EAP-GTC Error - Samsung S20+ connecting to eduroam - Freeradius-Users

8 Sep 2020

      Hi,

I’ve never needed to post here but this one has really stifled me. I have an end user with a Samsung S20+ and the September 2020 security patch attempting to connect to eduroam, everything looks fine client side (PEAP/MSCHAPv2) which has been verified by myself but Freeradius keeps throwing EAP-GTC errors. All other devices hitting Freeradius are connecting normally without issue.

eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed

I’ve no idea why its touching EAP-GTC at all… The client is set for MSCHAPv2 so I’m inclined to say that the client is bad and to wait for the next update but it’s difficult to articulate that to end users who have purchased the latest Samsung. Any ideas?

Debug as per below.

Cheers
Shaun

Copyright (C) 1999-2015 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/local/share/freeradius/dictionary
including dictionary file /usr/local/share/freeradius/dictionary.dhcp
including dictionary file /usr/local/share/freeradius/dictionary.vqp
including dictionary file /usr/local/etc/raddb/dictionary
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/proxy.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/mods-enabled/
including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
including configuration file /usr/local/etc/raddb/mods-enabled/realm
including configuration file /usr/local/etc/raddb/mods-enabled/eap
including configuration file /usr/local/etc/raddb/mods-enabled/exec
including configuration file /usr/local/etc/raddb/mods-enabled/dhcp
including configuration file /usr/local/etc/raddb/mods-enabled/logintime
including configuration file /usr/local/etc/raddb/mods-enabled/server_log
including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
including configuration file /usr/local/etc/raddb/mods-enabled/chap
including configuration file /usr/local/etc/raddb/mods-enabled/extended_logging
including configuration file /usr/local/etc/raddb/mods-enabled/always
including configuration file /usr/local/etc/raddb/mods-enabled/replicate
including configuration file /usr/local/etc/raddb/mods-enabled/soh
including configuration file /usr/local/etc/raddb/mods-enabled/files
including configuration file /usr/local/etc/raddb/mods-enabled/passwd
including configuration file /usr/local/etc/raddb/mods-enabled/detail
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
including configuration file /usr/local/etc/raddb/mods-enabled/echo
including configuration file /usr/local/etc/raddb/mods-enabled/expiration
including configuration file /usr/local/etc/raddb/mods-enabled/unpack
including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
including configuration file /usr/local/etc/raddb/mods-enabled/unix
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
including configuration file /usr/local/etc/raddb/mods-enabled/digest
including configuration file /usr/local/etc/raddb/mods-enabled/expr
including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
including configuration file /usr/local/etc/raddb/mods-enabled/pap
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
including files in directory /usr/local/etc/raddb/policy.d/
including configuration file /usr/local/etc/raddb/policy.d/eap
including configuration file /usr/local/etc/raddb/policy.d/dhcp
including configuration file /usr/local/etc/raddb/policy.d/canonicalization
including configuration file /usr/local/etc/raddb/policy.d/accounting
including configuration file /usr/local/etc/raddb/policy.d/filter
including configuration file /usr/local/etc/raddb/policy.d/control
including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
including configuration file /usr/local/etc/raddb/policy.d/debug
including configuration file /usr/local/etc/raddb/policy.d/operator-name
including configuration file /usr/local/etc/raddb/policy.d/cui
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/status
including configuration file /usr/local/etc/raddb/sites-enabled/eduroam
main {
security {
        allow_core_dumps = no
}
}
main {
        name = "radiusd"
        prefix = "/usr/local"
        localstatedir = "/usr/local/var"
        sbindir = "/usr/local/sbin"
        logdir = "/usr/local/var/log/radius"
        run_dir = "/usr/local/var/run/radiusd"
        libdir = "/usr/local/lib"
        radacctdir = "/usr/local/var/log/radius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 1024
        pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
        checkrad = "/usr/local/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
log {
        stripped_names = no
        auth = no
        auth_badpass = no
        auth_goodpass = no
        colourise = yes
        msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
        max_attributes = 200
        reject_delay = 1.000000
        status_server = yes
        allow_vulnerable_openssl = "yes"
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
}
home_server eduroam0 {
        ipaddr = roaming0.ja.net IPv4 address [194.82.174.185]
