Hi, I have installed latest RPM of freeradius from https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ on centos 7. Below are the list of installed RPMs. freeradius-mysql-3.0.21-8.1.x86_64 freeradius-config-3.0.21-8.1.x86_64 freeradius-unixODBC-3.0.21-8.1.x86_64 freeradius-utils-3.0.21-8.1.x86_64 freeradius-3.0.21-8.1.x86_64 freeradius-perl-3.0.21-8.1.x86_64 After fresh install when I start radius in debug mode, it gives me below errors of auth and acct protocol. Mon Sep 28 16:34:26 2020 : Debug: Created signal pipe. Read end FD 5, write end FD 6 Mon Sep 28 16:34:26 2020 : Debug: radiusd: #### Opening IP addresses and Ports #### Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = * Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path: /usr/lib64/freeradius/proto_acct.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed: /usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "acct" Mon Sep 28 16:34:26 2020 : Debug: ipv6addr = :: Mon Sep 28 16:34:26 2020 : Debug: port = 0 Mon Sep 28 16:34:26 2020 : Debug: limit { Mon Sep 28 16:34:26 2020 : Debug: max_connections = 16 Mon Sep 28 16:34:26 2020 : Debug: lifetime = 0 Mon Sep 28 16:34:26 2020 : Debug: idle_timeout = 30 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path: /usr/lib64/freeradius/proto_auth.so Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed: /usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No such file or directory - No such file or directory Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search path(s) Mon Sep 28 16:34:26 2020 : Debug: Defaults : /lib:/usr/lib Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so: cannot open shared object file: No such file or directory Mon Sep 28 16:34:26 2020 : Debug: listen { Mon Sep 28 16:34:26 2020 : Debug: type = "auth" Mon Sep 28 16:34:26 2020 : Debug: ipaddr = 127.0.0.1 Mon Sep 28 16:34:26 2020 : Debug: port = 18120 Mon Sep 28 16:34:26 2020 : Debug: } Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address * port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address * port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address :: port 1812 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address :: port 1813 bound to server default Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address * port 34165' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address * port 34165 Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address :: port 59302' Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address :: port 59302 Mon Sep 28 16:34:26 2020 : Info: Ready to process requests Need your advise. --
Hi Freeradius Users List, Autentication works as per deployingradius Thank you, now I need accounting packets forwarded to a nother Radius box via replicate module, is this possible? Regards
On Sep 28, 2020, at 6:33 AM, Linux Threads <linuxthreads@gmail.com> wrote:
Hi Freeradius Users List,
It's generally best to start your own thread, instead of replying to someone else message.
Autentication works as per deployingradius Thank you, now I need accounting packets forwarded to a nother Radius box via replicate module, is this possible?
Yes. It's documented. Do you have a *specific* question about how to do it, or about the documentation? Alan DeKok.
Hi, Thank you for taking the time, On Mon, 2020-09-28 at 07:41 -0400, Alan DeKok wrote:
On Sep 28, 2020, at 6:33 AM, Linux Threads <linuxthreads@gmail.com> wrote:
Hi Freeradius Users List,
It's generally best to start your own thread, instead of replying to someone else message.
Autentication works as per deployingradius Thank you, now I need accounting packets forwarded to a nother Radius box via replicate module, is this possible?
Yes.
It's documented.
the replicate module says that it works the same way as proxy
Do you have a *specific* question about how to do it, or about the documentation?
the user only authenticate with the nt-domain username, how is this tied to a realm? Mon Sep 28 09:46:43 2020 : Debug: # Loading accounting {...} Mon Sep 28 09:46:43 2020 : Debug: replicate Mon Sep 28 09:46:43 2020 : Debug: update { Mon Sep 28 09:46:43 2020 : Debug: &control:Replicate-To-Realm := "CLIENT-ACCT-REALM" replicate config file: replicate { home_server CLIENT-ACCT-SERVER { type = acct ipaddr = 192.168.1.1 src_ipaddr = 192.168.1.241 port = 1813 secret = replicate-acct require_message_authenticator = yes } home_server_pool CLIENT-ACCT-SERVER-POOL { type = fail-over home_server = CLIENT-ACCT-SERVER } realm CLIENT-ACCT-REALM { type = radius pool = CLIENT-ACCT-SERVER-POOL nosprip } } sites-enabled/default accounting { replicate update control { &Replicate-to-Realm := "CLIENT-ACCT-REALM" if I place replicate module above update control or below it does not matter same effect I can get freeradius to send with the following command but I geuss it does not come from the nas client "echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123 Received response ID 21, code 5, length = 20" Mon Sep 28 14:06:42 2020 : Debug: (33) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default Mon Sep 28 14:06:42 2020 : Debug: (33) accounting { Mon Sep 28 14:06:42 2020 : Debug: (33) modsingle[accounting]: calling replicate (rlm_replicate) Mon Sep 28 14:06:42 2020 : Debug: (33) modsingle[accounting]: returned from replicate (rlm_replicate) Mon Sep 28 14:06:42 2020 : Debug: (33) [replicate] = noop Mon Sep 28 14:06:42 2020 : Debug: (33) update control { Mon Sep 28 14:06:42 2020 : Debug: (33) &Replicate-to- Realm := "CLIENT-ACCT-REALM" Mon Sep 28 14:06:42 2020 : Debug: (33) } # update control = noop Mon Sep 28 14:06:42 2020 : Debug: (33) modsingle[accounting]: calling detail (rlm_detail) Mon Sep 28 14:25:29 2020 : Debug: (2) detail: --> /var/log/freeradius/radacct/127.0.0.1/detail-20200928 Mon Sep 28 14:25:29 2020 Message-Authenticator = 0x4e938c9236a109448204634f7930a20d NAS-IP-Address = 127.0.0.1 Event-Timestamp = "Sep 28 2020 14:25:29 SAST" Tmp-String-9 = "ai:" Acct-Unique-Session-Id = "a90afff2a77f213d484c7ec2be0d0330" Timestamp = 1601295929
Alan DeKok.
Regards
On Sep 28, 2020, at 8:32 AM, Linux Threads <linuxthreads@gmail.com> wrote:
the replicate module says that it works the same way as proxy
No, it doesn't. The documentation explicitly says that it's not the same as proxying. It's similar, but not "the same".
Do you have a *specific* question about how to do it, or about the documentation?
the user only authenticate with the nt-domain username, how is this tied to a realm?
via the Replicate-To-Realm attribute... as the documentation says. The documentation says how to use the "replicate" module. If you try to do anything else, it won't work.
Mon Sep 28 09:46:43 2020 : Debug: # Loading accounting {...} Mon Sep 28 09:46:43 2020 : Debug: replicate Mon Sep 28 09:46:43 2020 : Debug: update { Mon Sep 28 09:46:43 2020 : Debug: &control:Replicate-To-Realm := "CLIENT-ACCT-REALM"
replicate config file: replicate {
home_server CLIENT-ACCT-SERVER {
No, you can't invent configuration and expect it to work. You can't put "home_server" into the configuration for the replicate module. Read the debug output... it will show you that it is NOT loading the "CLIENT-ACCT-SERVER" configuration. Realms and home_servers go into proxy.conf. Alan DeKok.
Hi Guys, I am still not winning, for replication: the home server, home server pool and the realm are configured in proxy.conf replicate should be listed in sites-enabled/"site" either under the below sections depending on requirements I am using accounting: authorize accounting preacct pre-proxy recv-coa and control I have listed it under accounting: update control { &Replicate-to-Realm := "REALM-NAME" } do I leave mods-enabled/replicate as is? replicate { } if a user auths with username or nt-domain\username, it does not replicate, the only time it send packets to home server is when I use: echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123 Received response ID 21, code 5, length = 20 replicate is loaded: Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_replicate, checking if it's valid Wed Sep 30 09:02:45 2020 : Debug: # Loaded module rlm_replicate Wed Sep 30 09:02:45 2020 : Debug: # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_realm, checking if it's valid I have no otherway of testing this exept if I auth against the AP Thanks in advance On Mon, 2020-09-28 at 08:55 -0400, Alan DeKok wrote:
the replicate module says that it works the same way as proxy
No, it doesn't. The documentation explicitly says that it's not the same as proxying. It's similar, but not "the same".
Do you have a *specific* question about how to do it, or about the documentation?
the user only authenticate with the nt-domain username, how is this tied to a realm?
via the Replicate-To-Realm attribute... as the documentation says.
The documentation says how to use the "replicate" module. If you try to do anything else, it won't work.
Mon Sep 28 09:46:43 2020 : Debug: # Loading accounting {...} Mon Sep 28 09:46:43 2020 : Debug: replicate Mon Sep 28 09:46:43 2020 : Debug: update { Mon Sep 28 09:46:43 2020 : Debug: &control:Replicate-To-Realm := "CLIENT-ACCT-REALM"
replicate config file: replicate {
home_server CLIENT-ACCT-SERVER {
No, you can't invent configuration and expect it to work.
You can't put "home_server" into the configuration for the replicate module.
Read the debug output... it will show you that it is NOT loading the "CLIENT-ACCT-SERVER" configuration.
Realms and home_servers go into proxy.conf.
Alan DeKok.
On Sep 30, 2020, at 8:31 AM, Linux Threads <linuxthreads@gmail.com> wrote:
for replication: the home server, home server pool and the realm are configured in proxy.conf
That's good.
replicate should be listed in sites-enabled/"site" either under the below sections depending on requirements I am using accounting:
OK.
and control I have listed it under accounting:
update control { &Replicate-to-Realm := "REALM-NAME" }
do I leave mods-enabled/replicate as is?
