       } # update control = noop (18) eap: Peer sent EAP Response (code 2) ID 8 length 6 (18) eap: No EAP Start, assuming it's an on-going EAP conversation (18)       [eap] = updated (18) files: Searching for user in group "allusers" rlm_ldap (ldap): Reserved connection (2) (18) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (18) files:    --> (uid=test1) (18) files: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (18) files: Waiting for search result... (18) files: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (18) files: Checking user object's memberOf attributes (18) files:   Performing unfiltered search in "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan", scope "base" (18) files:   Waiting for search result... (18) files: Processing memberOf value "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (18) files:   Resolving group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (18) files:   Performing unfiltered search in "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (18) files:   Waiting for search result... (18) files:   Group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "ftp_plugin" (18) files: Processing memberOf value "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (18) files:   Resolving group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (18) files:   Performing unfiltered search in "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (18) files:   Waiting for search result... (18) files:   Group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "web_proxy_plugin" (18) files: Processing memberOf value "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (18) files:   Resolving group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (18) files:   Performing unfiltered search in "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (18) files:   Waiting for search result... (18) files:   Group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "webupload" (18) files: Processing memberOf value "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (18) files:   Resolving group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (18) files:   Performing unfiltered search in "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (18) files:   Waiting for search result... (18) files:   Group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "allusers" (18) files: User found in group "allusers". Comparison between membership: name (resolved from DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=l?"), check: name rlm_ldap (ldap): Released connection (2) (18)       [files] = noop rlm_ldap (ldap): Reserved connection (3) (18) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (18) ldap:    --> (uid=test1) (18) ldap: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (18) ldap: Waiting for search result... (18) ldap: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (18) ldap: Processing user attributes (18) ldap: control:Password-With-Header += '{sha}tESsBmE/yNY3lb6a0L6vVQEZNqw=' rlm_ldap (ldap): Released connection (3) (18)       [ldap] = updated (18)       [expiration] = noop (18)       [logintime] = noop (18) pap: Converted: &control:Password-With-Header -> &control:SHA1-Password (18) pap: Removing &control:Password-With-Header (18) pap: Normalizing SHA1-Password from base64 encoding, 28 bytes -> 20 bytes (18) pap: WARNING: Auth-Type already set.  Not setting to PAP (18)       [pap] = noop (18)     } # authorize = updated (18)   Found Auth-Type = eap (18)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (18)     authenticate { (18) eap: Expiring EAP session with state 0x9f2abfcb9e22a540 (18) eap: Finished EAP session with state 0x9f2abfcb9e22a540 (18) eap: Previous EAP request found for state 0x9f2abfcb9e22a540, released from the list (18) eap: Peer sent packet with method EAP MSCHAPv2 (26) (18) eap: Calling submodule eap_mschapv2 to process data (18) eap: Sending EAP Success (code 3) ID 8 length 4 (18) eap: Freeing handler (18)       [eap] = ok (18)     } # authenticate = ok (18)   # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (18)     post-auth { (18)       if (0) { (18)       if (0)  -> FALSE (18)     } # post-auth = noop (18) } # server inner-tunnel (18) Virtual server sending reply (18)   MS-MPPE-Encryption-Policy = Encryption-Allowed (18)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (18)   MS-MPPE-Send-Key = 0x9f37c0e1d4ae81eaea7ac004f3bb5134 (18)   MS-MPPE-Recv-Key = 0x8f50bbb6f8efe9070c7af89a4d834531 (18)   EAP-Message = 0x03080004 (18)   Message-Authenticator = 0x00000000000000000000000000000000 (18)   Stripped-User-Name = "test1" (18) eap_peap: Got tunneled reply code 2 (18) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed (18) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (18) eap_peap:   MS-MPPE-Send-Key = 0x9f37c0e1d4ae81eaea7ac004f3bb5134 (18) eap_peap:   MS-MPPE-Recv-Key = 0x8f50bbb6f8efe9070c7af89a4d834531 (18) eap_peap:   EAP-Message = 0x03080004 (18) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap:   Stripped-User-Name = "test1" (18) eap_peap: Got tunneled reply RADIUS code 2 (18) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed (18) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (18) eap_peap:   MS-MPPE-Send-Key = 0x9f37c0e1d4ae81eaea7ac004f3bb5134 (18) eap_peap:   MS-MPPE-Recv-Key = 0x8f50bbb6f8efe9070c7af89a4d834531 (18) eap_peap:   EAP-Message = 0x03080004 (18) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (18) eap_peap:   Stripped-User-Name = "test1" (18) eap_peap: Tunneled authentication was successful (18) eap_peap: SUCCESS (18) eap: Sending EAP Request (code 1) ID 9 length 46 (18) eap: EAP session adding &reply:State = 0x5205bbdd5a0ca286 (18)     [eap] = handled (18)   } # authenticate = handled (18) Using Post-Auth-Type Challenge (18) # Executing group from file /etc/raddb/sites-enabled/default (18)   Challenge { ... } # empty sub-section is ignored (18) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (18)   EAP-Message = 0x0109002e19001703030023122ff0483babe9a792158bc6ad78757a858837b878ce0bc7a162c340720b68c2f14dff (18)   Message-Authenticator = 0x00000000000000000000000000000000 (18)   State = 0x5205bbdd5a0ca286e7a44a448065710e (18) Finished request Waking up in 4.9 seconds. (18) Cleaning up request packet ID 0 with timestamp +44 (19) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 189 (19)   User-Name = "CLEARSYSTEM\\test1" (19)   NAS-IP-Address = 172.22.22.254 (19)   Called-Station-Id = "001601dfe596" (19)   Calling-Station-Id = "74da38d41a8b" (19)   NAS-Identifier = "001601dfe596" (19)   NAS-Port = 5 (19)   Framed-MTU = 1400 (19)   State = 0x5205bbdd5a0ca286e7a44a448065710e (19)   NAS-Port-Type = Wireless-802.11 (19)   EAP-Message = 0x0209002e190017030300230000000000000004b670ecb66f45a52089029ef2d2526cd88f998a49f04e0a33532b8f (19)   Message-Authenticator = 0x1547e8623f812242aa168cffa15b4bf4 (19) session-state: No cached attributes (19) # Executing section authorize from file /etc/raddb/sites-enabled/default (19)   authorize { (19)     policy filter_username { (19)       if (&User-Name) { (19)       if (&User-Name)  -> TRUE (19)       if (&User-Name)  { (19)         if (&User-Name =~ / /) { (19)         if (&User-Name =~ / /)  -> FALSE (19)         if (&User-Name =~ /@[^@]*@/ ) { (19)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (19)         if (&User-Name =~ /\.\./ ) { (19)         if (&User-Name =~ /\.\./ )  -> FALSE (19)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (19)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (19)         if (&User-Name =~ /\.$/)  { (19)         if (&User-Name =~ /\.$/)   -> FALSE (19)         if (&User-Name =~ /@\./)  { (19)         if (&User-Name =~ /@\./)   -> FALSE (19)       } # if (&User-Name)  = notfound (19)     } # policy filter_username = notfound (19)     [preprocess] = ok (19)     [chap] = noop (19)     [mschap] = noop (19)     [digest] = noop (19) suffix: Checking for suffix after "@" (19) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (19) suffix: No such realm "NULL" (19)     [suffix] = noop (19) ntdomain: Checking for prefix before "\" (19) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (19) ntdomain: Found realm "CLEARSYSTEM" (19) ntdomain: Adding Stripped-User-Name = "test1" (19) ntdomain: Adding Realm = "CLEARSYSTEM" (19) ntdomain: Authentication realm is LOCAL (19)     [ntdomain] = ok (19) eap: Peer sent EAP Response (code 2) ID 9 length 46 (19) eap: Continuing tunnel setup (19)     [eap] = ok (19)   } # authorize = ok (19) Found Auth-Type = eap (19) # Executing group from file /etc/raddb/sites-enabled/default (19)   authenticate { (19) eap: Expiring EAP session with state 0x5205bbdd5a0ca286 (19) eap: Finished EAP session with state 0x5205bbdd5a0ca286 (19) eap: Previous EAP request found for state 0x5205bbdd5a0ca286, released from the list (19) eap: Peer sent packet with method EAP PEAP (25) (19) eap: Calling submodule eap_peap to process data (19) eap_peap: Continuing EAP-TLS (19) eap_peap: [eaptls verify] = ok (19) eap_peap: Done initial handshake (19) eap_peap: [eaptls process] = ok (19) eap_peap: Session established.  