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 30.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 300
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
}
home_server eduroam1 {
        ipaddr = roaming1.ja.net IPv4 address [194.83.56.233]
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 30.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 300
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
}
home_server eduroam2 {
        ipaddr = roaming2.ja.net IPv4 address [194.83.56.249]
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 30.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 300
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
}
home_server nps0 {
        ipaddr = 10.0.38.3
        port = 1812
        type = "auth"
        secret = <<< secret >>>
        response_window = 30.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "none"
        ping_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 300
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
}
home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
       type = "auth"
        secret = <<< secret >>>
        response_window = 20.000000
        response_timeouts = 1
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_interval = 30
        check_timeout = 4
        num_answers_to_alive = 3
        revive_interval = 120
  limit {
        max_connections = 16
        max_requests = 0
        lifetime = 0
        idle_timeout = 0
  }
  coa {
        irt = 2
        mrt = 16
        mrc = 5
        mrd = 30
  }
}
realm harper-adams.ac.uk {
}
realm live.harper.ac.uk {
}
realm hkvets.ac.uk {
}
realm students.hkvets.ac.uk {
}
home_server_pool eduroam {
        type = client-port-balance
        home_server = eduroam0
        home_server = eduroam1
        home_server = eduroam2
}
realm eduroam {
        auth_pool = eduroam
        nostrip
}
home_server_pool nps {
        type = client-port-balance
        home_server = nps0
}
realm nps {
        auth_pool = nps
}
home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
}
realm example.com {
        auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client 10.0.71.71/24 {
        ipaddr = 10.0.71.71
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client 192.168.30.120 {
        ipaddr = 192.168.30.120
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client 192.168.30.121 {
        ipaddr = 192.168.30.121
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client roaming0.ja.net {
        ipaddr = roaming0.ja.net IPv4 address [194.82.174.185]
        require_message_authenticator = no
        secret = <<< secret >>>
        shortname = "roaming0.ja.net"
        virtual_server = "eduroam"
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client roaming1.ja.net {
        ipaddr = roaming1.ja.net IPv4 address [194.83.56.233]
        require_message_authenticator = no
        secret = <<< secret >>>
        shortname = "roaming1.ja.net"
        virtual_server = "eduroam"
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client roaming2.ja.net {
        ipaddr = roaming2.ja.net IPv4 address [194.83.56.249]
        require_message_authenticator = no
        secret = <<< secret >>>
        shortname = "roaming2.ja.net"
        virtual_server = "eduroam"
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client 192.168.10.1 {
        ipaddr = 192.168.10.1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client nps {
        ipaddr = 10.0.38.3
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client localhost {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = <<< secret >>>
        nas_type = "other"
        proto = "*"
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
client localhost_ipv6 {
        ipv6addr = ::1
        require_message_authenticator = no
        secret = <<< secret >>>
  limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
  }
}
Debugger not attached
# Creating Auth-Type = digest
# Creating Autz-Type = Status-Server
radiusd: #### Instantiating modules ####
instantiate {
}
modules {
  # Loaded module rlm_mschap
  # Instantiating module "keele" from file /usr/local/etc/raddb/radiusd.conf
  mschap keele {
        use_mppe = yes
        require_encryption = yes
        require_strong = yes
        with_ntdomain_hack = yes
        ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=mercia.keele.ac.uk --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
   passchange {
   }
        allow_retry = yes
  }
rlm_mschap (keele): authenticating by calling 'ntlm_auth'
  # Loaded module rlm_cache
  # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
  cache cache_eap {
        driver = "rlm_cache_rbtree"
        key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
        ttl = 15
        max_entries = 0
        epoch = 0
        add_stats = no
  }
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
  # Loaded module rlm_realm
  # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
  realm IPASS {
        format = "prefix"
        delimiter = "/"
        ignore_default = no
        ignore_null = no
  }
  # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
  # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
  realm realmpercent {
        format = "suffix"
        delimiter = "%"
        ignore_default = no
        ignore_null = no
  }
  # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
  realm ntdomain {
        format = "prefix"
        delimiter = "\\"
        ignore_default = no
        ignore_null = no
  }
  # Loaded module rlm_eap
  # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
  eap {
        default_eap_type = "peap"
        timer_expire = 60
        ignore_unknown_eap_types = no
        mod_accounting_username_bug = no
        max_sessions = 1024
  }
   # Linked to sub-module rlm_eap_md5
   # Linked to sub-module rlm_eap_leap
   # Linked to sub-module rlm_eap_gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
   # Linked to sub-module rlm_eap_tls
   tls {
        tls = "tls-common"
   }
   tls-config tls-common {
        rsa_key_exchange = no
        dh_key_exchange = yes
        rsa_key_length = 512
        dh_key_length = 512
        verify_depth = 0
        ca_path = "/usr/local/etc/raddb/certs"
        pem_file_type = yes
        private_key_file = "/usr/local/etc/raddb/certs/server.pem"
        certificate_file = "/usr/local/etc/raddb/certs/server.pem"
        ca_file = "/usr/local/etc/raddb/certs/ca.pem"
        private_key_password = <<< secret >>>
        dh_file = "/usr/local/etc/raddb/certs/dh"
        fragment_size = 1024
        include_length = yes
        check_crl = no
        cipher_list = "DEFAULT"
        ecdh_curve = "prime256v1"
    cache {
        enable = yes
        lifetime = 24
        max_entries = 255
    }
    verify {
    }
    ocsp {
        enable = no
        override_cert_url = yes
        url = "http://127.0.0.1/ocsp/"
        use_nonce = yes
        timeout = 0
        softfail = no
    }
   }
   # Linked to sub-module rlm_eap_ttls
   ttls {
        tls = "tls-common"
        default_eap_type = "md5"
        copy_request_to_tunnel = yes
        use_tunneled_reply = yes
        virtual_server = "inner-tunnel"
        include_length = yes
        require_client_cert = no
   }
Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_peap
   peap {
        tls = "tls-common"
        default_method = "mschapv2"
        copy_request_to_tunnel = yes
        use_tunneled_reply = yes
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
        soh = no
        require_client_cert = no
   }
Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
        with_ntdomain_hack = no
        send_error = no
   }
  # Loaded module rlm_exec
  # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
        timeout = 10
  }
  # Loaded module rlm_dhcp
  # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp
  # Loaded module rlm_logintime
  # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
  logintime {
        minimum_timeout = 60
  }
  # Loaded module rlm_linelog
  # Instantiating module "default_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
  linelog default_server_log {
        filename = "/usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "default_server_log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "eduroam_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
  linelog eduroam_server_log {
        filename = "/usr/local/var/log/radius/radacct/eduroam_server_log/eduroam_server_log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "eduroam_server_log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "inner_tunnel_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
  linelog inner_tunnel_server_log {
        filename = "/usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "accounting_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
  linelog accounting_server_log {
        filename = "/usr/local/var/log/radius/radacct/accounting_server_log/accounting_log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = "%S#%{User-Name}#%{Framed-IP-Address}#%{Calling-Station-Id}#"
  }
  # Loaded module rlm_dynamic_clients
  # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
  # Loaded module rlm_detail
  # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
  detail auth_log {
        filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
  # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
  detail reply_log {
        filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
  detail pre_proxy_log {
        filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
  detail post_proxy_log {
        filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Loaded module rlm_chap
  # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
  # Instantiating module "on-site-internal-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
  linelog on-site-internal-accept-log {
        filename = "/usr/local/var/log/radius/radacct/on-site-internal-accept-log/on-site-internal-accept-log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "on-site-internal-accept-log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "on-site-external-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