Yes. That's the default configuration for the module. The documentation makes it clear what you need to do.
if a user auths with username or nt-domain\username, it does not replicate,
So.... where is the debug output?
the only time it send packets to home server is when I use:
echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123 Received response ID 21, code 5, length = 20
replicate is loaded:
Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_replicate, checking if it's valid
Don't use "radiusd -Xxx".
I have no otherway of testing this exept if I auth against the AP
You can run the server in debugging mode to see the packets from the AP. Then, copy the packets, and resend them using radclient. And PLEASE read http://wiki.freeradius.org/list-help ALL of the documentation says to run the server in debugging mode, and post the output to the list. The above page also links to another page which explains how to read the output of "radiusd -X". When you ignore the documentation, you're wasting your time and ours. We wrote the documentation in order to help people. If you want help, READ THE DOCS, and FOLLOW THE INSTRUCTIONS. Alan DeKok.
HI, thanks for your effords thus far; what is strange is that the radius server is sending an arp request for the homeserver I have configured not sure if it is related, as requested here is the debug output sudo freeradius -X FreeRADIUS Version 3.0.17 Copyright (C) 1999-2017 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/share/freeradius/dictionary including dictionary file /usr/share/freeradius/dictionary.dhcp including dictionary file /usr/share/freeradius/dictionary.vqp including dictionary file /etc/freeradius/3.0/dictionary including configuration file /etc/freeradius/3.0/radiusd.conf including configuration file /etc/freeradius/3.0/proxy.conf including configuration file /etc/freeradius/3.0/clients.conf including files in directory /etc/freeradius/3.0/mods-enabled/ including configuration file /etc/freeradius/3.0/mods-enabled/always including configuration file /etc/freeradius/3.0/mods- enabled/attr_filter including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap including configuration file /etc/freeradius/3.0/mods-enabled/chap including configuration file /etc/freeradius/3.0/mods-enabled/date including configuration file /etc/freeradius/3.0/mods-enabled/detail including configuration file /etc/freeradius/3.0/mods- enabled/detail.log including configuration file /etc/freeradius/3.0/mods- enabled/dynamic_clients including configuration file /etc/freeradius/3.0/mods-enabled/eap including configuration file /etc/freeradius/3.0/mods-enabled/echo including configuration file /etc/freeradius/3.0/mods-enabled/exec including configuration file /etc/freeradius/3.0/mods- enabled/expiration including configuration file /etc/freeradius/3.0/mods-enabled/expr including configuration file /etc/freeradius/3.0/mods-enabled/files including configuration file /etc/freeradius/3.0/mods-enabled/linelog including configuration file /etc/freeradius/3.0/mods-enabled/logintime including configuration file /etc/freeradius/3.0/mods-enabled/passwd including configuration file /etc/freeradius/3.0/mods- enabled/preprocess including configuration file /etc/freeradius/3.0/mods-enabled/radutmp including configuration file /etc/freeradius/3.0/mods-enabled/soh including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp including configuration file /etc/freeradius/3.0/mods-enabled/unix including configuration file /etc/freeradius/3.0/mods-enabled/unpack including configuration file /etc/freeradius/3.0/mods-enabled/utf8 including configuration file /etc/freeradius/3.0/mods-enabled/perl including configuration file /etc/freeradius/3.0/mods-enabled/pap including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth including configuration file /etc/freeradius/3.0/mods-enabled/mschap including configuration file /etc/freeradius/3.0/mods-enabled/digest including configuration file /etc/freeradius/3.0/mods-enabled/replicate including configuration file /etc/freeradius/3.0/mods-enabled/realm including files in directory /etc/freeradius/3.0/policy.d/ including configuration file /etc/freeradius/3.0/policy.d/abfab-tr including configuration file /etc/freeradius/3.0/policy.d/accounting including configuration file /etc/freeradius/3.0/policy.d/accounting.dpkg-old including configuration file /etc/freeradius/3.0/policy.d/canonicalization including configuration file /etc/freeradius/3.0/policy.d/control including configuration file /etc/freeradius/3.0/policy.d/cui including configuration file /etc/freeradius/3.0/policy.d/debug including configuration file /etc/freeradius/3.0/policy.d/dhcp including configuration file /etc/freeradius/3.0/policy.d/eap including configuration file /etc/freeradius/3.0/policy.d/filter including configuration file /etc/freeradius/3.0/policy.d/moonshot- targeted-ids including configuration file /etc/freeradius/3.0/policy.d/moonshot- targeted-ids.dpkg-old including configuration file /etc/freeradius/3.0/policy.d/operator-name including configuration file /etc/freeradius/3.0/policy.d/rfc7542 including files in directory /etc/freeradius/3.0/sites-enabled/ including configuration file /etc/freeradius/3.0/sites-enabled/inner- tunnel including configuration file /etc/freeradius/3.0/sites-enabled/default main { security { user = "freerad" group = "freerad" allow_core_dumps = no } name = "freeradius" prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" } main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 16384 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no colourise = yes msg_denied = "You are already logged in - access denied" } resources { } security { max_attributes = 200 reject_delay = 1.000000 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <<< secret >>> response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 120 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server CLIENT-ACCT-SERVER { ipaddr = 192.168.1.1 port = 1813 type = "acct" secret = <<< secret >>> src_ipaddr = "192.168.1.241" response_window = 30.000000 response_timeouts = 1 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_timeout = 4 num_answers_to_alive = 3 revive_interval = 300 limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } home_server_pool CLIENT-ACCT-SERVER-POOL { type = fail-over home_server = CLIENT-ACCT-SERVER } realm CLIENT-ACCT-REALM { acct_pool = CLIENT-ACCT-SERVER-POOL } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <<< secret >>> nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client localhost_ipv6 { ipv6addr = ::1 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } client CLIENT-TEST-AP { ipaddr = 10.0.1.241 require_message_authenticator = no secret = <<< secret >>> limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Debugger not attached # Creating Auth-Type = mschap # Creating Auth-Type = eap # Creating Auth-Type = PAP # Creating Auth-Type = CHAP # Creating Auth-Type = MS-CHAP # Creating Auth-Type = NTLM # Creating Auth-Type = digest radiusd: #### Instantiating modules #### modules { # Loaded module rlm_always # Loading module "reject" from file /etc/freeradius/3.0/mods- enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Loading module "fail" from file /etc/freeradius/3.0/mods- enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Loading module "ok" from file /etc/freeradius/3.0/mods- enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loading module "handled" from file /etc/freeradius/3.0/mods- enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Loading module "invalid" from file /etc/freeradius/3.0/mods- enabled/always always invalid { rcode = "invalid" simulcount = 0 mpp = no } # Loading module "userlock" from file /etc/freeradius/3.0/mods- enabled/always always userlock { rcode = "userlock" simulcount = 0 mpp = no } # Loading module "notfound" from file /etc/freeradius/3.0/mods- enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Loading module "noop" from file /etc/freeradius/3.0/mods- enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Loading module "updated" from file /etc/freeradius/3.0/mods- enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Loaded module rlm_attr_filter # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/post- proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre- proxy" key = "%{Realm}" relaxed = no } # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/etc/freeradius/3.0/mods- config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/etc/freeradius/3.0/mods- config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/etc/freeradius/3.0/mods- config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } # Loaded module rlm_cache # Loading module "cache_eap" from file /etc/freeradius/3.0/mods- enabled/cache_eap cache cache_eap { driver = "rlm_cache_rbtree" key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 0 epoch = 0 add_stats = no } # Loaded module rlm_chap # Loading module "chap" from file /etc/freeradius/3.0/mods- enabled/chap # Loaded module rlm_date # Loading module "date" from file /etc/freeradius/3.0/mods- enabled/date date { format = "%b %e %Y %H:%M:%S %Z" utc = no } # Loading module "wispr2date" from file /etc/freeradius/3.0/mods- enabled/date date wispr2date { format = "%Y-%m-%dT%H:%M:%S" utc = no } # Loaded module rlm_detail # Loading module "detail" from file /etc/freeradius/3.0/mods- enabled/detail detail { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP- Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "auth_log" from file /etc/freeradius/3.0/mods- enabled/detail.log detail