Decoding tunneled attributes (19) eap_peap: PEAP state send tlv success (19) eap_peap: Received EAP-TLV response (19) eap_peap: Success (19) eap: Sending EAP Success (code 3) ID 9 length 4 (19) eap: Freeing handler (19)     [eap] = ok (19)   } # authenticate = ok (19) # Executing section post-auth from file /etc/raddb/sites-enabled/default (19)   post-auth { (19)     update { (19)       No attributes updated (19)     } # update = noop (19)     [exec] = noop (19)     policy remove_reply_message_if_eap { (19)       if (&reply:EAP-Message && &reply:Reply-Message) { (19)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE (19)       else { (19)         [noop] = noop (19)       } # else = noop (19)     } # policy remove_reply_message_if_eap = noop (19)   } # post-auth = noop (19) Sent Access-Accept Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (19)   MS-MPPE-Recv-Key = 0x2a974e72a8e47133de5164a69bcadf7e50cb5b8e597302ea8864926ace2ad5fa (19)   MS-MPPE-Send-Key = 0xa82102166fbb9ded233362e3ee602ba3dc3e63538e8cf48d2a1db1c6eb7fe9b6 (19)   EAP-Message = 0x03090004 (19)   Message-Authenticator = 0x00000000000000000000000000000000 (19) Finished request Waking up in 4.9 seconds. (19) Cleaning up request packet ID 0 with timestamp +44 Ready to process requests (20) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 147 (20)   User-Name = "CLEARSYSTEM\\test1" (20)   NAS-IP-Address = 172.22.22.254 (20)   Called-Station-Id = "001601dfe596" (20)   Calling-Station-Id = "74da38d41a8b" (20)   NAS-Identifier = "001601dfe596" (20)   NAS-Port = 5 (20)   Framed-MTU = 1400 (20)   NAS-Port-Type = Wireless-802.11 (20)   EAP-Message = 0x0200001601434c45415253595354454d5c7465737431 (20)   Message-Authenticator = 0x9933ba7d639c9f63e9cb320a8b41e98f (20) # Executing section authorize from file /etc/raddb/sites-enabled/default (20)   authorize { (20)     policy filter_username { (20)       if (&User-Name) { (20)       if (&User-Name)  -> TRUE (20)       if (&User-Name)  { (20)         if (&User-Name =~ / /) { (20)         if (&User-Name =~ / /)  -> FALSE (20)         if (&User-Name =~ /@[^@]*@/ ) { (20)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (20)         if (&User-Name =~ /\.\./ ) { (20)         if (&User-Name =~ /\.\./ )  -> FALSE (20)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (20)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (20)         if (&User-Name =~ /\.$/)  { (20)         if (&User-Name =~ /\.$/)   -> FALSE (20)         if (&User-Name =~ /@\./)  { (20)         if (&User-Name =~ /@\./)   -> FALSE (20)       } # if (&User-Name)  = notfound (20)     } # policy filter_username = notfound (20)     [preprocess] = ok (20)     [chap] = noop (20)     [mschap] = noop (20)     [digest] = noop (20) suffix: Checking for suffix after "@" (20) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (20) suffix: No such realm "NULL" (20)     [suffix] = noop (20) ntdomain: Checking for prefix before "\" (20) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (20) ntdomain: Found realm "CLEARSYSTEM" (20) ntdomain: Adding Stripped-User-Name = "test1" (20) ntdomain: Adding Realm = "CLEARSYSTEM" (20) ntdomain: Authentication realm is LOCAL (20)     [ntdomain] = ok (20) eap: Peer sent EAP Response (code 2) ID 0 length 22 (20) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (20)     [eap] = ok (20)   } # authorize = ok (20) Found Auth-Type = eap (20) # Executing group from file /etc/raddb/sites-enabled/default (20)   authenticate { (20) eap: Peer sent packet with method EAP Identity (1) (20) eap: Calling submodule eap_peap to process data (20) eap_peap: Initiating new EAP-TLS session (20) eap_peap: [eaptls start] = request (20) eap: Sending EAP Request (code 1) ID 1 length 6 (20) eap: EAP session adding &reply:State = 0xfa6d51bcfa6c4896 (20)     [eap] = handled (20)   } # authenticate = handled (20) Using Post-Auth-Type Challenge (20) # Executing group from file /etc/raddb/sites-enabled/default (20)   Challenge { ... } # empty sub-section is ignored (20) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (20)   EAP-Message = 0x010100061920 (20)   Message-Authenticator = 0x00000000000000000000000000000000 (20)   State = 0xfa6d51bcfa6c489698062bca06912e67 (20) Finished request Waking up in 4.9 seconds. (20) Cleaning up request packet ID 0 with timestamp +52 (21) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 309 (21)   User-Name = "CLEARSYSTEM\\test1" (21)   NAS-IP-Address = 172.22.22.254 (21)   Called-Station-Id = "001601dfe596" (21)   Calling-Station-Id = "74da38d41a8b" (21)   NAS-Identifier = "001601dfe596" (21)   NAS-Port = 5 (21)   Framed-MTU = 1400 (21)   State = 0xfa6d51bcfa6c489698062bca06912e67 (21)   NAS-Port-Type = Wireless-802.11 (21)   EAP-Message = 0x020100a619800000009c16030300970100009303035af2cd4182a5d752449f9f3c82907f8a3241b08562a2f580b7510c209b1ad8ee00002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000040000500050100000000000a00080006001d (21)   Message-Authenticator = 0xd7ca5568b71b5db979cc885bbb70864c (21) session-state: No cached attributes (21) # Executing section authorize from file /etc/raddb/sites-enabled/default (21)   authorize { (21)     policy filter_username { (21)       if (&User-Name) { (21)       if (&User-Name)  -> TRUE (21)       if (&User-Name)  { (21)         if (&User-Name =~ / /) { (21)         if (&User-Name =~ / /)  -> FALSE (21)         if (&User-Name =~ /@[^@]*@/ ) { (21)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (21)         if (&User-Name =~ /\.\./ ) { (21)         if (&User-Name =~ /\.\./ )  -> FALSE (21)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (21)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (21)         if (&User-Name =~ /\.$/)  { (21)         if (&User-Name =~ /\.$/)   -> FALSE (21)         if (&User-Name =~ /@\./)  { (21)         if (&User-Name =~ /@\./)   -> FALSE (21)       } # if (&User-Name)  = notfound (21)     } # policy filter_username = notfound (21)     [preprocess] = ok (21)     [chap] = noop (21)     [mschap] = noop (21)     [digest] = noop (21) suffix: Checking for suffix after "@" (21) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (21) suffix: No such realm "NULL" (21)     [suffix] = noop (21) ntdomain: Checking for prefix before "\" (21) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (21) ntdomain: Found realm "CLEARSYSTEM" (21) ntdomain: Adding Stripped-User-Name = "test1" (21) ntdomain: Adding Realm = "CLEARSYSTEM" (21) ntdomain: Authentication realm is LOCAL (21)     [ntdomain] = ok (21) eap: Peer sent EAP Response (code 2) ID 1 length 166 (21) eap: Continuing tunnel setup (21)     [eap] = ok (21)   } # authorize = ok (21) Found Auth-Type = eap (21) # Executing group from file /etc/raddb/sites-enabled/default (21)   authenticate { (21) eap: Expiring EAP session with state 0xfa6d51bcfa6c4896 (21) eap: Finished EAP session with state 0xfa6d51bcfa6c4896 (21) eap: Previous EAP request found for state 0xfa6d51bcfa6c4896, released from the list (21) eap: Peer sent packet with method EAP PEAP (25) (21) eap: Calling submodule eap_peap to process data (21) eap_peap: Continuing EAP-TLS (21) eap_peap: Peer indicated complete TLS record size will be 156 bytes (21) eap_peap: Got complete TLS record (156 bytes) (21) eap_peap: [eaptls verify] = length included (21) eap_peap: (other): before/accept initialization (21) eap_peap: TLS_accept: before/accept initialization (21) eap_peap: <<< recv TLS 1.2  [length 0097] (21) eap_peap: TLS_accept: SSLv3 read client hello A (21) eap_peap: >>> send TLS 1.2  [length 0039] (21) eap_peap: TLS_accept: SSLv3 write server hello A (21) eap_peap: >>> send TLS 1.2  [length 08bd] (21) eap_peap: TLS_accept: SSLv3 write certificate A (21) eap_peap: >>> send TLS 1.2  [length 014d] (21) eap_peap: TLS_accept: SSLv3 write key exchange A (21) eap_peap: >>> send TLS 1.2  [length 0004] (21) eap_peap: TLS_accept: SSLv3 write server done A (21) eap_peap: TLS_accept: SSLv3 flush data (21) eap_peap: TLS_accept: SSLv3 read client certificate A (21) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key exchange A (21) eap_peap: TLS_accept: Need to read more data: SSLv3 read client key exchange A (21) eap_peap: In SSL Handshake Phase (21) eap_peap: In SSL Accept mode (21) eap_peap: [eaptls process] = handled (21) eap: Sending EAP Request (code 1) ID 2 length 1004 (21) eap: EAP session adding &reply:State = 0xfa6d51bcfb6f4896 (21)     [eap] = handled (21)   } # authenticate = handled (21) Using Post-Auth-Type Challenge (21) # Executing group from file /etc/raddb/sites-enabled/default (21)   Challenge { ... } # empty sub-section is ignored (21) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (21)   EAP-Message = 0x010203ec19c000000a5b1603030039020000350303efe7db12e59487a4ce090d0f4ba3b259512e5009c80752cd2d3f4b01afc6b7ed00c03000000dff01000100000b00040300010216030308bd0b0008b90008b60003fb308203f7308202dfa003020102020101300d06092a864886f70d01010b050030 (21)   Message-Authenticator = 0x00000000000000000000000000000000 (21)   State = 0xfa6d51bcfb6f489698062bca06912e67 (21) Finished request Waking up in 4.9 seconds. (21) Cleaning up request packet ID 0 with timestamp +53 (22) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (22)   User-Name = "CLEARSYSTEM\\test1" (22)   NAS-IP-Address = 172.22.22.254 (22)   Called-Station-Id = "001601dfe596" (22)   Calling-Station-Id = "74da38d41a8b" (22)   NAS-Identifier = "001601dfe596" (22)   NAS-Port = 5 (22)   Framed-MTU = 1400 (22)   State = 0xfa6d51bcfb6f489698062bca06912e67 (22)   NAS-Port-Type = Wireless-802.11 (22)   EAP-Message = 0x020200061900 (22)   Message-Authenticator = 0xa6e13757d66ca64391cce7904f9323cb (22) session-state: No cached attributes (22) # Executing section authorize from file /etc/raddb/sites-enabled/default (22)   authorize { (22)     policy filter_username { (22)       if (&User-Name) { (22)       if (&User-Name)  -> TRUE (22)       if (&User-Name)  { (22)         if (&User-Name =~ / /) { (22)         if (&User-Name =~ / /)  -> FALSE (22)         if (&User-Name =~ /@[^@]*@/ ) { (22)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (22)         if (&User-Name =~ /\.