  linelog on-site-external-accept-log {
        filename = "/usr/local/var/log/radius/radacct/on-site-external-accept-log/on-site-external-accept-log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "on-site-external-accept-log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "on-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
  linelog on-site-reject-log {
        filename = "/usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "on-site-reject-log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "off-site-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
  linelog off-site-accept-log {
        filename = "/usr/local/var/log/radius/radacct/off-site-accept-log/off-site-accept-log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "off-site-accept-log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "off-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
  linelog off-site-reject-log {
        filename = "/usr/local/var/log/radius/radacct/off-site-reject-log/off-site-reject-log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "off-site-reject-log.%{%{reply:Packet-Type}:-format}"
  }
  # Instantiating module "off-site-eduroam-support-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
  linelog off-site-eduroam-support-reject-log {
        filename = "/usr/local/var/log/radius/radacct/off-site-eduroam-support-reject-log/off-site-eduroam-support-reject-log-%Y%m%d"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "off-site-eduroam-support-reject-log.%{%{reply:Packet-Type}:-format}"
  }
  # Loaded module rlm_always
  # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
  always reject {
        rcode = "reject"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
always fail {
        rcode = "fail"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
  always ok {
        rcode = "ok"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
  always handled {
        rcode = "handled"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
  always invalid {
        rcode = "invalid"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
  always userlock {
        rcode = "userlock"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
  always notfound {
        rcode = "notfound"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
  always noop {
        rcode = "noop"
        simulcount = 0
        mpp = no
  }
  # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
  always updated {
        rcode = "updated"
        simulcount = 0
        mpp = no
  }
  # Loaded module rlm_replicate
  # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
  # Loaded module rlm_soh
  # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
  soh {
        dhcp = yes
  }
  # Loaded module rlm_files
  # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
  files {
        filename = "/usr/local/etc/raddb/mods-config/files/authorize"
        acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
        preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
        compat = "cistron"
  }
reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
[/usr/local/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry username@harper-adams.ac.uk ...
[/usr/local/etc/raddb/mods-config/files/authorize]:184 Cistron compatibility checks for entry DEFAULT ...
[/usr/local/etc/raddb/mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ...
[/usr/local/etc/raddb/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ...
reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
  # Loaded module rlm_passwd
  # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
  passwd etc_passwd {
        filename = "/etc/passwd"
        format = "*User-Name:Crypt-Password:"
        delimiter = ":"
        ignore_nislike = no
        ignore_empty = yes
        allow_multiple_keys = no
        hash_size = 100
  }
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
  detail {
        filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
        header = "%t"
        permissions = 384
        locking = no
        escape_filenames = no
        log_packet_header = no
  }
  # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
  mschap {
        use_mppe = yes
        require_encryption = yes
        require_strong = yes
        with_ntdomain_hack = yes
        ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-harper-adams.ac.uk} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
   passchange {
   }
        allow_retry = yes
  }
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
  # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
  exec echo {
        wait = yes
        program = "/bin/echo %{User-Name}"
        input_pairs = "request"
        output_pairs = "reply"
        shell_escape = yes
  }
  # Loaded module rlm_expiration
  # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
  # Loaded module rlm_unpack
  # Instantiating module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
  # Loaded module rlm_preprocess
  # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