auth_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP- Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "reply_log" from file /etc/freeradius/3.0/mods- enabled/detail.log detail reply_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP- Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods- enabled/detail.log detail pre_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP- Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods- enabled/detail.log detail post_proxy_log { filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP- Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 locking = no escape_filenames = no log_packet_header = no } # Loaded module rlm_dynamic_clients # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients # Loaded module rlm_eap # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 16384 } # Loaded module rlm_exec # Loading module "echo" from file /etc/freeradius/3.0/mods- enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Loading module "exec" from file /etc/freeradius/3.0/mods- enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_expiration # Loading module "expiration" from file /etc/freeradius/3.0/mods- enabled/expiration # Loaded module rlm_expr # Loading module "expr" from file /etc/freeradius/3.0/mods- enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" } # Loaded module rlm_files # Loading module "files" from file /etc/freeradius/3.0/mods- enabled/files files { filename = "/etc/freeradius/3.0/mods-config/files/authorize" acctusersfile = "/etc/freeradius/3.0/mods- config/files/accounting" preproxy_usersfile = "/etc/freeradius/3.0/mods- config/files/pre-proxy" } # Loaded module rlm_linelog # Loading module "linelog" from file /etc/freeradius/3.0/mods- enabled/linelog linelog { filename = "/var/log/freeradius/linelog" escape_filenames = no syslog_severity = "info" permissions = 384 format = "This is a log message for %{User-Name}" reference = "messages.%{%{reply:Packet-Type}:-default}" } # Loading module "log_accounting" from file /etc/freeradius/3.0/mods- enabled/linelog linelog log_accounting { filename = "/var/log/freeradius/linelog-accounting" escape_filenames = no syslog_severity = "info" permissions = 384 format = "" reference = "Accounting-Request.%{%{Acct-Status-Type}:- unknown}" } # Loaded module rlm_logintime # Loading module "logintime" from file /etc/freeradius/3.0/mods- enabled/logintime logintime { minimum_timeout = 60 } # Loaded module rlm_passwd # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods- enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } # Loaded module rlm_preprocess # Loading module "preprocess" from file /etc/freeradius/3.0/mods- enabled/preprocess preprocess { huntgroups = "/etc/freeradius/3.0/mods- config/preprocess/huntgroups" hints = "/etc/freeradius/3.0/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } # Loaded module rlm_radutmp # Loading module "radutmp" from file /etc/freeradius/3.0/mods- enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Loaded module rlm_soh # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh soh { dhcp = yes } # Loading module "sradutmp" from file /etc/freeradius/3.0/mods- enabled/sradutmp radutmp sradutmp { filename = "/var/log/freeradius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_unix # Loading module "unix" from file /etc/freeradius/3.0/mods- enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Creating attribute Unix-Group # Loaded module rlm_unpack # Loading module "unpack" from file /etc/freeradius/3.0/mods- enabled/unpack # Loaded module rlm_utf8 # Loading module "utf8" from file /etc/freeradius/3.0/mods- enabled/utf8 # Loaded module rlm_perl # Loading module "perl" from file /etc/freeradius/3.0/mods- enabled/perl perl { filename = "/etc/freeradius/3.0/mods-config/perl/example.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_post_auth = "post_auth" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_recv_coa = "recv_coa" func_send_coa = "send_coa" perl_flags = "-T" } # Loaded module rlm_pap # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap pap { normalise = yes } # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods- enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=client- nt-domain --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_mschap # Loading module "mschap" from file /etc/freeradius/3.0/mods- enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key -- username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:- client-nt-domain} --challenge=%{mschap:Challenge:-00} --nt- response=%{mschap:NT-Response:-00}" passchange { } allow_retry = yes winbind_retry_with_normalised_username = no } # Loaded module rlm_digest # Loading module "digest" from file /etc/freeradius/3.0/mods- enabled/digest # Loaded module rlm_replicate # Loading module "replicate" from file /etc/freeradius/3.0/mods- enabled/replicate # Loaded module rlm_realm # Loading module "IPASS" from file /etc/freeradius/3.0/mods- enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Loading module "suffix" from file /etc/freeradius/3.0/mods- enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Loading module "bangpath" from file /etc/freeradius/3.0/mods- enabled/realm realm bangpath { format = "prefix" delimiter = "!" ignore_default = no ignore_null = no } # Loading module "realmpercent" from file /etc/freeradius/3.0/mods- enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Loading module "ntdomain" from file /etc/freeradius/3.0/mods- enabled/realm realm ntdomain { format = "prefix" delimiter = "\\" ignore_default = no ignore_null = no } instantiate { } # Instantiating module "reject" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "fail" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "ok" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "handled" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "invalid" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "userlock" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "notfound" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "noop" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "updated" from file /etc/freeradius/3.0/mods- enabled/always # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post- proxy # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre- proxy # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods- config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods- config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter reading pairlist file /etc/freeradius/3.0/mods- config/attr_filter/accounting_response # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked # Instantiating module "detail" from file /etc/freeradius/3.0/mods- enabled/detail # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods- enabled/detail.log rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log # Instantiating module "eap" from file /etc/freeradius/3.0/mods- enabled/eap # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { verify_depth = 0 ca_path = "/etc/freeradius/3.0/certs" pem_file_type = yes private_key_file = "/etc/freeradius/3.0/certs/server.pem" certificate_file = "/etc/freeradius/3.0/certs/server.pem" ca_file = "/etc/freeradius/3.0/certs/ca.pem" private_key_password = <<< secret >>> dh_file = "/etc/freeradius/3.0/certs/dh" fragment_size = 1024 include_length = yes auto_chain = yes check_crl = no check_all_crl = no cipher_list = "DEFAULT" cipher_server_preference = no ecdh_curve = "prime256v1" disable_tlsv1 = yes disable_tlsv1_1 = yes tls_max_version = "1.2" tls_min_version = "1.2" cache { enable = no lifetime = 24 max_entries = 255 } verify { skip_if_ocsp_ok = no } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Please use tls_min_version and tls_max_version instead of disable_tlsv1 Please use tls_min_version and tls_max_version instead of disable_tlsv1_2 # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } tls: Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration # Instantiating module "files" from file /etc/freeradius/3.0/mods- enabled/files reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy # Instantiating module "linelog" from file /etc/freeradius/3.0/mods- enabled/linelog # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess reading pairlist file /etc/freeradius/3.0/mods- config/preprocess/huntgroups reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints # Instantiating module "perl" from file /etc/freeradius/3.0/mods- enabled/perl # Instantiating module "pap" from file /etc/freeradius/3.0/mods- enabled/pap # Instantiating module "mschap" from file /etc/freeradius/3.0/mods- enabled/mschap rlm_mschap (mschap): authenticating by calling 'ntlm_auth' # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods- enabled/realm # Instantiating module "suffix" from file /etc/freeradius/3.0/mods- enabled/realm # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods- enabled/realm # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods- enabled/realm } # modules radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/3.0/radiusd.conf } # server server inner-tunnel { # from file /etc/freeradius/3.0/sites- enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} Ignoring "sql" (see raddb/mods-available/README.rst) Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} # Skipping contents of 'if' as it is always 'false' -- /etc/freeradius/3.0/sites-enabled/inner-tunnel:341 } # server inner-tunnel server default { # from file /etc/freeradius/3.0/sites-enabled/default # Loading authenticate {...} # Loading authorize {...} # Loading preacct {...} # Loading accounting {...} # Loading post-proxy {...} # Loading post-auth {...} } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "auth" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipv6addr = :: port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 bound to server inner- tunnel Listening on auth address * port 1812 bound to server default Listening on acct address * port 1813 bound to server default Listening on auth address :: port 1812 bound to server default Listening on acct address :: port 1813 bound to server default Listening on proxy address * port 37028 Listening on proxy address :: port 51490 Ready to process requests (0) Received Access-Request Id 187 from 10.0.1.241:32768 to 192.168.1.241:1812 length 141 (0) User-Name = "client-test-user" (0) NAS-IP-Address = 10.0.1.241 (0) NAS-Port = 0 (0) Called-Station-Id = "60-03-47-12-C5-7F" (0) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) EAP-Message = 0x02010015016173747574652d746573742d75736572 (0) Message-Authenticator = 0xa99423b63e9e814224134870e99ec71d (0) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> FALSE (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (0) if (&User-Name =~ /\.$/) { (0) if (&User-Name =~ /\.$/) -> FALSE (0) if (&User-Name =~ /@\./) { (0) if (&User-Name =~ /@\./) -> FALSE (0) } # if (&User-Name) = notfound (0) } # policy filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix: Checking for suffix after "@" (0) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (0) suffix: No such realm "NULL" (0) [suffix] = noop (0) eap: Peer sent EAP Response (code 2) ID 1 length 21 (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = eap (0) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (0) authenticate { (0) eap: Peer sent packet with method EAP Identity (1) (0) eap: Calling submodule eap_md5 to process data (0) eap_md5: Issuing MD5 Challenge (0) eap: Sending EAP Request (code 1) ID 2 length 22 (0) eap: EAP session adding &reply:State = 0x2f19408c2f1b44c6 (0) [eap] = handled (0) } # authenticate = handled (0) Using Post-Auth-Type Challenge (0) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (0) Challenge { ... } # empty sub-section is ignored (0) Sent Access-Challenge Id 187 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (0) EAP-Message = 0x010200160410ac3f54d14b3a4f03c3401d8309dc1cec (0) Message-Authenticator = 0x00000000000000000000000000000000 (0) State = 0x2f19408c2f1b44c676c2fe7afaf965a8 (0) Finished request Waking up in 4.9 seconds. (1) Received Access-Request Id 188 from 10.0.1.241:32768 to 192.168.1.241:1812 length 144 (1) User-Name = "client-test-user" (1) NAS-IP-Address = 10.0.1.241 (1) NAS-Port = 0 (1) Called-Station-Id = "60-03-47-12-C5-7F" (1) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (1) Framed-MTU = 1400 (1) NAS-Port-Type = Wireless-802.11 (1) EAP-Message = 0x020200060319 (1) State = 0x2f19408c2f1b44c676c2fe7afaf965a8 (1) Message-Authenticator = 0x3e36f0495ca757e9c65b6c20dd2331c0 (1) session-state: No cached attributes (1) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (1) authorize { (1) policy filter_username { (1) if (&User-Name) { (1) if (&User-Name) -> TRUE (1) if (&User-Name) { (1) if (&User-Name =~ / /) { (1) if (&User-Name =~ / /) -> FALSE (1) if (&User-Name =~ /@[^@]*@/ ) { (1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (1) if (&User-Name =~ /\.\./ ) { (1) if (&User-Name =~ /\.\./ ) -> FALSE (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (1) if (&User-Name =~ /\.$/) { (1) if (&User-Name =~ /\.$/) -> FALSE (1) if (&User-Name =~ /@\./) { (1) if (&User-Name =~ /@\./) -> FALSE (1) } # if (&User-Name) = notfound (1) } # policy filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix: Checking for suffix after "@" (1) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (1) suffix: No such realm "NULL" (1) [suffix] = noop (1) eap: Peer sent EAP Response (code 2) ID 2 length 6 (1) eap: No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (1) pap: WARNING: Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = eap (1) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (1) authenticate { (1) eap: Expiring EAP session with state 0x2f19408c2f1b44c6 (1) eap: Finished EAP session with state 0x2f19408c2f1b44c6 (1) eap: Previous EAP request found for state 0x2f19408c2f1b44c6, released from the list (1) eap: Peer sent packet with method EAP NAK (3) (1) eap: Found mutually acceptable type PEAP (25) (1) eap: Calling submodule eap_peap to process data (1) eap_peap: Initiating new EAP-TLS session (1) eap_peap: [eaptls start] = request (1) eap: Sending EAP Request (code 1) ID 3 length 6 (1) eap: EAP session adding &reply:State = 0x2f19408c2e1a59c6 (1) [eap] = handled (1) } # authenticate = handled (1) Using Post-Auth-Type Challenge (1) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (1) Challenge { ... } # empty sub-section is ignored (1) Sent Access-Challenge Id 188 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (1) EAP-Message = 0x010300061920 (1) Message-Authenticator = 0x00000000000000000000000000000000 (1) State = 0x2f19408c2e1a59c676c2fe7afaf965a8 (1) Finished request Waking up in 4.9 seconds. (2) Received Access-Request Id 189 from 10.0.1.241:32768 to 192.168.1.241:1812 length 310 (2) User-Name = "client-test-user" (2) NAS-IP-Address = 10.0.1.241 (2) NAS-Port = 0 (2) Called-Station-Id = "60-03-47-12-C5-7F" (2) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (2) Framed-MTU = 1400 (2) NAS-Port-Type = Wireless-802.11 (2) EAP-Message = 0x020300ac1980000000a2160303009d0100009903035f7590d6bd503a391b92654f49a c436d073b3e922a2c5e3369776b0b75eddadc00002ac02cc02bc030c02f009f009ec024 c023c028c027c00ac009c014c013009d009c003d003c0035002f000a010000460005000 50100000000000a00080006001d (2) State = 0x2f19408c2e1a59c676c2fe7afaf965a8 (2) Message-Authenticator = 0xb44537a405aed36e10fd26ff1212ec81 (2) session-state: No cached attributes (2) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (2) authorize { (2) policy filter_username { (2) if (&User-Name) { (2) if (&User-Name) -> TRUE (2) if (&User-Name) { (2) if (&User-Name =~ / /) { (2) if (&User-Name =~ / /) -> FALSE (2) if (&User-Name =~ /@[^@]*@/ ) { (2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (2) if (&User-Name =~ /\.\./ ) { (2) if (&User-Name =~ /\.\./ ) -> FALSE (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (2) if (&User-Name =~ /\.$/) { (2) if (&User-Name =~ /\.$/) -> FALSE (2) if (&User-Name =~ /@\./) { (2) if (&User-Name =~ /@\./) -> FALSE (2) } # if (&User-Name) = notfound (2) } # policy filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix: Checking for suffix after "@" (2) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (2) suffix: No such realm "NULL" (2) [suffix] = noop (2) eap: Peer sent EAP Response (code 2) ID 3 length 172 (2) eap: Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = eap (2) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (2) authenticate { (2) eap: Expiring EAP session with state 0x2f19408c2e1a59c6 (2) eap: Finished EAP session with state 0x2f19408c2e1a59c6 (2) eap: Previous EAP request found for state 0x2f19408c2e1a59c6, released from the list (2) eap: Peer sent packet with method EAP PEAP (25) (2) eap: Calling submodule eap_peap to process data (2) eap_peap: Continuing EAP-TLS (2) eap_peap: Peer indicated complete TLS record size will be 162 bytes (2) eap_peap: Got complete TLS record (162 bytes) (2) eap_peap: [eaptls verify] = length included (2) eap_peap: (other): before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: TLS_accept: before SSL initialization (2) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 009d] (2) eap_peap: TLS_accept: SSLv3/TLS read client hello (2) eap_peap: >>> send TLS 1.2 [length 003d] (2) eap_peap: TLS_accept: SSLv3/TLS write server hello (2) eap_peap: >>> send TLS 1.2 [length 08bf] (2) eap_peap: TLS_accept: SSLv3/TLS write certificate (2) eap_peap: >>> send TLS 1.2 [length 014d] (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange (2) eap_peap: >>> send TLS 1.2 [length 0004] (2) eap_peap: TLS_accept: SSLv3/TLS write server done (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (2) eap_peap: In SSL Handshake Phase (2) eap_peap: In SSL Accept mode (2) eap_peap: [eaptls process] = handled (2) eap: Sending EAP Request (code 1) ID 4 length 1004 (2) eap: EAP session adding &reply:State = 0x2f19408c2d1d59c6 (2) [eap] = handled (2) } # authenticate = handled (2) Using Post-Auth-Type Challenge (2) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (2) Challenge { ... } # empty sub-section is ignored (2) Sent Access-Challenge Id 189 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (2) EAP-Message = 0x010403ec19c000000a61160303003d0200003903038f3d3f8f7f3fb1ff22498475736 563182fca8341022e1746de1bac3afbf6f12200c030000011ff01000100000b00040300 01020017000016030308bf0b0008bb0008b80003d2308203ce308202b6a003020102020 102300d06092a864886f70d0101 (2) Message-Authenticator = 0x00000000000000000000000000000000 (2) State = 0x2f19408c2d1d59c676c2fe7afaf965a8 (2) Finished request Waking up in 4.9 seconds. (3) Received Access-Request Id 190 from 10.0.1.241:32768 to 192.168.1.241:1812 length 144 (3) User-Name = "client-test-user" (3) NAS-IP-Address = 10.0.1.241 (3) NAS-Port = 0 (3) Called-Station-Id = "60-03-47-12-C5-7F" (3) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (3) Framed-MTU = 1400 (3) NAS-Port-Type = Wireless-802.11 (3) EAP-Message = 0x020400061900 (3) State = 0x2f19408c2d1d59c676c2fe7afaf965a8 (3) Message-Authenticator = 0x68716177af467d2a12d6a8940ee6ab7d (3) session-state: No cached attributes (3) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (3) authorize { (3) policy filter_username { (3) if (&User-Name) { (3) if (&User-Name) -> TRUE (3) if (&User-Name) { (3) if (&User-Name =~ / /) { (3) if (&User-Name =~ / /) -> FALSE (3) if (&User-Name =~ /@[^@]*@/ ) { (3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (3) if (&User-Name =~ /\.