\./ ) { (22)         if (&User-Name =~ /\.\./ )  -> FALSE (22)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (22)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (22)         if (&User-Name =~ /\.$/)  { (22)         if (&User-Name =~ /\.$/)   -> FALSE (22)         if (&User-Name =~ /@\./)  { (22)         if (&User-Name =~ /@\./)   -> FALSE (22)       } # if (&User-Name)  = notfound (22)     } # policy filter_username = notfound (22)     [preprocess] = ok (22)     [chap] = noop (22)     [mschap] = noop (22)     [digest] = noop (22) suffix: Checking for suffix after "@" (22) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (22) suffix: No such realm "NULL" (22)     [suffix] = noop (22) ntdomain: Checking for prefix before "\" (22) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (22) ntdomain: Found realm "CLEARSYSTEM" (22) ntdomain: Adding Stripped-User-Name = "test1" (22) ntdomain: Adding Realm = "CLEARSYSTEM" (22) ntdomain: Authentication realm is LOCAL (22)     [ntdomain] = ok (22) eap: Peer sent EAP Response (code 2) ID 2 length 6 (22) eap: Continuing tunnel setup (22)     [eap] = ok (22)   } # authorize = ok (22) Found Auth-Type = eap (22) # Executing group from file /etc/raddb/sites-enabled/default (22)   authenticate { (22) eap: Expiring EAP session with state 0xfa6d51bcfb6f4896 (22) eap: Finished EAP session with state 0xfa6d51bcfb6f4896 (22) eap: Previous EAP request found for state 0xfa6d51bcfb6f4896, released from the list (22) eap: Peer sent packet with method EAP PEAP (25) (22) eap: Calling submodule eap_peap to process data (22) eap_peap: Continuing EAP-TLS (22) eap_peap: Peer ACKed our handshake fragment (22) eap_peap: [eaptls verify] = request (22) eap_peap: [eaptls process] = handled (22) eap: Sending EAP Request (code 1) ID 3 length 1000 (22) eap: EAP session adding &reply:State = 0xfa6d51bcf86e4896 (22)     [eap] = handled (22)   } # authenticate = handled (22) Using Post-Auth-Type Challenge (22) # Executing group from file /etc/raddb/sites-enabled/default (22)   Challenge { ... } # empty sub-section is ignored (22) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (22)   EAP-Message = 0x010303e819408444f5b804aa2d65ef2b23820bb1bf1bfcb24df6bd03eabe61d7bb630cfd9fd6165d19f24d23925593c04c7ec13d5afe51369fe487605e2de3073d043a15e72448712bca946e329e81ff36cebcdfe8be08dc6490da38ed9147e7eac88af7f25487bee0ef80700004b5308204b130820399 (22)   Message-Authenticator = 0x00000000000000000000000000000000 (22)   State = 0xfa6d51bcf86e489698062bca06912e67 (22) Finished request Waking up in 4.9 seconds. (22) Cleaning up request packet ID 0 with timestamp +53 (23) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (23)   User-Name = "CLEARSYSTEM\\test1" (23)   NAS-IP-Address = 172.22.22.254 (23)   Called-Station-Id = "001601dfe596" (23)   Calling-Station-Id = "74da38d41a8b" (23)   NAS-Identifier = "001601dfe596" (23)   NAS-Port = 5 (23)   Framed-MTU = 1400 (23)   State = 0xfa6d51bcf86e489698062bca06912e67 (23)   NAS-Port-Type = Wireless-802.11 (23)   EAP-Message = 0x020300061900 (23)   Message-Authenticator = 0x12fe245e46b21f527d4441886e6f31df (23) session-state: No cached attributes (23) # Executing section authorize from file /etc/raddb/sites-enabled/default (23)   authorize { (23)     policy filter_username { (23)       if (&User-Name) { (23)       if (&User-Name)  -> TRUE (23)       if (&User-Name)  { (23)         if (&User-Name =~ / /) { (23)         if (&User-Name =~ / /)  -> FALSE (23)         if (&User-Name =~ /@[^@]*@/ ) { (23)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (23)         if (&User-Name =~ /\.\./ ) { (23)         if (&User-Name =~ /\.\./ )  -> FALSE (23)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (23)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (23)         if (&User-Name =~ /\.$/)  { (23)         if (&User-Name =~ /\.$/)   -> FALSE (23)         if (&User-Name =~ /@\./)  { (23)         if (&User-Name =~ /@\./)   -> FALSE (23)       } # if (&User-Name)  = notfound (23)     } # policy filter_username = notfound (23)     [preprocess] = ok (23)     [chap] = noop (23)     [mschap] = noop (23)     [digest] = noop (23) suffix: Checking for suffix after "@" (23) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (23) suffix: No such realm "NULL" (23)     [suffix] = noop (23) ntdomain: Checking for prefix before "\" (23) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (23) ntdomain: Found realm "CLEARSYSTEM" (23) ntdomain: Adding Stripped-User-Name = "test1" (23) ntdomain: Adding Realm = "CLEARSYSTEM" (23) ntdomain: Authentication realm is LOCAL (23)     [ntdomain] = ok (23) eap: Peer sent EAP Response (code 2) ID 3 length 6 (23) eap: Continuing tunnel setup (23)     [eap] = ok (23)   } # authorize = ok (23) Found Auth-Type = eap (23) # Executing group from file /etc/raddb/sites-enabled/default (23)   authenticate { (23) eap: Expiring EAP session with state 0xfa6d51bcf86e4896 (23) eap: Finished EAP session with state 0xfa6d51bcf86e4896 (23) eap: Previous EAP request found for state 0xfa6d51bcf86e4896, released from the list (23) eap: Peer sent packet with method EAP PEAP (25) (23) eap: Calling submodule eap_peap to process data (23) eap_peap: Continuing EAP-TLS (23) eap_peap: Peer ACKed our handshake fragment (23) eap_peap: [eaptls verify] = request (23) eap_peap: [eaptls process] = handled (23) eap: Sending EAP Request (code 1) ID 4 length 669 (23) eap: EAP session adding &reply:State = 0xfa6d51bcf9694896 (23)     [eap] = handled (23)   } # authenticate = handled (23) Using Post-Auth-Type Challenge (23) # Executing group from file /etc/raddb/sites-enabled/default (23)   Challenge { ... } # empty sub-section is ignored (23) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (23)   EAP-Message = 0x0104029d1900278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b050003820101000132a42023b4da19cd0464809979cba06e09409f4cbae9db226b41b48d0c97de8fa6092c00476cb9f16399e310996fb68c40e69b10 (23)   Message-Authenticator = 0x00000000000000000000000000000000 (23)   State = 0xfa6d51bcf969489698062bca06912e67 (23) Finished request Waking up in 4.9 seconds. (23) Cleaning up request packet ID 0 with timestamp +53 (24) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 279 (24)   User-Name = "CLEARSYSTEM\\test1" (24)   NAS-IP-Address = 172.22.22.254 (24)   Called-Station-Id = "001601dfe596" (24)   Calling-Station-Id = "74da38d41a8b" (24)   NAS-Identifier = "001601dfe596" (24)   NAS-Port = 5 (24)   Framed-MTU = 1400 (24)   State = 0xfa6d51bcf969489698062bca06912e67 (24)   NAS-Port-Type = Wireless-802.11 (24)   EAP-Message = 0x0204008819800000007e16030300461000004241049e1a625d2b93e6a0c9c56f2c9ac9ff69abdc4f1ca93b1351d875e78f8aa12296537dfac26fda08297759aa812bdcd6a246e57257ee8f71aa07939bb4a5f5f6a914030300010116030300280000000000000000c1c16214c7db50ef874f9234cd8c36 (24)   Message-Authenticator = 0xef04f914f34ef56740417c68c8f84c29 (24) session-state: No cached attributes (24) # Executing section authorize from file /etc/raddb/sites-enabled/default (24)   authorize { (24)     policy filter_username { (24)       if (&User-Name) { (24)       if (&User-Name)  -> TRUE (24)       if (&User-Name)  { (24)         if (&User-Name =~ / /) { (24)         if (&User-Name =~ / /)  -> FALSE (24)         if (&User-Name =~ /@[^@]*@/ ) { (24)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (24)         if (&User-Name =~ /\.\./ ) { (24)         if (&User-Name =~ /\.\./ )  -> FALSE (24)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (24)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (24)         if (&User-Name =~ /\.$/)  { (24)         if (&User-Name =~ /\.