  preprocess {
        huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
        hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
  # Loaded module rlm_radutmp
  # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
  radutmp {
        filename = "/usr/local/var/log/radius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 384
        caller_id = yes
  }
  # Loaded module rlm_attr_filter
  # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
        filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
        key = "%{Realm}"
        relaxed = no
  }
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
  # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
        filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
        key = "%{Realm}"
        relaxed = no
  }
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
  # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
        filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
        key = "%{User-Name}"
        relaxed = no
  }
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
  # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
        filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
        key = "%{User-Name}"
        relaxed = no
  }
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
        filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
        key = "%{User-Name}"
        relaxed = no
  }
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
  # Loaded module rlm_unix
  # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
  unix {
        radwtmp = "/usr/local/var/log/radius/radwtmp"
  }
  # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
  radutmp sradutmp {
        filename = "/usr/local/var/log/radius/sradutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        permissions = 420
        caller_id = no
  }
  # Loaded module rlm_digest
  # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
  # Loaded module rlm_expr
  # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
  expr {
        safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth
  exec ntlm_auth {
        wait = yes
        program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
        shell_escape = yes
  }
  # Loaded module rlm_pap
  # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
  pap {
        normalise = yes
  }
  # Loaded module rlm_utf8
  # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
  # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
  linelog {
        filename = "/usr/local/var/log/radius/linelog"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = "This is a log message for %{User-Name}"
        reference = "messages.%{%{Packet-Type}:-default}"
  }
  # Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
  linelog log_accounting {
        filename = "/usr/local/var/log/radius/linelog-accounting"
        escape_filenames = no
        syslog_severity = "info"
        permissions = 384
        format = ""
        reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  }
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /usr/local/etc/raddb/radiusd.conf
} # server
server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
# Loading authenticate {...}
# Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
Ignoring "ldap" (see raddb/mods-available/README.rst)
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server inner-tunnel
server default { # from file /usr/local/etc/raddb/sites-enabled/default
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server default
server status { # from file /usr/local/etc/raddb/sites-enabled/status
# Loading authorize {...}
} # server status
server eduroam { # from file /usr/local/etc/raddb/sites-enabled/eduroam
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server eduroam
/usr/local/etc/raddb/sites-enabled/default[705] Please change %{Realm}} to &Realm}
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = 127.0.0.1
        port = 18120
}
listen {
        type = "auth"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "auth"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "acct"
        ipv6addr = ::
        port = 0
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
}
listen {
        type = "status"
        ipaddr = 127.0.0.1
        port = 18121
  client admin {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = <<< secret >>>
   limit {
        max_connections = 16
        lifetime = 0
        idle_timeout = 30
   }
  }
}
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on status address 127.0.0.1 port 18121 bound to server status
Opening new proxy socket 'proxy address * port 0'
Listening on proxy address * port 54558
Ready to process requests
(0) Received Access-Request Id 66 from 192.168.30.121:59063 to 192.168.10.211:1812 length 228
(0)   User-Name = '00703070@harper-adams.ac.uk'
(0)   NAS-IP-Address = 192.168.30.121
(0)   NAS-Port = 0
(0)   NAS-Identifier = '192.168.30.121'
(0)   NAS-Port-Type = Wireless-802.11
(0)   Calling-Station-Id = '96006F089222'