\./ ) { (3) if (&User-Name =~ /\.\./ ) -> FALSE (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (3) if (&User-Name =~ /\.$/) { (3) if (&User-Name =~ /\.$/) -> FALSE (3) if (&User-Name =~ /@\./) { (3) if (&User-Name =~ /@\./) -> FALSE (3) } # if (&User-Name) = notfound (3) } # policy filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix: Checking for suffix after "@" (3) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (3) suffix: No such realm "NULL" (3) [suffix] = noop (3) eap: Peer sent EAP Response (code 2) ID 4 length 6 (3) eap: Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = eap (3) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (3) authenticate { (3) eap: Expiring EAP session with state 0x2f19408c2d1d59c6 (3) eap: Finished EAP session with state 0x2f19408c2d1d59c6 (3) eap: Previous EAP request found for state 0x2f19408c2d1d59c6, released from the list (3) eap: Peer sent packet with method EAP PEAP (25) (3) eap: Calling submodule eap_peap to process data (3) eap_peap: Continuing EAP-TLS (3) eap_peap: Peer ACKed our handshake fragment (3) eap_peap: [eaptls verify] = request (3) eap_peap: [eaptls process] = handled (3) eap: Sending EAP Request (code 1) ID 5 length 1000 (3) eap: EAP session adding &reply:State = 0x2f19408c2c1c59c6 (3) [eap] = handled (3) } # authenticate = handled (3) Using Post-Auth-Type Challenge (3) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (3) Challenge { ... } # empty sub-section is ignored (3) Sent Access-Challenge Id 190 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (3) EAP-Message = 0x010503e81940217e113b0db74005ed147213bb838d5b883dd7a71e480026d17f84189 851ad07796d0c48913c87ebdbb4e5cffb3ae09e56bbe20d7b93f5a3799c1a60343f1ca1 ee0004e0308204dc308203c4a003020102021449a7f678b76499ed03327ae353204d115 dfaba62300d06092a864886f70d (3) Message-Authenticator = 0x00000000000000000000000000000000 (3) State = 0x2f19408c2c1c59c676c2fe7afaf965a8 (3) Finished request Waking up in 4.9 seconds. (4) Received Access-Request Id 191 from 10.0.1.241:32768 to 192.168.1.241:1812 length 144 (4) User-Name = "client-test-user" (4) NAS-IP-Address = 10.0.1.241 (4) NAS-Port = 0 (4) Called-Station-Id = "60-03-47-12-C5-7F" (4) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (4) Framed-MTU = 1400 (4) NAS-Port-Type = Wireless-802.11 (4) EAP-Message = 0x020500061900 (4) State = 0x2f19408c2c1c59c676c2fe7afaf965a8 (4) Message-Authenticator = 0x0b54bdad79479e5d45d47f5f2079f512 (4) session-state: No cached attributes (4) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (4) authorize { (4) policy filter_username { (4) if (&User-Name) { (4) if (&User-Name) -> TRUE (4) if (&User-Name) { (4) if (&User-Name =~ / /) { (4) if (&User-Name =~ / /) -> FALSE (4) if (&User-Name =~ /@[^@]*@/ ) { (4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (4) if (&User-Name =~ /\.\./ ) { (4) if (&User-Name =~ /\.\./ ) -> FALSE (4) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (4) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (4) if (&User-Name =~ /\.$/) { (4) if (&User-Name =~ /\.$/) -> FALSE (4) if (&User-Name =~ /@\./) { (4) if (&User-Name =~ /@\./) -> FALSE (4) } # if (&User-Name) = notfound (4) } # policy filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix: Checking for suffix after "@" (4) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (4) suffix: No such realm "NULL" (4) [suffix] = noop (4) eap: Peer sent EAP Response (code 2) ID 5 length 6 (4) eap: Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = eap (4) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (4) authenticate { (4) eap: Expiring EAP session with state 0x2f19408c2c1c59c6 (4) eap: Finished EAP session with state 0x2f19408c2c1c59c6 (4) eap: Previous EAP request found for state 0x2f19408c2c1c59c6, released from the list (4) eap: Peer sent packet with method EAP PEAP (25) (4) eap: Calling submodule eap_peap to process data (4) eap_peap: Continuing EAP-TLS (4) eap_peap: Peer ACKed our handshake fragment (4) eap_peap: [eaptls verify] = request (4) eap_peap: [eaptls process] = handled (4) eap: Sending EAP Request (code 1) ID 6 length 675 (4) eap: EAP session adding &reply:State = 0x2f19408c2b1f59c6 (4) [eap] = handled (4) } # authenticate = handled (4) Using Post-Auth-Type Challenge (4) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (4) Challenge { ... } # empty sub-section is ignored (4) Sent Access-Challenge Id 191 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (4) EAP-Message = 0x010602a319002d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6 f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b0500038201 0100962a6f743a739b9e506cbd7ee0a26dc02273355768707b9c29ab09b8c0fbf0dd6ae 51c67fec12412bd2e112f2e871a (4) Message-Authenticator = 0x00000000000000000000000000000000 (4) State = 0x2f19408c2b1f59c676c2fe7afaf965a8 (4) Finished request Waking up in 4.9 seconds. (5) Received Access-Request Id 192 from 10.0.1.241:32768 to 192.168.1.241:1812 length 274 (5) User-Name = "client-test-user" (5) NAS-IP-Address = 10.0.1.241 (5) NAS-Port = 0 (5) Called-Station-Id = "60-03-47-12-C5-7F" (5) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (5) Framed-MTU = 1400 (5) NAS-Port-Type = Wireless-802.11 (5) EAP-Message = 0x0206008819800000007e1603030046100000424104135245371b17ce114babd8b9774 038119708b7a7928504e378f8342d161c72d1ae144f247a9ddfdfc5abbff2b3835c233b 1ed3f86c967c3878882ff5564debe714030300010116030300280000000000000000202 2f582ac6ba225f8ba6254b8b501 (5) State = 0x2f19408c2b1f59c676c2fe7afaf965a8 (5) Message-Authenticator = 0xee8c616e6b613bc9272d1ead183d260e (5) session-state: No cached attributes (5) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (5) authorize { (5) policy filter_username { (5) if (&User-Name) { (5) if (&User-Name) -> TRUE (5) if (&User-Name) { (5) if (&User-Name =~ / /) { (5) if (&User-Name =~ / /) -> FALSE (5) if (&User-Name =~ /@[^@]*@/ ) { (5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (5) if (&User-Name =~ /\.\./ ) { (5) if (&User-Name =~ /\.\./ ) -> FALSE (5) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (5) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (5) if (&User-Name =~ /\.$/) { (5) if (&User-Name =~ /\.$/) -> FALSE (5) if (&User-Name =~ /@\./) { (5) if (&User-Name =~ /@\./) -> FALSE (5) } # if (&User-Name) = notfound (5) } # policy filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix: Checking for suffix after "@" (5) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (5) suffix: No such realm "NULL" (5) [suffix] = noop (5) eap: Peer sent EAP Response (code 2) ID 6 length 136 (5) eap: Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = eap (5) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (5) authenticate { (5) eap: Expiring EAP session with state 0x2f19408c2b1f59c6 (5) eap: Finished EAP session with state 0x2f19408c2b1f59c6 (5) eap: Previous EAP request found for state 0x2f19408c2b1f59c6, released from the list (5) eap: Peer sent packet with method EAP PEAP (25) (5) eap: Calling submodule eap_peap to process data (5) eap_peap: Continuing EAP-TLS (5) eap_peap: Peer indicated complete TLS record size will be 126 bytes (5) eap_peap: Got complete TLS record (126 bytes) (5) eap_peap: [eaptls verify] = length included (5) eap_peap: TLS_accept: SSLv3/TLS write server done (5) eap_peap: <<< recv TLS 1.2 [length 0046] (5) eap_peap: TLS_accept: SSLv3/TLS read client key exchange (5) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (5) eap_peap: <<< recv TLS 1.2 [length 0010] (5) eap_peap: TLS_accept: SSLv3/TLS read finished (5) eap_peap: >>> send TLS 1.2 [length 0001] (5) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (5) eap_peap: >>> send TLS 1.2 [length 0010] (5) eap_peap: TLS_accept: SSLv3/TLS write finished (5) eap_peap: (other): SSL negotiation finished successfully (5) eap_peap: SSL Connection Established (5) eap_peap: [eaptls process] = handled (5) eap: Sending EAP Request (code 1) ID 7 length 57 (5) eap: EAP session adding &reply:State = 0x2f19408c2a1e59c6 (5) [eap] = handled (5) } # authenticate = handled (5) Using Post-Auth-Type Challenge (5) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (5) Challenge { ... } # empty sub-section is ignored (5) Sent Access-Challenge Id 192 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (5) EAP-Message = 0x01070039190014030300010116030300283fd988a4113089de2cec17df7414e410c83 6b9e79ef84b283501b866a43776cf8decfc8808756ee5 (5) Message-Authenticator = 0x00000000000000000000000000000000 (5) State = 0x2f19408c2a1e59c676c2fe7afaf965a8 (5) Finished request Waking up in 4.9 seconds. (6) Received Access-Request Id 193 from 10.0.1.241:32768 to 192.168.1.241:1812 length 144 (6) User-Name = "client-test-user" (6) NAS-IP-Address = 10.0.1.241 (6) NAS-Port = 0 (6) Called-Station-Id = "60-03-47-12-C5-7F" (6) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (6) Framed-MTU = 1400 (6) NAS-Port-Type = Wireless-802.11 (6) EAP-Message = 0x020700061900 (6) State = 0x2f19408c2a1e59c676c2fe7afaf965a8 (6) Message-Authenticator = 0xe929038cf8c386739506b03a026f42da (6) session-state: No cached attributes (6) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (6) authorize { (6) policy filter_username { (6) if (&User-Name) { (6) if (&User-Name) -> TRUE (6) if (&User-Name) { (6) if (&User-Name =~ / /) { (6) if (&User-Name =~ / /) -> FALSE (6) if (&User-Name =~ /@[^@]*@/ ) { (6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (6) if (&User-Name =~ /\.