$/)   -> FALSE (24)         if (&User-Name =~ /@\./)  { (24)         if (&User-Name =~ /@\./)   -> FALSE (24)       } # if (&User-Name)  = notfound (24)     } # policy filter_username = notfound (24)     [preprocess] = ok (24)     [chap] = noop (24)     [mschap] = noop (24)     [digest] = noop (24) suffix: Checking for suffix after "@" (24) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (24) suffix: No such realm "NULL" (24)     [suffix] = noop (24) ntdomain: Checking for prefix before "\" (24) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (24) ntdomain: Found realm "CLEARSYSTEM" (24) ntdomain: Adding Stripped-User-Name = "test1" (24) ntdomain: Adding Realm = "CLEARSYSTEM" (24) ntdomain: Authentication realm is LOCAL (24)     [ntdomain] = ok (24) eap: Peer sent EAP Response (code 2) ID 4 length 136 (24) eap: Continuing tunnel setup (24)     [eap] = ok (24)   } # authorize = ok (24) Found Auth-Type = eap (24) # Executing group from file /etc/raddb/sites-enabled/default (24)   authenticate { (24) eap: Expiring EAP session with state 0xfa6d51bcf9694896 (24) eap: Finished EAP session with state 0xfa6d51bcf9694896 (24) eap: Previous EAP request found for state 0xfa6d51bcf9694896, released from the list (24) eap: Peer sent packet with method EAP PEAP (25) (24) eap: Calling submodule eap_peap to process data (24) eap_peap: Continuing EAP-TLS (24) eap_peap: Peer indicated complete TLS record size will be 126 bytes (24) eap_peap: Got complete TLS record (126 bytes) (24) eap_peap: [eaptls verify] = length included (24) eap_peap: <<< recv TLS 1.2  [length 0046] (24) eap_peap: TLS_accept: SSLv3 read client key exchange A (24) eap_peap: TLS_accept: SSLv3 read certificate verify A (24) eap_peap: <<< recv TLS 1.2  [length 0001] (24) eap_peap: <<< recv TLS 1.2  [length 0010] (24) eap_peap: TLS_accept: SSLv3 read finished A (24) eap_peap: >>> send TLS 1.2  [length 0001] (24) eap_peap: TLS_accept: SSLv3 write change cipher spec A (24) eap_peap: >>> send TLS 1.2  [length 0010] (24) eap_peap: TLS_accept: SSLv3 write finished A (24) eap_peap: TLS_accept: SSLv3 flush data (24) eap_peap: (other): SSL negotiation finished successfully (24) eap_peap: SSL Connection Established (24) eap_peap: [eaptls process] = handled (24) eap: Sending EAP Request (code 1) ID 5 length 57 (24) eap: EAP session adding &reply:State = 0xfa6d51bcfe684896 (24)     [eap] = handled (24)   } # authenticate = handled (24) Using Post-Auth-Type Challenge (24) # Executing group from file /etc/raddb/sites-enabled/default (24)   Challenge { ... } # empty sub-section is ignored (24) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (24)   EAP-Message = 0x01050039190014030300010116030300289fc5de61f40ef791b66109d7e36af16596d84e0d117df80d2a801f121f79b4700b8a5712ac9eb200 (24)   Message-Authenticator = 0x00000000000000000000000000000000 (24)   State = 0xfa6d51bcfe68489698062bca06912e67 (24) Finished request Waking up in 4.9 seconds. (24) Cleaning up request packet ID 0 with timestamp +53 (25) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 149 (25)   User-Name = "CLEARSYSTEM\\test1" (25)   NAS-IP-Address = 172.22.22.254 (25)   Called-Station-Id = "001601dfe596" (25)   Calling-Station-Id = "74da38d41a8b" (25)   NAS-Identifier = "001601dfe596" (25)   NAS-Port = 5 (25)   Framed-MTU = 1400 (25)   State = 0xfa6d51bcfe68489698062bca06912e67 (25)   NAS-Port-Type = Wireless-802.11 (25)   EAP-Message = 0x020500061900 (25)   Message-Authenticator = 0xc4d5b25261ca14db4b0b4afd1509d942 (25) session-state: No cached attributes (25) # Executing section authorize from file /etc/raddb/sites-enabled/default (25)   authorize { (25)     policy filter_username { (25)       if (&User-Name) { (25)       if (&User-Name)  -> TRUE (25)       if (&User-Name)  { (25)         if (&User-Name =~ / /) { (25)         if (&User-Name =~ / /)  -> FALSE (25)         if (&User-Name =~ /@[^@]*@/ ) { (25)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (25)         if (&User-Name =~ /\.\./ ) { (25)         if (&User-Name =~ /\.\./ )  -> FALSE (25)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (25)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (25)         if (&User-Name =~ /\.$/)  { (25)         if (&User-Name =~ /\.$/)   -> FALSE (25)         if (&User-Name =~ /@\./)  { (25)         if (&User-Name =~ /@\./)   -> FALSE (25)       } # if (&User-Name)  = notfound (25)     } # policy filter_username = notfound (25)     [preprocess] = ok (25)     [chap] = noop (25)     [mschap] = noop (25)     [digest] = noop (25) suffix: Checking for suffix after "@" (25) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (25) suffix: No such realm "NULL" (25)     [suffix] = noop (25) ntdomain: Checking for prefix before "\" (25) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (25) ntdomain: Found realm "CLEARSYSTEM" (25) ntdomain: Adding Stripped-User-Name = "test1" (25) ntdomain: Adding Realm = "CLEARSYSTEM" (25) ntdomain: Authentication realm is LOCAL (25)     [ntdomain] = ok (25) eap: Peer sent EAP Response (code 2) ID 5 length 6 (25) eap: Continuing tunnel setup (25)     [eap] = ok (25)   } # authorize = ok (25) Found Auth-Type = eap (25) # Executing group from file /etc/raddb/sites-enabled/default (25)   authenticate { (25) eap: Expiring EAP session with state 0xfa6d51bcfe684896 (25) eap: Finished EAP session with state 0xfa6d51bcfe684896 (25) eap: Previous EAP request found for state 0xfa6d51bcfe684896, released from the list (25) eap: Peer sent packet with method EAP PEAP (25) (25) eap: Calling submodule eap_peap to process data (25) eap_peap: Continuing EAP-TLS (25) eap_peap: Peer ACKed our handshake fragment.  handshake is finished (25) eap_peap: [eaptls verify] = success (25) eap_peap: [eaptls process] = success (25) eap_peap: Session established.  Decoding tunneled attributes (25) eap_peap: PEAP state TUNNEL ESTABLISHED (25) eap: Sending EAP Request (code 1) ID 6 length 40 (25) eap: EAP session adding &reply:State = 0xfa6d51bcff6b4896 (25)     [eap] = handled (25)   } # authenticate = handled (25) Using Post-Auth-Type Challenge (25) # Executing group from file /etc/raddb/sites-enabled/default (25)   Challenge { ... } # empty sub-section is ignored (25) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (25)   EAP-Message = 0x010600281900170303001d9fc5de61f40ef7925497e0f03071577e94fda8fc4dca1cd9802e483d4e (25)   Message-Authenticator = 0x00000000000000000000000000000000 (25)   State = 0xfa6d51bcff6b489698062bca06912e67 (25) Finished request Waking up in 4.9 seconds. (25) Cleaning up request packet ID 0 with timestamp +53 (26) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 196 (26)   User-Name = "CLEARSYSTEM\\test1" (26)   NAS-IP-Address = 172.22.22.254 (26)   Called-Station-Id = "001601dfe596" (26)   Calling-Station-Id = "74da38d41a8b" (26)   NAS-Identifier = "001601dfe596" (26)   NAS-Port = 5 (26)   Framed-MTU = 1400 (26)   State = 0xfa6d51bcff6b489698062bca06912e67 (26)   NAS-Port-Type = Wireless-802.11 (26)   EAP-Message = 0x020600351900170303002a00000000000000010c933fa0100b5f27e5b96564694cce21d984340dcb6f16c8d77d6ca418f7bc3355c0 (26)   Message-Authenticator = 0x3bb9fc8b6b5e0df1d67ba95dd5dded2d (26) session-state: No cached attributes (26) # Executing section authorize from file /etc/raddb/sites-enabled/default (26)   authorize { (26)     policy filter_username { (26)       if (&User-Name) { (26)       if (&User-Name)  -> TRUE (26)       if (&User-Name)  { (26)         if (&User-Name =~ / /) { (26)         if (&User-Name =~ / /)  -> FALSE (26)         if (&User-Name =~ /@[^@]*@/ ) { (26)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (26)         if (&User-Name =~ /\.\./ ) { (26)         if (&User-Name =~ /\.\./ )  -> FALSE (26)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (26)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (26)         if (&User-Name =~ /\.$/)  { (26)         if (&User-Name =~ /\.$/)   -> FALSE (26)         if (&User-Name =~ /@\./)  { (26)         if (&User-Name =~ /@\./)   -> FALSE (26)       } # if (&User-Name)  = notfound (26)     } # policy filter_username = notfound (26)     [preprocess] = ok (26)     [chap] = noop (26)     [mschap] = noop (26)     [digest] = noop (26) suffix: Checking for suffix after "@" (26) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (26) suffix: No such realm "NULL" (26)     [suffix] = noop (26) ntdomain: Checking for prefix before "\" (26) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (26) ntdomain: Found realm "CLEARSYSTEM" (26) ntdomain: Adding Stripped-User-Name = "test1" (26) ntdomain: Adding Realm = "CLEARSYSTEM" (26) ntdomain: Authentication realm is LOCAL (26)     [ntdomain] = ok (26) eap: Peer sent EAP Response (code 2) ID 6 length 53 (26) eap: Continuing tunnel setup (26)     [eap] = ok (26)   } # authorize = ok (26) Found Auth-Type = eap (26) # Executing group from file /etc/raddb/sites-enabled/default (26)   authenticate { (26) eap: Expiring EAP session with state 0xfa6d51bcff6b4896 (26) eap: Finished EAP session with state 0xfa6d51bcff6b4896 (26) eap: Previous EAP request found for state 0xfa6d51bcff6b4896, released from the list (26) eap: Peer sent packet with method EAP PEAP (25) (26) eap: Calling submodule eap_peap to process data (26) eap_peap: Continuing EAP-TLS (26) eap_peap: [eaptls verify] = ok (26) eap_peap: Done initial handshake (26) eap_peap: [eaptls process] = ok (26) eap_peap: Session established.  