(0)   Called-Station-Id = '001A1E01CF58'
(0)   Service-Type = Framed-User
(0)   Framed-MTU = 1100
(0)   EAP-Message = 0x02010020013030373033303730406861727065722d6164616d732e61632e756b
(0)   Aruba-Essid-Name = 'eduroam'
(0)   Aruba-Location-Id = 'CETLfoyer_AP01'
(0)   Aruba-AP-Group = 'apg-comp'
(0)   Message-Authenticator = 0xeea556b9e161ae9c916574dcf448efa7
(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(0)   authorize {
(0)     policy eduroam_filter {
(0)       if (User-Name !~ /@/) {
(0)       if (User-Name !~ /@/)  -> FALSE
(0)       if ("%{User-Name}" =~ /@$/) {
(0)       EXPAND %{User-Name}
(0)          --> 00703070@harper-adams.ac.uk
(0)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(0)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(0)       EXPAND %{User-Name}
(0)          --> 00703070@harper-adams.ac.uk
(0)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(0)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(0)       EXPAND %{User-Name}
(0)          --> 00703070@harper-adams.ac.uk
(0)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(0)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(0)       EXPAND %{User-Name}
(0)          --> 00703070@harper-adams.ac.uk
(0)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(0)     } # policy eduroam_filter = notfound
(0)     [preprocess] = ok
(0)     policy operator-name.authorize {
(0)       if ("%{client:Operator-Name}") {
(0)       EXPAND %{client:Operator-Name}
(0)          --> 1harper-adams.ac.uk
(0)       if ("%{client:Operator-Name}")  -> TRUE
(0)       if ("%{client:Operator-Name}")  {
(0)         update request {
(0)           EXPAND %{client:Operator-Name}
(0)              --> 1harper-adams.ac.uk
(0)           &Operator-Name = 1harper-adams.ac.uk
(0)         } # update request = noop
(0)       } # if ("%{client:Operator-Name}")  = noop
(0)     } # policy operator-name.authorize = noop
(0)     policy cui.authorize {
(0)       if ("%{client:add_cui}" == 'yes') {
(0)       EXPAND %{client:add_cui}
(0)          --> yes
(0)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(0)       if ("%{client:add_cui}" == 'yes')  {
(0)         update request {
(0)           &Chargeable-User-Identity := 0x00
(0)         } # update request = noop
(0)       } # if ("%{client:add_cui}" == 'yes')  = noop
(0)     } # policy cui.authorize = noop
(0)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(0)     EXPAND %{User-Name}
(0)        --> 00703070@harper-adams.ac.uk
(0)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(0)     else {
(0) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(0) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(0) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(0) auth_log: EXPAND %t
(0) auth_log:    --> Mon Sep  7 19:55:28 2020
(0)       [auth_log] = ok
(0)     } # else = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(0) suffix: Found realm "harper-adams.ac.uk"
(0) suffix: Adding Stripped-User-Name = "00703070"
(0) suffix: Adding Realm = "harper-adams.ac.uk"
(0) suffix: Authentication realm is LOCAL
(0)     [suffix] = ok
(0)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(0)     EXPAND %{User-Name}
(0)        --> 00703070@harper-adams.ac.uk
(0)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(0)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(0)       [noop] = noop
(0)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(0)     ... skipping elsif for request 0: Preceding "if" was taken
(0)     ... skipping elsif for request 0: Preceding "if" was taken
(0)     ... skipping elsif for request 0: Preceding "if" was taken
(0)     ... skipping else for request 0: Preceding "if" was taken
(0) eap: Peer sent code Response (2) ID 1 length 32
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0)   authenticate {
(0) eap: Peer sent method Identity (1)
(0) eap: Calling eap_peap to process EAP data
(0) eap_peap: Flushing SSL sessions (of #0)
(0) eap_peap: Initiate
(0) eap_peap: Start returned 1
(0) eap: EAP session adding &reply:State = 0x5d232d885d2134dd
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found.  Ignoring.
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) Sent Access-Challenge Id 66 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(0)   EAP-Message = 0x010200061920
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0x5d232d885d2134dd60443f4cd8d35175
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 36 from 192.168.30.121:59063 to 192.168.10.211:1812 length 365
(1)   User-Name = '00703070@harper-adams.ac.uk'
(1)   NAS-IP-Address = 192.168.30.121
(1)   NAS-Port = 0
(1)   NAS-Identifier = '192.168.30.121'
(1)   NAS-Port-Type = Wireless-802.11
(1)   Calling-Station-Id = '96006F089222'
(1)   Called-Station-Id = '001A1E01CF58'
(1)   Service-Type = Framed-User
(1)   Framed-MTU = 1100
(1)   EAP-Message = 0x0202009719800000008d16030100880100008403033d6bb98ca56f708bfefc5724df297400c611b45f02b6135a065b604a87f97e4d000028c02bc02fc02cc030cca9cca8c009c013c00ac014c007c011009c009d002f003c0035003d0005000a0100003300170000ff01000100000a00080006001d0017