\./ ) { (6) if (&User-Name =~ /\.\./ ) -> FALSE (6) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (6) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (6) if (&User-Name =~ /\.$/) { (6) if (&User-Name =~ /\.$/) -> FALSE (6) if (&User-Name =~ /@\./) { (6) if (&User-Name =~ /@\./) -> FALSE (6) } # if (&User-Name) = notfound (6) } # policy filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix: Checking for suffix after "@" (6) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (6) suffix: No such realm "NULL" (6) [suffix] = noop (6) eap: Peer sent EAP Response (code 2) ID 7 length 6 (6) eap: Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = eap (6) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (6) authenticate { (6) eap: Expiring EAP session with state 0x2f19408c2a1e59c6 (6) eap: Finished EAP session with state 0x2f19408c2a1e59c6 (6) eap: Previous EAP request found for state 0x2f19408c2a1e59c6, released from the list (6) eap: Peer sent packet with method EAP PEAP (25) (6) eap: Calling submodule eap_peap to process data (6) eap_peap: Continuing EAP-TLS (6) eap_peap: Peer ACKed our handshake fragment. handshake is finished (6) eap_peap: [eaptls verify] = success (6) eap_peap: [eaptls process] = success (6) eap_peap: Session established. Decoding tunneled attributes (6) eap_peap: PEAP state TUNNEL ESTABLISHED (6) eap: Sending EAP Request (code 1) ID 8 length 40 (6) eap: EAP session adding &reply:State = 0x2f19408c291159c6 (6) [eap] = handled (6) } # authenticate = handled (6) Using Post-Auth-Type Challenge (6) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (6) Challenge { ... } # empty sub-section is ignored (6) Sent Access-Challenge Id 193 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (6) EAP-Message = 0x010800281900170303001d3fd988a4113089dfa6325137ec2500f4aa1129e7598d55a 6872c83f508 (6) Message-Authenticator = 0x00000000000000000000000000000000 (6) State = 0x2f19408c291159c676c2fe7afaf965a8 (6) Finished request Waking up in 4.9 seconds. (7) Received Access-Request Id 194 from 10.0.1.241:32768 to 192.168.1.241:1812 length 190 (7) User-Name = "client-test-user" (7) NAS-IP-Address = 10.0.1.241 (7) NAS-Port = 0 (7) Called-Station-Id = "60-03-47-12-C5-7F" (7) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (7) Framed-MTU = 1400 (7) NAS-Port-Type = Wireless-802.11 (7) EAP-Message = 0x0208003419001703030029000000000000000164b3595702a133e733bd03f116fd7c4 b66ad6d5e85b46ef6ca2dfa7873fc871367 (7) State = 0x2f19408c291159c676c2fe7afaf965a8 (7) Message-Authenticator = 0xdae6f74c322757ac59e32daab3d39765 (7) session-state: No cached attributes (7) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /@\./) { (7) if (&User-Name =~ /@\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [preprocess] = ok (7) [chap] = noop (7) [mschap] = noop (7) [digest] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) eap: Peer sent EAP Response (code 2) ID 8 length 52 (7) eap: Continuing tunnel setup (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (7) authenticate { (7) eap: Expiring EAP session with state 0x2f19408c291159c6 (7) eap: Finished EAP session with state 0x2f19408c291159c6 (7) eap: Previous EAP request found for state 0x2f19408c291159c6, released from the list (7) eap: Peer sent packet with method EAP PEAP (25) (7) eap: Calling submodule eap_peap to process data (7) eap_peap: Continuing EAP-TLS (7) eap_peap: [eaptls verify] = ok (7) eap_peap: Done initial handshake (7) eap_peap: [eaptls process] = ok (7) eap_peap: Session established. Decoding tunneled attributes (7) eap_peap: PEAP state WAITING FOR INNER IDENTITY (7) eap_peap: Identity - client-test-user (7) eap_peap: Got inner identity 'client-test-user' (7) eap_peap: Setting default EAP type for tunneled EAP session (7) eap_peap: Got tunneled request (7) eap_peap: EAP-Message = 0x02080015016173747574652d746573742d75736572 (7) eap_peap: Setting User-Name to client-test-user (7) eap_peap: Sending tunneled request to inner-tunnel (7) eap_peap: EAP-Message = 0x02080015016173747574652d746573742d75736572 (7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (7) eap_peap: User-Name = "client-test-user" (7) Virtual server inner-tunnel received request (7) EAP-Message = 0x02080015016173747574652d746573742d75736572 (7) FreeRADIUS-Proxied-To = 127.0.0.1 (7) User-Name = "client-test-user" (7) WARNING: Outer and inner identities are the same. User privacy is compromised. (7) server inner-tunnel { (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (7) authorize { (7) policy filter_username { (7) if (&User-Name) { (7) if (&User-Name) -> TRUE (7) if (&User-Name) { (7) if (&User-Name =~ / /) { (7) if (&User-Name =~ / /) -> FALSE (7) if (&User-Name =~ /@[^@]*@/ ) { (7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (7) if (&User-Name =~ /\.\./ ) { (7) if (&User-Name =~ /\.\./ ) -> FALSE (7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (7) if (&User-Name =~ /\.$/) { (7) if (&User-Name =~ /\.$/) -> FALSE (7) if (&User-Name =~ /@\./) { (7) if (&User-Name =~ /@\./) -> FALSE (7) } # if (&User-Name) = notfound (7) } # policy filter_username = notfound (7) [chap] = noop (7) [mschap] = noop (7) suffix: Checking for suffix after "@" (7) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (7) suffix: No such realm "NULL" (7) [suffix] = noop (7) update control { (7) &Proxy-To-Realm := LOCAL (7) } # update control = noop (7) eap: Peer sent EAP Response (code 2) ID 8 length 21 (7) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (7) [eap] = ok (7) } # authorize = ok (7) Found Auth-Type = eap (7) # Executing group from file /etc/freeradius/3.0/sites- enabled/inner-tunnel (7) authenticate { (7) eap: Peer sent packet with method EAP Identity (1) (7) eap: Calling submodule eap_mschapv2 to process data (7) eap_mschapv2: Issuing Challenge (7) eap: Sending EAP Request (code 1) ID 9 length 43 (7) eap: EAP session adding &reply:State = 0x32d4275432dd3d85 (7) [eap] = handled (7) } # authenticate = handled (7) } # server inner-tunnel (7) Virtual server sending reply (7) EAP-Message = 0x0109002b1a01090026106146255b0872fefcd7f91c2e18b2f7b766726565726164697 5732d332e302e3137 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x32d4275432dd3d857188142e16d38f62 (7) eap_peap: Got tunneled reply code 11 (7) eap_peap: EAP-Message = 0x0109002b1a01090026106146255b0872fefcd7f91c2e18b2f7b766726565726164697 5732d332e302e3137 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x32d4275432dd3d857188142e16d38f62 (7) eap_peap: Got tunneled reply RADIUS code 11 (7) eap_peap: EAP-Message = 0x0109002b1a01090026106146255b0872fefcd7f91c2e18b2f7b766726565726164697 5732d332e302e3137 (7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (7) eap_peap: State = 0x32d4275432dd3d857188142e16d38f62 (7) eap_peap: Got tunneled Access-Challenge (7) eap: Sending EAP Request (code 1) ID 9 length 74 (7) eap: EAP session adding &reply:State = 0x2f19408c281059c6 (7) [eap] = handled (7) } # authenticate = handled (7) Using Post-Auth-Type Challenge (7) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (7) Challenge { ... } # empty sub-section is ignored (7) Sent Access-Challenge Id 194 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (7) EAP-Message = 0x0109004a1900170303003f3fd988a4113089e02588a8d5573530c9c35719adfde63de b907a2e0d9595c68a4082aca2a31fcb76db7c1412622ada742a8df6ee5d2529b8cfe413 2302dbd8 (7) Message-Authenticator = 0x00000000000000000000000000000000 (7) State = 0x2f19408c281059c676c2fe7afaf965a8 (7) Finished request Waking up in 4.9 seconds. (8) Received Access-Request Id 195 from 10.0.1.241:32768 to 192.168.1.241:1812 length 244 (8) User-Name = "client-test-user" (8) NAS-IP-Address = 10.0.1.241 (8) NAS-Port = 0 (8) Called-Station-Id = "60-03-47-12-C5-7F" (8) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (8) Framed-MTU = 1400 (8) NAS-Port-Type = Wireless-802.11 (8) EAP-Message = 0x0209006a1900170303005f0000000000000002be7dd694ab3a148dab1312f38720aef bbb3ee5b900cecd1e6ef5b716e62883917393690bd60fdb17789b88cdf191305aabacd4 86003431a162582efcf8b8592d46d4774f23745a0b20ae3c714705617d5a1874c7a322a 9 (8) State = 0x2f19408c281059c676c2fe7afaf965a8 (8) Message-Authenticator = 0xd4e295b7b6c6c3efabc7863953a96e4d (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /@\./) { (8) if (&User-Name =~ /@\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [preprocess] = ok (8) [chap] = noop (8) [mschap] = noop (8) [digest] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) eap: Peer sent EAP Response (code 2) ID 9 length 106 (8) eap: Continuing tunnel setup (8) [eap] = ok (8) } # authorize = ok (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (8) authenticate { (8) eap: Expiring EAP session with state 0x32d4275432dd3d85 (8) eap: Finished EAP session with state 0x2f19408c281059c6 (8) eap: Previous EAP request found for state 0x2f19408c281059c6, released from the list (8) eap: Peer sent packet with method EAP PEAP (25) (8) eap: Calling submodule eap_peap to process data (8) eap_peap: Continuing EAP-TLS (8) eap_peap: [eaptls verify] = ok (8) eap_peap: Done initial handshake (8) eap_peap: [eaptls process] = ok (8) eap_peap: Session established. Decoding tunneled attributes (8) eap_peap: PEAP state phase2 (8) eap_peap: EAP method MSCHAPv2 (26) (8) eap_peap: Got tunneled request (8) eap_peap: EAP-Message = 0x0209004b1a02090046316624fdb82698d5a9836d5483f2fef2a00000000000000000a 20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6006173747574652d74657374 2d75736572 (8) eap_peap: Setting User-Name to client-test-user (8) eap_peap: Sending tunneled request to inner-tunnel (8) eap_peap: EAP-Message = 0x0209004b1a02090046316624fdb82698d5a9836d5483f2fef2a00000000000000000a 20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6006173747574652d74657374 2d75736572 (8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (8) eap_peap: User-Name = "client-test-user" (8) eap_peap: State = 0x32d4275432dd3d857188142e16d38f62 (8) Virtual server inner-tunnel received request (8) EAP-Message = 0x0209004b1a02090046316624fdb82698d5a9836d5483f2fef2a00000000000000000a 20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6006173747574652d74657374 2d75736572 (8) FreeRADIUS-Proxied-To = 127.0.0.1 (8) User-Name = "client-test-user" (8) State = 0x32d4275432dd3d857188142e16d38f62 (8) WARNING: Outer and inner identities are the same. User privacy is compromised. (8) server inner-tunnel { (8) session-state: No cached attributes (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) authorize { (8) policy filter_username { (8) if (&User-Name) { (8) if (&User-Name) -> TRUE (8) if (&User-Name) { (8) if (&User-Name =~ / /) { (8) if (&User-Name =~ / /) -> FALSE (8) if (&User-Name =~ /@[^@]*@/ ) { (8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (8) if (&User-Name =~ /\.