Decoding tunneled attributes (26) eap_peap: PEAP state WAITING FOR INNER IDENTITY (26) eap_peap: Identity - CLEARSYSTEM\test1 (26) eap_peap: Got inner identity 'CLEARSYSTEM\test1' (26) eap_peap: Setting default EAP type for tunneled EAP session (26) eap_peap: Got tunneled request (26) eap_peap:   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (26) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (26) eap_peap: Sending tunneled request to inner-tunnel (26) eap_peap:   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (26) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (26) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (26) Virtual server inner-tunnel received request (26)   EAP-Message = 0x0206001601434c45415253595354454d5c7465737431 (26)   FreeRADIUS-Proxied-To = 127.0.0.1 (26)   User-Name = "CLEARSYSTEM\\test1" (26) WARNING: Outer and inner identities are the same.  User privacy is compromised. (26) server inner-tunnel { (26)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (26)     authorize { (26)       policy filter_username { (26)         if (&User-Name) { (26)         if (&User-Name)  -> TRUE (26)         if (&User-Name)  { (26)           if (&User-Name =~ / /) { (26)           if (&User-Name =~ / /)  -> FALSE (26)           if (&User-Name =~ /@[^@]*@/ ) { (26)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (26)           if (&User-Name =~ /\.\./ ) { (26)           if (&User-Name =~ /\.\./ )  -> FALSE (26)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (26)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (26)           if (&User-Name =~ /\.$/)  { (26)           if (&User-Name =~ /\.$/)   -> FALSE (26)           if (&User-Name =~ /@\./)  { (26)           if (&User-Name =~ /@\./)   -> FALSE (26)         } # if (&User-Name)  = notfound (26)       } # policy filter_username = notfound (26)       [chap] = noop (26)       [mschap] = noop (26) suffix: Checking for suffix after "@" (26) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (26) suffix: No such realm "NULL" (26)       [suffix] = noop (26) ntdomain: Checking for prefix before "\" (26) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (26) ntdomain: Found realm "CLEARSYSTEM" (26) ntdomain: Adding Stripped-User-Name = "test1" (26) ntdomain: Adding Realm = "CLEARSYSTEM" (26) ntdomain: Authentication realm is LOCAL (26)       [ntdomain] = ok (26)       update control { (26)         &Proxy-To-Realm := LOCAL (26)       } # update control = noop (26) eap: Peer sent EAP Response (code 2) ID 6 length 22 (26) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (26)       [eap] = ok (26)     } # authorize = ok (26)   Found Auth-Type = eap (26)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (26)     authenticate { (26) eap: Peer sent packet with method EAP Identity (1) (26) eap: Calling submodule eap_mschapv2 to process data (26) eap_mschapv2: Issuing Challenge (26) eap: Sending EAP Request (code 1) ID 7 length 43 (26) eap: EAP session adding &reply:State = 0x67f4154867f30fc7 (26)       [eap] = handled (26)     } # authenticate = handled (26) } # server inner-tunnel (26) Virtual server sending reply (26)   EAP-Message = 0x0107002b1a0107002610924e60a23ee51c27491d1ede23d3f645667265657261646975732d332e302e3133 (26)   Message-Authenticator = 0x00000000000000000000000000000000 (26)   State = 0x67f4154867f30fc7e3fcab03d0b75466 (26) eap_peap: Got tunneled reply code 11 (26) eap_peap:   EAP-Message = 0x0107002b1a0107002610924e60a23ee51c27491d1ede23d3f645667265657261646975732d332e302e3133 (26) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (26) eap_peap:   State = 0x67f4154867f30fc7e3fcab03d0b75466 (26) eap_peap: Got tunneled reply RADIUS code 11 (26) eap_peap:   EAP-Message = 0x0107002b1a0107002610924e60a23ee51c27491d1ede23d3f645667265657261646975732d332e302e3133 (26) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (26) eap_peap:   State = 0x67f4154867f30fc7e3fcab03d0b75466 (26) eap_peap: Got tunneled Access-Challenge (26) eap: Sending EAP Request (code 1) ID 7 length 74 (26) eap: EAP session adding &reply:State = 0xfa6d51bcfc6a4896 (26)     [eap] = handled (26)   } # authenticate = handled (26) Using Post-Auth-Type Challenge (26) # Executing group from file /etc/raddb/sites-enabled/default (26)   Challenge { ... } # empty sub-section is ignored (26) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (26)   EAP-Message = 0x0107004a1900170303003f9fc5de61f40ef79320067b88f1b9e625058f12902741fb970becb9261d941d1b266fa753bee467888aab0af7d34c9f313426aa5a51d1aa69aa798529ede786 (26)   Message-Authenticator = 0x00000000000000000000000000000000 (26)   State = 0xfa6d51bcfc6a489698062bca06912e67 (26) Finished request Waking up in 4.9 seconds. (26) Cleaning up request packet ID 0 with timestamp +53 (27) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 250 (27)   User-Name = "CLEARSYSTEM\\test1" (27)   NAS-IP-Address = 172.22.22.254 (27)   Called-Station-Id = "001601dfe596" (27)   Calling-Station-Id = "74da38d41a8b" (27)   NAS-Identifier = "001601dfe596" (27)   NAS-Port = 5 (27)   Framed-MTU = 1400 (27)   State = 0xfa6d51bcfc6a489698062bca06912e67 (27)   NAS-Port-Type = Wireless-802.11 (27)   EAP-Message = 0x0207006b1900170303006000000000000000021164b401a6b91edb40d45e1ae33a3fea0cec4342e9431f3070feae69d5c873b621ce5e2ca831677e11c81a47eb117c073c0825ef4ce462d2b041e0dbe753411783cbeed0efd3072a2d2548310371af5a119da170a961b921 (27)   Message-Authenticator = 0xf080de21399d6eac0a27d43417e9a92c (27) session-state: No cached attributes (27) # Executing section authorize from file /etc/raddb/sites-enabled/default (27)   authorize { (27)     policy filter_username { (27)       if (&User-Name) { (27)       if (&User-Name)  -> TRUE (27)       if (&User-Name)  { (27)         if (&User-Name =~ / /) { (27)         if (&User-Name =~ / /)  -> FALSE (27)         if (&User-Name =~ /@[^@]*@/ ) { (27)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (27)         if (&User-Name =~ /\.\./ ) { (27)         if (&User-Name =~ /\.\./ )  -> FALSE (27)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (27)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (27)         if (&User-Name =~ /\.$/)  { (27)         if (&User-Name =~ /\.$/)   -> FALSE (27)         if (&User-Name =~ /@\./)  { (27)         if (&User-Name =~ /@\./)   -> FALSE (27)       } # if (&User-Name)  = notfound (27)     } # policy filter_username = notfound (27)     [preprocess] = ok (27)     [chap] = noop (27)     [mschap] = noop (27)     [digest] = noop (27) suffix: Checking for suffix after "@" (27) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (27) suffix: No such realm "NULL" (27)     [suffix] = noop (27) ntdomain: Checking for prefix before "\" (27) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (27) ntdomain: Found realm "CLEARSYSTEM" (27) ntdomain: Adding Stripped-User-Name = "test1" (27) ntdomain: Adding Realm = "CLEARSYSTEM" (27) ntdomain: Authentication realm is LOCAL (27)     [ntdomain] = ok (27) eap: Peer sent EAP Response (code 2) ID 7 length 107 (27) eap: Continuing tunnel setup (27)     [eap] = ok (27)   } # authorize = ok (27) Found Auth-Type = eap (27) # Executing group from file /etc/raddb/sites-enabled/default (27)   authenticate { (27) eap: Expiring EAP session with state 0x67f4154867f30fc7 (27) eap: Finished EAP session with state 0xfa6d51bcfc6a4896 (27) eap: Previous EAP request found for state 0xfa6d51bcfc6a4896, released from the list (27) eap: Peer sent packet with method EAP PEAP (25) (27) eap: Calling submodule eap_peap to process data (27) eap_peap: Continuing EAP-TLS (27) eap_peap: [eaptls verify] = ok (27) eap_peap: Done initial handshake (27) eap_peap: [eaptls process] = ok (27) eap_peap: Session established.  Decoding tunneled attributes (27) eap_peap: PEAP state phase2 (27) eap_peap: EAP method MSCHAPv2 (26) (27) eap_peap: Got tunneled request (27) eap_peap:   EAP-Message = 0x0207004c1a02070047318ebe9e5e7d389ad1bc7eb58ddee3294600000000000000009192d897cc33bc83f03bd7b7e725852e1cefe0cd1cabcebc00434c45415253595354454d5c7465737431 (27) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (27) eap_peap: Sending tunneled request to inner-tunnel (27) eap_peap:   EAP-Message = 0x0207004c1a02070047318ebe9e5e7d389ad1bc7eb58ddee3294600000000000000009192d897cc33bc83f03bd7b7e725852e1cefe0cd1cabcebc00434c45415253595354454d5c7465737431 (27) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (27) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (27) eap_peap:   State = 0x67f4154867f30fc7e3fcab03d0b75466 (27) Virtual server inner-tunnel received request (27)   EAP-Message = 0x0207004c1a02070047318ebe9e5e7d389ad1bc7eb58ddee3294600000000000000009192d897cc33bc83f03bd7b7e725852e1cefe0cd1cabcebc00434c45415253595354454d5c7465737431 (27)   FreeRADIUS-Proxied-To = 127.0.0.1 (27)   User-Name = "CLEARSYSTEM\\test1" (27)   State = 0x67f4154867f30fc7e3fcab03d0b75466 (27) WARNING: Outer and inner identities are the same.  