(1)   State = 0x5d232d885d2134dd60443f4cd8d35175
(1)   Aruba-Essid-Name = 'eduroam'
(1)   Aruba-Location-Id = 'CETLfoyer_AP01'
(1)   Aruba-AP-Group = 'apg-comp'
(1)   Message-Authenticator = 0x221852c8ef612ff7a655f72f18256d56
(1) session-state: No cached attributes
(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(1)   authorize {
(1)     policy eduroam_filter {
(1)       if (User-Name !~ /@/) {
(1)       if (User-Name !~ /@/)  -> FALSE
(1)       if ("%{User-Name}" =~ /@$/) {
(1)       EXPAND %{User-Name}
(1)          --> 00703070@harper-adams.ac.uk
(1)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(1)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(1)       EXPAND %{User-Name}
(1)          --> 00703070@harper-adams.ac.uk
(1)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(1)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(1)       EXPAND %{User-Name}
(1)          --> 00703070@harper-adams.ac.uk
(1)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(1)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(1)       EXPAND %{User-Name}
(1)          --> 00703070@harper-adams.ac.uk
(1)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(1)     } # policy eduroam_filter = notfound
(1)     [preprocess] = ok
(1)     policy operator-name.authorize {
(1)       if ("%{client:Operator-Name}") {
(1)       EXPAND %{client:Operator-Name}
(1)          --> 1harper-adams.ac.uk
(1)       if ("%{client:Operator-Name}")  -> TRUE
(1)       if ("%{client:Operator-Name}")  {
(1)         update request {
(1)           EXPAND %{client:Operator-Name}
(1)              --> 1harper-adams.ac.uk
(1)           &Operator-Name = 1harper-adams.ac.uk
(1)         } # update request = noop
(1)       } # if ("%{client:Operator-Name}")  = noop
(1)     } # policy operator-name.authorize = noop
(1)     policy cui.authorize {
(1)       if ("%{client:add_cui}" == 'yes') {
(1)       EXPAND %{client:add_cui}
(1)          --> yes
(1)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(1)       if ("%{client:add_cui}" == 'yes')  {
(1)         update request {
(1)           &Chargeable-User-Identity := 0x00
(1)         } # update request = noop
(1)       } # if ("%{client:add_cui}" == 'yes')  = noop
(1)     } # policy cui.authorize = noop
(1)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(1)     EXPAND %{User-Name}
(1)        --> 00703070@harper-adams.ac.uk
(1)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(1)     else {
(1) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(1) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(1) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(1) auth_log: EXPAND %t
(1) auth_log:    --> Mon Sep  7 19:55:28 2020
(1)       [auth_log] = ok
(1)     } # else = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(1) suffix: Found realm "harper-adams.ac.uk"
(1) suffix: Adding Stripped-User-Name = "00703070"
(1) suffix: Adding Realm = "harper-adams.ac.uk"
(1) suffix: Authentication realm is LOCAL
(1)     [suffix] = ok
(1)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(1)     EXPAND %{User-Name}
(1)        --> 00703070@harper-adams.ac.uk
(1)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(1)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(1)       [noop] = noop
(1)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(1)     ... skipping elsif for request 1: Preceding "if" was taken
(1)     ... skipping elsif for request 1: Preceding "if" was taken
(1)     ... skipping elsif for request 1: Preceding "if" was taken
(1)     ... skipping else for request 1: Preceding "if" was taken
(1) eap: Peer sent code Response (2) ID 2 length 151
(1) eap: Continuing tunnel setup
(1)     [eap] = ok
(1)   } # authorize = ok
(1) Found Auth-Type = EAP
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0x5d232d885d2134dd
(1) eap: Finished EAP session with state 0x5d232d885d2134dd
(1) eap: Previous EAP request found for state 0x5d232d885d2134dd, released from the list
(1) eap: Peer sent method PEAP (25)
(1) eap: EAP PEAP (25)
(1) eap: Calling eap_peap to process EAP data
(1) eap_peap: processing EAP-TLS
(1) eap_peap: TLS Length 141
(1) eap_peap: Length Included
(1) eap_peap: eaptls_verify returned 11
(1) eap_peap: (other): before/accept initialization
(1) eap_peap: TLS_accept: before/accept initialization
(1) eap_peap: <<< TLS 1.2  [length 0088]
(1) eap_peap: TLS_accept: SSLv3 read client hello A
(1) eap_peap: >>> TLS 1.2  [length 0059]
(1) eap_peap: TLS_accept: SSLv3 write server hello A
(1) eap_peap: >>> TLS 1.2  [length 098e]
(1) eap_peap: TLS_accept: SSLv3 write certificate A
(1) eap_peap: >>> TLS 1.2  [length 014d]
(1) eap_peap: TLS_accept: SSLv3 write key exchange A
(1) eap_peap: >>> TLS 1.2  [length 0004]
(1) eap_peap: TLS_accept: SSLv3 write server done A
(1) eap_peap: TLS_accept: SSLv3 flush data
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
(1) eap_peap: eaptls_process returned 13
(1) eap_peap: FR_TLS_HANDLED
(1) eap: EAP session adding &reply:State = 0x5d232d885c2034dd
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found.  Ignoring.