\./ ) { (8) if (&User-Name =~ /\.\./ ) -> FALSE (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (8) if (&User-Name =~ /\.$/) { (8) if (&User-Name =~ /\.$/) -> FALSE (8) if (&User-Name =~ /@\./) { (8) if (&User-Name =~ /@\./) -> FALSE (8) } # if (&User-Name) = notfound (8) } # policy filter_username = notfound (8) [chap] = noop (8) [mschap] = noop (8) suffix: Checking for suffix after "@" (8) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (8) suffix: No such realm "NULL" (8) [suffix] = noop (8) update control { (8) &Proxy-To-Realm := LOCAL (8) } # update control = noop (8) eap: Peer sent EAP Response (code 2) ID 9 length 75 (8) eap: No EAP Start, assuming it's an on-going EAP conversation (8) [eap] = updated (8) [files] = noop (8) [expiration] = noop (8) [logintime] = noop (8) [pap] = noop (8) } # authorize = updated (8) Found Auth-Type = eap (8) # Executing group from file /etc/freeradius/3.0/sites- enabled/inner-tunnel (8) authenticate { (8) eap: Expiring EAP session with state 0x32d4275432dd3d85 (8) eap: Finished EAP session with state 0x32d4275432dd3d85 (8) eap: Previous EAP request found for state 0x32d4275432dd3d85, released from the list (8) eap: Peer sent packet with method EAP MSCHAPv2 (26) (8) eap: Calling submodule eap_mschapv2 to process data (8) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (8) eap_mschapv2: authenticate { (8) mschap: Creating challenge hash with username: client-test-user (8) mschap: Client is using MS-CHAPv2 (8) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key -- username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:- client-nt-domain} --challenge=%{mschap:Challenge:-00} --nt- response=%{mschap:NT-Response:-00}: (8) mschap: EXPAND --username=%{mschap:User-Name:-None} (8) mschap: --> --username=client-test-user (8) mschap: ERROR: No NT-Domain was found in the User-Name (8) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-client-nt-domain} (8) mschap: --> --domain=client-nt-domain (8) mschap: Creating challenge hash with username: client-test-user (8) mschap: EXPAND --challenge=%{mschap:Challenge:-00} (8) mschap: --> --challenge=cea5e5da3645ab46 (8) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00} (8) mschap: --> --nt- response=a20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6 (8) mschap: Program returned code (0) and output 'NT_KEY: 0DF2778ED7F65BC492752683ED79B290' (8) mschap: Adding MS-CHAPv2 MPPE keys (8) [mschap] = ok (8) } # authenticate = ok (8) MSCHAP Success (8) eap: Sending EAP Request (code 1) ID 10 length 51 (8) eap: EAP session adding &reply:State = 0x32d4275433de3d85 (8) [eap] = handled (8) } # authenticate = handled (8) } # server inner-tunnel (8) Virtual server sending reply (8) EAP-Message = 0x010a00331a0309002e533d42434239374144444530463536344642463337434238303 342353846424535363643424246413744 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x32d4275433de3d857188142e16d38f62 (8) eap_peap: Got tunneled reply code 11 (8) eap_peap: EAP-Message = 0x010a00331a0309002e533d42434239374144444530463536344642463337434238303 342353846424535363643424246413744 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x32d4275433de3d857188142e16d38f62 (8) eap_peap: Got tunneled reply RADIUS code 11 (8) eap_peap: EAP-Message = 0x010a00331a0309002e533d42434239374144444530463536344642463337434238303 342353846424535363643424246413744 (8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (8) eap_peap: State = 0x32d4275433de3d857188142e16d38f62 (8) eap_peap: Got tunneled Access-Challenge (8) eap: Sending EAP Request (code 1) ID 10 length 82 (8) eap: EAP session adding &reply:State = 0x2f19408c271359c6 (8) [eap] = handled (8) } # authenticate = handled (8) Using Post-Auth-Type Challenge (8) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (8) Challenge { ... } # empty sub-section is ignored (8) Sent Access-Challenge Id 195 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (8) EAP-Message = 0x010a0052190017030300473fd988a4113089e1f9f6e801a5317a6a411a60513de98ee 1b93c8b86213418c35b5d92e7d7dca3fe7924a4cec84e2b87b64713da08236896f7bfc0 c582f082500a6baaf1128a76 (8) Message-Authenticator = 0x00000000000000000000000000000000 (8) State = 0x2f19408c271359c676c2fe7afaf965a8 (8) Finished request Waking up in 4.8 seconds. (9) Received Access-Request Id 196 from 10.0.1.241:32768 to 192.168.1.241:1812 length 175 (9) User-Name = "client-test-user" (9) NAS-IP-Address = 10.0.1.241 (9) NAS-Port = 0 (9) Called-Station-Id = "60-03-47-12-C5-7F" (9) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (9) Framed-MTU = 1400 (9) NAS-Port-Type = Wireless-802.11 (9) EAP-Message = 0x020a00251900170303001a00000000000000030c34ff09938824e8775cca0ecc692a9 cad18 (9) State = 0x2f19408c271359c676c2fe7afaf965a8 (9) Message-Authenticator = 0xcdb8b982178bc3a0765a18b33f4f06d4 (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /@\./) { (9) if (&User-Name =~ /@\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [preprocess] = ok (9) [chap] = noop (9) [mschap] = noop (9) [digest] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) eap: Peer sent EAP Response (code 2) ID 10 length 37 (9) eap: Continuing tunnel setup (9) [eap] = ok (9) } # authorize = ok (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (9) authenticate { (9) eap: Expiring EAP session with state 0x32d4275433de3d85 (9) eap: Finished EAP session with state 0x2f19408c271359c6 (9) eap: Previous EAP request found for state 0x2f19408c271359c6, released from the list (9) eap: Peer sent packet with method EAP PEAP (25) (9) eap: Calling submodule eap_peap to process data (9) eap_peap: Continuing EAP-TLS (9) eap_peap: [eaptls verify] = ok (9) eap_peap: Done initial handshake (9) eap_peap: [eaptls process] = ok (9) eap_peap: Session established. Decoding tunneled attributes (9) eap_peap: PEAP state phase2 (9) eap_peap: EAP method MSCHAPv2 (26) (9) eap_peap: Got tunneled request (9) eap_peap: EAP-Message = 0x020a00061a03 (9) eap_peap: Setting User-Name to client-test-user (9) eap_peap: Sending tunneled request to inner-tunnel (9) eap_peap: EAP-Message = 0x020a00061a03 (9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (9) eap_peap: User-Name = "client-test-user" (9) eap_peap: State = 0x32d4275433de3d857188142e16d38f62 (9) Virtual server inner-tunnel received request (9) EAP-Message = 0x020a00061a03 (9) FreeRADIUS-Proxied-To = 127.0.0.1 (9) User-Name = "client-test-user" (9) State = 0x32d4275433de3d857188142e16d38f62 (9) WARNING: Outer and inner identities are the same. User privacy is compromised. (9) server inner-tunnel { (9) session-state: No cached attributes (9) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) authorize { (9) policy filter_username { (9) if (&User-Name) { (9) if (&User-Name) -> TRUE (9) if (&User-Name) { (9) if (&User-Name =~ / /) { (9) if (&User-Name =~ / /) -> FALSE (9) if (&User-Name =~ /@[^@]*@/ ) { (9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (9) if (&User-Name =~ /\.\./ ) { (9) if (&User-Name =~ /\.\./ ) -> FALSE (9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (9) if (&User-Name =~ /\.$/) { (9) if (&User-Name =~ /\.