User privacy is compromised. (27) server inner-tunnel { (27)   session-state: No cached attributes (27)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (27)     authorize { (27)       policy filter_username { (27)         if (&User-Name) { (27)         if (&User-Name)  -> TRUE (27)         if (&User-Name)  { (27)           if (&User-Name =~ / /) { (27)           if (&User-Name =~ / /)  -> FALSE (27)           if (&User-Name =~ /@[^@]*@/ ) { (27)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (27)           if (&User-Name =~ /\.\./ ) { (27)           if (&User-Name =~ /\.\./ )  -> FALSE (27)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (27)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (27)           if (&User-Name =~ /\.$/)  { (27)           if (&User-Name =~ /\.$/)   -> FALSE (27)           if (&User-Name =~ /@\./)  { (27)           if (&User-Name =~ /@\./)   -> FALSE (27)         } # if (&User-Name)  = notfound (27)       } # policy filter_username = notfound (27)       [chap] = noop (27)       [mschap] = noop (27) suffix: Checking for suffix after "@" (27) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (27) suffix: No such realm "NULL" (27)       [suffix] = noop (27) ntdomain: Checking for prefix before "\" (27) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (27) ntdomain: Found realm "CLEARSYSTEM" (27) ntdomain: Adding Stripped-User-Name = "test1" (27) ntdomain: Adding Realm = "CLEARSYSTEM" (27) ntdomain: Authentication realm is LOCAL (27)       [ntdomain] = ok (27)       update control { (27)         &Proxy-To-Realm := LOCAL (27)       } # update control = noop (27) eap: Peer sent EAP Response (code 2) ID 7 length 76 (27) eap: No EAP Start, assuming it's an on-going EAP conversation (27)       [eap] = updated (27) files: Searching for user in group "allusers" rlm_ldap (ldap): Reserved connection (4) (27) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (27) files:    --> (uid=test1) (27) files: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (27) files: Waiting for search result... (27) files: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (27) files: Checking user object's memberOf attributes (27) files:   Performing unfiltered search in "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan", scope "base" (27) files:   Waiting for search result... (27) files: Processing memberOf value "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (27) files:   Resolving group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (27) files:   Performing unfiltered search in "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (27) files:   Waiting for search result... (27) files:   Group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "ftp_plugin" (27) files: Processing memberOf value "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (27) files:   Resolving group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (27) files:   Performing unfiltered search in "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (27) files:   Waiting for search result... (27) files:   Group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "web_proxy_plugin" (27) files: Processing memberOf value "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (27) files:   Resolving group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (27) files:   Performing unfiltered search in "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (27) files:   Waiting for search result... (27) files:   Group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "webupload" (27) files: Processing memberOf value "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (27) files:   Resolving group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (27) files:   Performing unfiltered search in "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (27) files:   Waiting for search result... (27) files:   Group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "allusers" (27) files: User found in group "allusers". Comparison between membership: name (resolved from DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=l?"), check: name rlm_ldap (ldap): Released connection (4) (27)       [files] = noop rlm_ldap (ldap): Reserved connection (1) (27) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (27) ldap:    --> (uid=test1) (27) ldap: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (27) ldap: Waiting for search result... (27) ldap: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (27) ldap: Processing user attributes (27) ldap: control:Password-With-Header += '{sha}tESsBmE/yNY3lb6a0L6vVQEZNqw=' rlm_ldap (ldap): Released connection (1) (27)       [ldap] = updated (27)       [expiration] = noop (27)       [logintime] = noop (27) pap: Converted: &control:Password-With-Header -> &control:SHA1-Password (27) pap: Removing &control:Password-With-Header (27) pap: Normalizing SHA1-Password from base64 encoding, 28 bytes -> 20 bytes (27) pap: WARNING: Auth-Type already set.  Not setting to PAP (27)       [pap] = noop (27)     } # authorize = updated (27)   Found Auth-Type = eap (27)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (27)     authenticate { (27) eap: Expiring EAP session with state 0x67f4154867f30fc7 (27) eap: Finished EAP session with state 0x67f4154867f30fc7 (27) eap: Previous EAP request found for state 0x67f4154867f30fc7, released from the list (27) eap: Peer sent packet with method EAP MSCHAPv2 (26) (27) eap: Calling submodule eap_mschapv2 to process data (27) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (27) eap_mschapv2:   authenticate { (27) mschap: Creating challenge hash with username: test1 (27) mschap: Client is using MS-CHAPv2 (27) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (27) mschap: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (27) mschap:    --> --username=test1 (27) mschap: Creating challenge hash with username: test1 (27) mschap: EXPAND --challenge=%{%{mschap:Challenge}:-00} (27) mschap:    --> --challenge=b7881bdaef5718d0 (27) mschap: EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (27) mschap:    --> --nt-response=9192d897cc33bc83f03bd7b7e725852e1cefe0cd1cabcebc (27) mschap: Program returned code (0) and output 'NT_KEY: DAE53F1776DBD0817C5639A27629A27D' (27) mschap: Adding MS-CHAPv2 MPPE keys (27)     [mschap] = ok (27)   } # authenticate = ok (27) MSCHAP Success (27) eap: Sending EAP Request (code 1) ID 8 length 51 (27) eap: EAP session adding &reply:State = 0x67f4154866fc0fc7 (27)       [eap] = handled (27)     } # authenticate = handled (27) } # server inner-tunnel (27) Virtual server sending reply (27)   EAP-Message = 0x010800331a0307002e533d43433037464444353744443738353244433532393433303036333836383832433333303235313235 (27)   Message-Authenticator = 0x00000000000000000000000000000000 (27)   State = 0x67f4154866fc0fc7e3fcab03d0b75466 (27) eap_peap: Got tunneled reply code 11 (27) eap_peap:   EAP-Message = 0x010800331a0307002e533d43433037464444353744443738353244433532393433303036333836383832433333303235313235 (27) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (27) eap_peap:   State = 0x67f4154866fc0fc7e3fcab03d0b75466 (27) eap_peap: Got tunneled reply RADIUS code 11 (27) eap_peap:   EAP-Message = 0x010800331a0307002e533d43433037464444353744443738353244433532393433303036333836383832433333303235313235 (27) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (27) eap_peap:   State = 0x67f4154866fc0fc7e3fcab03d0b75466 (27) eap_peap: Got tunneled Access-Challenge (27) eap: Sending EAP Request (code 1) ID 8 length 82 (27) eap: EAP session adding &reply:State = 0xfa6d51bcfd654896 (27)     [eap] = handled (27)   } # authenticate = handled (27) Using Post-Auth-Type Challenge (27) # Executing group from file /etc/raddb/sites-enabled/default (27)   Challenge { ... } # empty sub-section is ignored (27) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (27)   EAP-Message = 0x01080052190017030300479fc5de61f40ef79494eff5694d56e768cdb21779bc552c78a169ac0f8530b9de062bb9e00f19afd761d18aabce43510a9de602925b9274ddb52b6383f31803be6bd4971c2690bf (27)   Message-Authenticator = 0x00000000000000000000000000000000 (27)   State = 0xfa6d51bcfd65489698062bca06912e67 (27) Finished request Waking up in 4.9 seconds. (27) Cleaning up request packet ID 0 with timestamp +53 (28) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 180 (28)   User-Name = "CLEARSYSTEM\\test1" (28)   NAS-IP-Address = 172.22.22.254 (28)   Called-Station-Id = "001601dfe596" (28)   Calling-Station-Id = "74da38d41a8b" (28)   NAS-Identifier = "001601dfe596" (28)   NAS-Port = 5 (28)   Framed-MTU = 1400 (28)   State = 0xfa6d51bcfd65489698062bca06912e67 (28)   NAS-Port-Type = Wireless-802.11 (28)   EAP-Message = 0x020800251900170303001a0000000000000003f17c071701f2900218e05b0493a96e129742 (28)   Message-Authenticator = 0x1d570e56fa27451711dbb7b15f04968d (28) session-state: No cached attributes (28) # Executing section authorize from file /etc/raddb/sites-enabled/default (28)   authorize { (28)     policy filter_username { (28)       if (&User-Name) { (28)       if (&User-Name)  -> TRUE (28)       if (&User-Name)  { (28)         if (&User-Name =~ / /) { (28)         if (&User-Name =~ / /)  -> FALSE (28)         if (&User-Name =~ /@[^@]*@/ ) { (28)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (28)         if (&User-Name =~ /\.