$/) -> FALSE (9) if (&User-Name =~ /@\./) { (9) if (&User-Name =~ /@\./) -> FALSE (9) } # if (&User-Name) = notfound (9) } # policy filter_username = notfound (9) [chap] = noop (9) [mschap] = noop (9) suffix: Checking for suffix after "@" (9) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (9) suffix: No such realm "NULL" (9) [suffix] = noop (9) update control { (9) &Proxy-To-Realm := LOCAL (9) } # update control = noop (9) eap: Peer sent EAP Response (code 2) ID 10 length 6 (9) eap: No EAP Start, assuming it's an on-going EAP conversation (9) [eap] = updated (9) [files] = noop (9) [expiration] = noop (9) [logintime] = noop (9) [pap] = noop (9) } # authorize = updated (9) Found Auth-Type = eap (9) # Executing group from file /etc/freeradius/3.0/sites- enabled/inner-tunnel (9) authenticate { (9) eap: Expiring EAP session with state 0x32d4275433de3d85 (9) eap: Finished EAP session with state 0x32d4275433de3d85 (9) eap: Previous EAP request found for state 0x32d4275433de3d85, released from the list (9) eap: Peer sent packet with method EAP MSCHAPv2 (26) (9) eap: Calling submodule eap_mschapv2 to process data (9) eap: Sending EAP Success (code 3) ID 10 length 4 (9) eap: Freeing handler (9) [eap] = ok (9) } # authenticate = ok (9) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (9) post-auth { (9) if (0) { (9) if (0) -> FALSE (9) } # post-auth = noop (9) Login OK: [client-test-user] (from client CLIENT-TEST-AP port 0 via TLS tunnel) (9) } # server inner-tunnel (9) Virtual server sending reply (9) MS-MPPE-Encryption-Policy = Encryption-Allowed (9) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) MS-MPPE-Send-Key = 0x95b3db36f265faf31f1a15ceb9266c6a (9) MS-MPPE-Recv-Key = 0x5a9b1ffb2b556bf199d63eecd358eb1b (9) EAP-Message = 0x030a0004 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) User-Name = "client-test-user" (9) eap_peap: Got tunneled reply code 2 (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x95b3db36f265faf31f1a15ceb9266c6a (9) eap_peap: MS-MPPE-Recv-Key = 0x5a9b1ffb2b556bf199d63eecd358eb1b (9) eap_peap: EAP-Message = 0x030a0004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "client-test-user" (9) eap_peap: Got tunneled reply RADIUS code 2 (9) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (9) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (9) eap_peap: MS-MPPE-Send-Key = 0x95b3db36f265faf31f1a15ceb9266c6a (9) eap_peap: MS-MPPE-Recv-Key = 0x5a9b1ffb2b556bf199d63eecd358eb1b (9) eap_peap: EAP-Message = 0x030a0004 (9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (9) eap_peap: User-Name = "client-test-user" (9) eap_peap: Tunneled authentication was successful (9) eap_peap: SUCCESS (9) eap: Sending EAP Request (code 1) ID 11 length 46 (9) eap: EAP session adding &reply:State = 0x2f19408c261259c6 (9) [eap] = handled (9) } # authenticate = handled (9) Using Post-Auth-Type Challenge (9) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (9) Challenge { ... } # empty sub-section is ignored (9) Sent Access-Challenge Id 196 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (9) EAP-Message = 0x010b002e190017030300233fd988a4113089e23fc83669abbf4ced24ed9102ba49fe8 9f70703aeccddc63de43194 (9) Message-Authenticator = 0x00000000000000000000000000000000 (9) State = 0x2f19408c261259c676c2fe7afaf965a8 (9) Finished request Waking up in 4.8 seconds. (10) Received Access-Request Id 197 from 10.0.1.241:32768 to 192.168.1.241:1812 length 184 (10) User-Name = "client-test-user" (10) NAS-IP-Address = 10.0.1.241 (10) NAS-Port = 0 (10) Called-Station-Id = "60-03-47-12-C5-7F" (10) Calling-Station-Id = "F4-8C-50-2A-EA-DB" (10) Framed-MTU = 1400 (10) NAS-Port-Type = Wireless-802.11 (10) EAP-Message = 0x020b002e190017030300230000000000000004a870e166c3f508bcb23cc22d4a75ac9 91a5936d243248199c7f548 (10) State = 0x2f19408c261259c676c2fe7afaf965a8 (10) Message-Authenticator = 0xcef94b00ae921e41ff8c71ef42622808 (10) session-state: No cached attributes (10) # Executing section authorize from file /etc/freeradius/3.0/sites- enabled/default (10) authorize { (10) policy filter_username { (10) if (&User-Name) { (10) if (&User-Name) -> TRUE (10) if (&User-Name) { (10) if (&User-Name =~ / /) { (10) if (&User-Name =~ / /) -> FALSE (10) if (&User-Name =~ /@[^@]*@/ ) { (10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (10) if (&User-Name =~ /\.\./ ) { (10) if (&User-Name =~ /\.\./ ) -> FALSE (10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (10) if (&User-Name =~ /\.$/) { (10) if (&User-Name =~ /\.$/) -> FALSE (10) if (&User-Name =~ /@\./) { (10) if (&User-Name =~ /@\./) -> FALSE (10) } # if (&User-Name) = notfound (10) } # policy filter_username = notfound (10) [preprocess] = ok (10) [chap] = noop (10) [mschap] = noop (10) [digest] = noop (10) suffix: Checking for suffix after "@" (10) suffix: No '@' in User-Name = "client-test-user", looking up realm NULL (10) suffix: No such realm "NULL" (10) [suffix] = noop (10) eap: Peer sent EAP Response (code 2) ID 11 length 46 (10) eap: Continuing tunnel setup (10) [eap] = ok (10) } # authorize = ok (10) Found Auth-Type = eap (10) # Executing group from file /etc/freeradius/3.0/sites- enabled/default (10) authenticate { (10) eap: Expiring EAP session with state 0x2f19408c261259c6 (10) eap: Finished EAP session with state 0x2f19408c261259c6 (10) eap: Previous EAP request found for state 0x2f19408c261259c6, released from the list (10) eap: Peer sent packet with method EAP PEAP (25) (10) eap: Calling submodule eap_peap to process data (10) eap_peap: Continuing EAP-TLS (10) eap_peap: [eaptls verify] = ok (10) eap_peap: Done initial handshake (10) eap_peap: [eaptls process] = ok (10) eap_peap: Session established. Decoding tunneled attributes (10) eap_peap: PEAP state send tlv success (10) eap_peap: Received EAP-TLV response (10) eap_peap: Success (10) eap: Sending EAP Success (code 3) ID 11 length 4 (10) eap: Freeing handler (10) [eap] = ok (10) } # authenticate = ok (10) # Executing section post-auth from file /etc/freeradius/3.0/sites- enabled/default (10) post-auth { (10) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (10) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (10) update { (10) No attributes updated (10) } # update = noop (10) [exec] = noop (10) policy remove_reply_message_if_eap { (10) if (&reply:EAP-Message && &reply:Reply-Message) { (10) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (10) else { (10) [noop] = noop (10) } # else = noop (10) } # policy remove_reply_message_if_eap = noop (10) } # post-auth = noop (10) Login OK: [client-test-user] (from client CLIENT-TEST-AP port 0 cli F4-8C-50-2A-EA-DB) (10) Sent Access-Accept Id 197 from 192.168.1.241:1812 to 10.0.1.241:32768 length 0 (10) MS-MPPE-Recv-Key = 0xe717c46c5b3cf37ed3b79c977f825f317523daeda6f5c3934c4abcf0658b9ff5 (10) MS-MPPE-Send-Key = 0x5207a25678621578604f44a475370863d742cb445cb6a9e93b5f9eb5aa484c37 (10) EAP-Message = 0x030b0004 (10) Message-Authenticator = 0x00000000000000000000000000000000 (10) User-Name = "client-test-user" (10) Finished request Waking up in 4.8 seconds. (0) Cleaning up request packet ID 187 with timestamp +7 (1) Cleaning up request packet ID 188 with timestamp +7 (2) Cleaning up request packet ID 189 with timestamp +7 (3) Cleaning up request packet ID 190 with timestamp +7 (4) Cleaning up request packet ID 191 with timestamp +7 (5) Cleaning up request packet ID 192 with timestamp +7 (6) Cleaning up request packet ID 193 with timestamp +7 (7) Cleaning up request packet ID 194 with timestamp +7 (8) Cleaning up request packet ID 195 with timestamp +7 (9) Cleaning up request packet ID 196 with timestamp +7 (10) Cleaning up request packet ID 197 with timestamp +7 Ready to process requests Regards On Wed, 2020-09-30 at 08:57 -0400, Alan DeKok wrote:
On Sep 30, 2020, at 8:31 AM, Linux Threads <linuxthreads@gmail.com> wrote:
for replication: the home server, home server pool and the realm are configured in proxy.conf
That's good.
replicate should be listed in sites-enabled/"site" either under the below sections depending on requirements I am using accounting:
OK.
and control I have listed it under accounting:
update control { &Replicate-to-Realm := "REALM-NAME" }
do I leave mods-enabled/replicate as is?
Yes. That's the default configuration for the module. The documentation makes it clear what you need to do.
if a user auths with username or nt-domain\username, it does not replicate,
So.... where is the debug output?
the only time it send packets to home server is when I use:
echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123 Received response ID 21, code 5, length = 20
replicate is loaded:
Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_replicate, checking if it's valid
Don't use "radiusd -Xxx".
I have no otherway of testing this exept if I auth against the AP
You can run the server in debugging mode to see the packets from the AP. Then, copy the packets, and resend them using radclient.
And PLEASE read http://wiki.freeradius.org/list-help
ALL of the documentation says to run the server in debugging mode, and post the output to the list. The above page also links to another page which explains how to read the output of "radiusd -X".
When you ignore the documentation, you're wasting your time and ours. We wrote the documentation in order to help people. If you want help, READ THE DOCS, and FOLLOW THE INSTRUCTIONS.
Alan DeKok.
On Oct 1, 2020, at 5:45 AM, Linux Threads <linuxthreads@gmail.com> wrote:
what is strange is that the radius server is sending an arp request for the homeserver I have configured not sure if it is related,
That's how IPv4 works...
as requested here is the debug output
sudo freeradius -X
Which shows Access-Request packets, but no accounting. How are you going to debug accounting packets by looking at Access-Request packets? Post the debug log WHICH SHOWS ACCOUNTING PACKETS. Alan DeKok.
Thanks Alan, I understand now, and replicate is working, edit proxy.conf add home sersers and home server pools and realm, update sites-enabled/site-name under accounting, and then point the ap acct to FR 1813 Regards On Thu, 2020-10-01 at 07:35 -0400, Alan DeKok wrote:
On Oct 1, 2020, at 5:45 AM, Linux Threads <linuxthreads@gmail.com> wrote:
what is strange is that the radius server is sending an arp request for the homeserver I have configured not sure if it is related,
That's how IPv4 works...
as requested here is the debug output
sudo freeradius -X
Which shows Access-Request packets, but no accounting.
How are you going to debug accounting packets by looking at Access- Request packets?
Post the debug log WHICH SHOWS ACCOUNTING PACKETS.
Alan DeKok.
On Sep 28, 2020, at 2:51 AM, Ammad Ali <ammad.ali@rapidcompute.com> wrote:
I have installed latest RPM of freeradius from https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ on centos 7.
We don't control that site and we have no input into it.
After fresh install when I start radius in debug mode, it gives me below errors of auth and acct protocol.
The server still starts. Ignore the messages. Alan DeKok.
participants (3)
-
Alan DeKok -
Ammad Ali -
Linux Threads