\./ ) { (28)         if (&User-Name =~ /\.\./ )  -> FALSE (28)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (28)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (28)         if (&User-Name =~ /\.$/)  { (28)         if (&User-Name =~ /\.$/)   -> FALSE (28)         if (&User-Name =~ /@\./)  { (28)         if (&User-Name =~ /@\./)   -> FALSE (28)       } # if (&User-Name)  = notfound (28)     } # policy filter_username = notfound (28)     [preprocess] = ok (28)     [chap] = noop (28)     [mschap] = noop (28)     [digest] = noop (28) suffix: Checking for suffix after "@" (28) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (28) suffix: No such realm "NULL" (28)     [suffix] = noop (28) ntdomain: Checking for prefix before "\" (28) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (28) ntdomain: Found realm "CLEARSYSTEM" (28) ntdomain: Adding Stripped-User-Name = "test1" (28) ntdomain: Adding Realm = "CLEARSYSTEM" (28) ntdomain: Authentication realm is LOCAL (28)     [ntdomain] = ok (28) eap: Peer sent EAP Response (code 2) ID 8 length 37 (28) eap: Continuing tunnel setup (28)     [eap] = ok (28)   } # authorize = ok (28) Found Auth-Type = eap (28) # Executing group from file /etc/raddb/sites-enabled/default (28)   authenticate { (28) eap: Expiring EAP session with state 0x67f4154866fc0fc7 (28) eap: Finished EAP session with state 0xfa6d51bcfd654896 (28) eap: Previous EAP request found for state 0xfa6d51bcfd654896, released from the list (28) eap: Peer sent packet with method EAP PEAP (25) (28) eap: Calling submodule eap_peap to process data (28) eap_peap: Continuing EAP-TLS (28) eap_peap: [eaptls verify] = ok (28) eap_peap: Done initial handshake (28) eap_peap: [eaptls process] = ok (28) eap_peap: Session established.  Decoding tunneled attributes (28) eap_peap: PEAP state phase2 (28) eap_peap: EAP method MSCHAPv2 (26) (28) eap_peap: Got tunneled request (28) eap_peap:   EAP-Message = 0x020800061a03 (28) eap_peap: Setting User-Name to CLEARSYSTEM\test1 (28) eap_peap: Sending tunneled request to inner-tunnel (28) eap_peap:   EAP-Message = 0x020800061a03 (28) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1 (28) eap_peap:   User-Name = "CLEARSYSTEM\\test1" (28) eap_peap:   State = 0x67f4154866fc0fc7e3fcab03d0b75466 (28) Virtual server inner-tunnel received request (28)   EAP-Message = 0x020800061a03 (28)   FreeRADIUS-Proxied-To = 127.0.0.1 (28)   User-Name = "CLEARSYSTEM\\test1" (28)   State = 0x67f4154866fc0fc7e3fcab03d0b75466 (28) WARNING: Outer and inner identities are the same.  User privacy is compromised. (28) server inner-tunnel { (28)   session-state: No cached attributes (28)   # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (28)     authorize { (28)       policy filter_username { (28)         if (&User-Name) { (28)         if (&User-Name)  -> TRUE (28)         if (&User-Name)  { (28)           if (&User-Name =~ / /) { (28)           if (&User-Name =~ / /)  -> FALSE (28)           if (&User-Name =~ /@[^@]*@/ ) { (28)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE (28)           if (&User-Name =~ /\.\./ ) { (28)           if (&User-Name =~ /\.\./ )  -> FALSE (28)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (28)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (28)           if (&User-Name =~ /\.$/)  { (28)           if (&User-Name =~ /\.$/)   -> FALSE (28)           if (&User-Name =~ /@\./)  { (28)           if (&User-Name =~ /@\./)   -> FALSE (28)         } # if (&User-Name)  = notfound (28)       } # policy filter_username = notfound (28)       [chap] = noop (28)       [mschap] = noop (28) suffix: Checking for suffix after "@" (28) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (28) suffix: No such realm "NULL" (28)       [suffix] = noop (28) ntdomain: Checking for prefix before "\" (28) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (28) ntdomain: Found realm "CLEARSYSTEM" (28) ntdomain: Adding Stripped-User-Name = "test1" (28) ntdomain: Adding Realm = "CLEARSYSTEM" (28) ntdomain: Authentication realm is LOCAL (28)       [ntdomain] = ok (28)       update control { (28)         &Proxy-To-Realm := LOCAL (28)       } # update control = noop (28) eap: Peer sent EAP Response (code 2) ID 8 length 6 (28) eap: No EAP Start, assuming it's an on-going EAP conversation (28)       [eap] = updated (28) files: Searching for user in group "allusers" rlm_ldap (ldap): Reserved connection (2) (28) files: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (28) files:    --> (uid=test1) (28) files: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (28) files: Waiting for search result... (28) files: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (28) files: Checking user object's memberOf attributes (28) files:   Performing unfiltered search in "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan", scope "base" (28) files:   Waiting for search result... (28) files: Processing memberOf value "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (28) files:   Resolving group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (28) files:   Performing unfiltered search in "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (28) files:   Waiting for search result... (28) files:   Group DN "cn=ftp_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "ftp_plugin" (28) files: Processing memberOf value "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (28) files:   Resolving group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (28) files:   Performing unfiltered search in "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (28) files:   Waiting for search result... (28) files:   Group DN "cn=web_proxy_plugin,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "web_proxy_plugin" (28) files: Processing memberOf value "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (28) files:   Resolving group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (28) files:   Performing unfiltered search in "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (28) files:   Waiting for search result... (28) files:   Group DN "cn=webupload,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "webupload" (28) files: Processing memberOf value "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" as a DN (28) files:   Resolving group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" to group name (28) files:   Performing unfiltered search in "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan", scope "base" (28) files:   Waiting for search result... (28) files:   Group DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan" resolves to name "allusers" (28) files: User found in group "allusers". Comparison between membership: name (resolved from DN "cn=allusers,ou=Groups,ou=Accounts,dc=system,dc=lan"), check: name rlm_ldap (ldap): Released connection (2) (28)       [files] = noop rlm_ldap (ldap): Reserved connection (3) (28) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (28) ldap:    --> (uid=test1) (28) ldap: Performing search in "dc=system,dc=lan" with filter "(uid=test1)", scope "sub" (28) ldap: Waiting for search result... (28) ldap: User object found at DN "cn=test1 test1,ou=Users,ou=Accounts,dc=system,dc=lan" (28) ldap: Processing user attributes (28) ldap: control:Password-With-Header += '{sha}tESsBmE/yNY3lb6a0L6vVQEZNqw=' rlm_ldap (ldap): Released connection (3) (28)       [ldap] = updated (28)       [expiration] = noop (28)       [logintime] = noop (28) pap: Converted: &control:Password-With-Header -> &control:SHA1-Password (28) pap: Removing &control:Password-With-Header (28) pap: Normalizing SHA1-Password from base64 encoding, 28 bytes -> 20 bytes (28) pap: WARNING: Auth-Type already set.  Not setting to PAP (28)       [pap] = noop (28)     } # authorize = updated (28)   Found Auth-Type = eap (28)   # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (28)     authenticate { (28) eap: Expiring EAP session with state 0x67f4154866fc0fc7 (28) eap: Finished EAP session with state 0x67f4154866fc0fc7 (28) eap: Previous EAP request found for state 0x67f4154866fc0fc7, released from the list (28) eap: Peer sent packet with method EAP MSCHAPv2 (26) (28) eap: Calling submodule eap_mschapv2 to process data (28) eap: Sending EAP Success (code 3) ID 8 length 4 (28) eap: Freeing handler (28)       [eap] = ok (28)     } # authenticate = ok (28)   # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel (28)     post-auth { (28)       if (0) { (28)       if (0)  -> FALSE (28)     } # post-auth = noop (28) } # server inner-tunnel (28) Virtual server sending reply (28)   MS-MPPE-Encryption-Policy = Encryption-Allowed (28)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (28)   MS-MPPE-Send-Key = 0xfb5f52a89ab44a864d241d4b18249347 (28)   MS-MPPE-Recv-Key = 0xda830131fe0600676623f4fe3bbd9685 (28)   EAP-Message = 0x03080004 (28)   Message-Authenticator = 0x00000000000000000000000000000000 (28)   Stripped-User-Name = "test1" (28) eap_peap: Got tunneled reply code 2 (28) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed (28) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (28) eap_peap:   MS-MPPE-Send-Key = 0xfb5f52a89ab44a864d241d4b18249347 (28) eap_peap:   MS-MPPE-Recv-Key = 0xda830131fe0600676623f4fe3bbd9685 (28) eap_peap:   EAP-Message = 0x03080004 (28) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (28) eap_peap:   Stripped-User-Name = "test1" (28) eap_peap: Got tunneled reply RADIUS code 2 (28) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed (28) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (28) eap_peap:   MS-MPPE-Send-Key = 0xfb5f52a89ab44a864d241d4b18249347 (28) eap_peap:   MS-MPPE-Recv-Key = 0xda830131fe0600676623f4fe3bbd9685 (28) eap_peap:   EAP-Message = 0x03080004 (28) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000 (28) eap_peap:   Stripped-User-Name = "test1" (28) eap_peap: Tunneled authentication was successful (28) eap_peap: SUCCESS (28) eap: Sending EAP Request (code 1) ID 9 length 46 (28) eap: EAP session adding &reply:State = 0xfa6d51bcf2644896 (28)     [eap] = handled (28)   } # authenticate = handled (28) Using Post-Auth-Type Challenge (28) # Executing group from file /etc/raddb/sites-enabled/default (28)   Challenge { ... } # empty sub-section is ignored (28) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (28)   EAP-Message = 0x0109002e190017030300239fc5de61f40ef795ba8f693d2d93d08ada2e3c4dc8cdf1c2eac7662be4b2d7d3a09444 (28)   Message-Authenticator = 0x00000000000000000000000000000000 (28)   State = 0xfa6d51bcf264489698062bca06912e67 (28) Finished request Waking up in 4.9 seconds. (28) Cleaning up request packet ID 0 with timestamp +53 (29) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 189 (29)   User-Name = "CLEARSYSTEM\\test1" (29)   NAS-IP-Address = 172.22.22.254 (29)   Called-Station-Id = "001601dfe596" (29)   Calling-Station-Id = "74da38d41a8b" (29)   NAS-Identifier = "001601dfe596" (29)   NAS-Port = 5 (29)   Framed-MTU = 1400 (29)   State = 0xfa6d51bcf264489698062bca06912e67 (29)   NAS-Port-Type = Wireless-802.11 (29)   EAP-Message = 0x0209002e190017030300230000000000000004471af753e3bf22745065af3a198931d3ee8a9faeb2d337841e44a2 (29)   Message-Authenticator = 0x75b133c737e069f2748c6b5b9222a581 (29) session-state: No cached attributes (29) # Executing section authorize from file /etc/raddb/sites-enabled/default (29)   authorize { (29)     policy filter_username { (29)       if (&User-Name) { (29)       if (&User-Name)  -> TRUE (29)       if (&User-Name)  { (29)         if (&User-Name =~ / /) { (29)         if (&User-Name =~ / /)  -> FALSE (29)         if (&User-Name =~ /@[^@]*@/ ) { (29)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (29)         if (&User-Name =~ /\.\./ ) { (29)         if (&User-Name =~ /\.\./ )  -> FALSE (29)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (29)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (29)         if (&User-Name =~ /\.$/)  { (29)         if (&User-Name =~ /\.$/)   -> FALSE (29)         if (&User-Name =~ /@\./)  { (29)         if (&User-Name =~ /@\./)   -> FALSE (29)       } # if (&User-Name)  = notfound (29)     } # policy filter_username = notfound (29)     [preprocess] = ok (29)     [chap] = noop (29)     [mschap] = noop (29)     [digest] = noop (29) suffix: Checking for suffix after "@" (29) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (29) suffix: No such realm "NULL" (29)     [suffix] = noop (29) ntdomain: Checking for prefix before "\" (29) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (29) ntdomain: Found realm "CLEARSYSTEM" (29) ntdomain: Adding Stripped-User-Name = "test1" (29) ntdomain: Adding Realm = "CLEARSYSTEM" (29) ntdomain: Authentication realm is LOCAL (29)     [ntdomain] = ok (29) eap: Peer sent EAP Response (code 2) ID 9 length 46 (29) eap: Continuing tunnel setup (29)     [eap] = ok (29)   } # authorize = ok (29) Found Auth-Type = eap (29) # Executing group from file /etc/raddb/sites-enabled/default (29)   authenticate { (29) eap: Expiring EAP session with state 0xfa6d51bcf2644896 (29) eap: Finished EAP session with state 0xfa6d51bcf2644896 (29) eap: Previous EAP request found for state 0xfa6d51bcf2644896, released from the list (29) eap: Peer sent packet with method EAP PEAP (25) (29) eap: Calling submodule eap_peap to process data (29) eap_peap: Continuing EAP-TLS (29) eap_peap: [eaptls verify] = ok (29) eap_peap: Done initial handshake (29) eap_peap: [eaptls process] = ok (29) eap_peap: Session established.  Decoding tunneled attributes (29) eap_peap: PEAP state send tlv success (29) eap_peap: Received EAP-TLV response (29) eap_peap: Success (29) eap: Sending EAP Success (code 3) ID 9 length 4 (29) eap: Freeing handler (29)     [eap] = ok (29)   } # authenticate = ok (29) # Executing section post-auth from file /etc/raddb/sites-enabled/default (29)   post-auth { (29)     update { (29)       No attributes updated (29)     } # update = noop (29)     [exec] = noop (29)     policy remove_reply_message_if_eap { (29)       if (&reply:EAP-Message && &reply:Reply-Message) { (29)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE (29)       else { (29)         [noop] = noop (29)       } # else = noop (29)     } # policy remove_reply_message_if_eap = noop (29)   } # post-auth = noop (29) Sent Access-Accept Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (29)   MS-MPPE-Recv-Key = 0x3a2a679722b005acbb715114d8a3916f36531e4efb83c3158fb73a7e0d95a8cd (29)   MS-MPPE-Send-Key = 0x73e2a159504c68f4b2a9b09c2cd3eda884da46f07bb478c2f637de7986d02c05 (29)   EAP-Message = 0x03090004 (29)   Message-Authenticator = 0x00000000000000000000000000000000 (29) Finished request Waking up in 4.9 seconds. (29) Cleaning up request packet ID 0 with timestamp +53 Ready to process requests (30) Received Access-Request Id 0 from 172.22.22.254:2049 to 172.22.22.1:1812 length 147 (30)   User-Name = "CLEARSYSTEM\\test1" (30)   NAS-IP-Address = 172.22.22.254 (30)   Called-Station-Id = "001601dfe596" (30)   Calling-Station-Id = "74da38d41a8b" (30)   NAS-Identifier = "001601dfe596" (30)   NAS-Port = 5 (30)   Framed-MTU = 1400 (30)   NAS-Port-Type = Wireless-802.11 (30)   EAP-Message = 0x0200001601434c45415253595354454d5c7465737431 (30)   Message-Authenticator = 0x26a6a6e06a663a4348a73e61f6370656 (30) # Executing section authorize from file /etc/raddb/sites-enabled/default (30)   authorize { (30)     policy filter_username { (30)       if (&User-Name) { (30)       if (&User-Name)  -> TRUE (30)       if (&User-Name)  { (30)         if (&User-Name =~ / /) { (30)         if (&User-Name =~ / /)  -> FALSE (30)         if (&User-Name =~ /@[^@]*@/ ) { (30)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE (30)         if (&User-Name =~ /\.\./ ) { (30)         if (&User-Name =~ /\.\./ )  -> FALSE (30)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  { (30)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE (30)         if (&User-Name =~ /\.$/)  { (30)         if (&User-Name =~ /\.$/)   -> FALSE (30)         if (&User-Name =~ /@\./)  { (30)         if (&User-Name =~ /@\./)   -> FALSE (30)       } # if (&User-Name)  = notfound (30)     } # policy filter_username = notfound (30)     [preprocess] = ok (30)     [chap] = noop (30)     [mschap] = noop (30)     [digest] = noop (30) suffix: Checking for suffix after "@" (30) suffix: No '@' in User-Name = "CLEARSYSTEM\test1", looking up realm NULL (30) suffix: No such realm "NULL" (30)     [suffix] = noop (30) ntdomain: Checking for prefix before "\" (30) ntdomain: Looking up realm "CLEARSYSTEM" for User-Name = "CLEARSYSTEM\test1" (30) ntdomain: Found realm "CLEARSYSTEM" (30) ntdomain: Adding Stripped-User-Name = "test1" (30) ntdomain: Adding Realm = "CLEARSYSTEM" (30) ntdomain: Authentication realm is LOCAL (30)     [ntdomain] = ok (30) eap: Peer sent EAP Response (code 2) ID 0 length 22 (30) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (30)     [eap] = ok (30)   } # authorize = ok (30) Found Auth-Type = eap (30) # Executing group from file /etc/raddb/sites-enabled/default (30)   authenticate { (30) eap: Peer sent packet with method EAP Identity (1) (30) eap: Calling submodule eap_peap to process data (30) eap_peap: Initiating new EAP-TLS session (30) eap_peap: [eaptls start] = request (30) eap: Sending EAP Request (code 1) ID 1 length 6 (30) eap: EAP session adding &reply:State = 0x436131c543602893 (30)     [eap] = handled (30)   } # authenticate = handled (30) Using Post-Auth-Type Challenge (30) # Executing group from file /etc/raddb/sites-enabled/default (30)   Challenge { ... } # empty sub-section is ignored (30) Sent Access-Challenge Id 0 from 172.22.22.1:1812 to 172.22.22.254:2049 length 0 (30)   EAP-Message = 0x010100061920 (30)   Message-Authenticator = 0x00000000000000000000000000000000 (30)   State = 0x436131c543602893bb7dfeada35c18c4 (30) Finished request Waking up in 4.9 seconds. I'm afraid I don't see what is going wrong and any pointers would be welcome. Thanks, Nick