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) Sent Access-Challenge Id 36 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(1)   EAP-Message = 0x010303ec19c000000b4c16030300590200005503035f5682202fb7a02869ff5572887e4559c92fea1887530f7a4ce236db46270e3e205c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08cc02f00000dff01000100000b000403000102160303098e0b00098a000987000430
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0x5d232d885c2034dd60443f4cd8d35175
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 101 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(2)   User-Name = '00703070@harper-adams.ac.uk'
(2)   NAS-IP-Address = 192.168.30.121
(2)   NAS-Port = 0
(2)   NAS-Identifier = '192.168.30.121'
(2)   NAS-Port-Type = Wireless-802.11
(2)   Calling-Station-Id = '96006F089222'
(2)   Called-Station-Id = '001A1E01CF58'
(2)   Service-Type = Framed-User
(2)   Framed-MTU = 1100
(2)   EAP-Message = 0x020300061900
(2)   State = 0x5d232d885c2034dd60443f4cd8d35175
(2)   Aruba-Essid-Name = 'eduroam'
(2)   Aruba-Location-Id = 'CETLfoyer_AP01'
(2)   Aruba-AP-Group = 'apg-comp'
(2)   Message-Authenticator = 0x4a33f9c19d7d272caf3b88dd8235def4
(2) session-state: No cached attributes
(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(2)   authorize {
(2)     policy eduroam_filter {
(2)       if (User-Name !~ /@/) {
(2)       if (User-Name !~ /@/)  -> FALSE
(2)       if ("%{User-Name}" =~ /@$/) {
(2)       EXPAND %{User-Name}
(2)          --> 00703070@harper-adams.ac.uk
(2)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(2)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(2)       EXPAND %{User-Name}
(2)          --> 00703070@harper-adams.ac.uk
(2)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(2)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(2)       EXPAND %{User-Name}
(2)          --> 00703070@harper-adams.ac.uk
(2)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(2)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(2)       EXPAND %{User-Name}
(2)          --> 00703070@harper-adams.ac.uk
(2)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(2)     } # policy eduroam_filter = notfound
(2)     [preprocess] = ok
(2)     policy operator-name.authorize {
(2)       if ("%{client:Operator-Name}") {
(2)       EXPAND %{client:Operator-Name}
(2)          --> 1harper-adams.ac.uk
(2)       if ("%{client:Operator-Name}")  -> TRUE
(2)       if ("%{client:Operator-Name}")  {
(2)         update request {
(2)           EXPAND %{client:Operator-Name}
(2)              --> 1harper-adams.ac.uk
(2)           &Operator-Name = 1harper-adams.ac.uk
(2)         } # update request = noop
(2)       } # if ("%{client:Operator-Name}")  = noop
(2)     } # policy operator-name.authorize = noop
(2)     policy cui.authorize {
(2)       if ("%{client:add_cui}" == 'yes') {
(2)       EXPAND %{client:add_cui}
(2)          --> yes
(2)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(2)       if ("%{client:add_cui}" == 'yes')  {
(2)         update request {
(2)           &Chargeable-User-Identity := 0x00
(2)         } # update request = noop
(2)       } # if ("%{client:add_cui}" == 'yes')  = noop
(2)     } # policy cui.authorize = noop
(2)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(2)     EXPAND %{User-Name}
(2)        --> 00703070@harper-adams.ac.uk
(2)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(2)     else {
(2) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(2) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(2) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(2) auth_log: EXPAND %t
(2) auth_log:    --> Mon Sep  7 19:55:28 2020
(2)       [auth_log] = ok
(2)     } # else = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(2) suffix: Found realm "harper-adams.ac.uk"
(2) suffix: Adding Stripped-User-Name = "00703070"
(2) suffix: Adding Realm = "harper-adams.ac.uk"
(2) suffix: Authentication realm is LOCAL
(2)     [suffix] = ok
(2)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(2)     EXPAND %{User-Name}
(2)        --> 00703070@harper-adams.ac.uk
(2)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(2)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(2)       [noop] = noop
(2)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(2)     ... skipping elsif for request 2: Preceding "if" was taken
(2)     ... skipping elsif for request 2: Preceding "if" was taken
(2)     ... skipping elsif for request 2: Preceding "if" was taken
(2)     ... skipping else for request 2: Preceding "if" was taken
(2) eap: Peer sent code Response (2) ID 3 length 6
(2) eap: Continuing tunnel setup
(2)     [eap] = ok
(2)   } # authorize = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0x5d232d885c2034dd
(2) eap: Finished EAP session with state 0x5d232d885c2034dd
(2) eap: Previous EAP request found for state 0x5d232d885c2034dd, released from the list
(2) eap: Peer sent method PEAP (25)
(2) eap: EAP PEAP (25)
(2) eap: Calling eap_peap to process EAP data
(2) eap_peap: processing EAP-TLS
(2) eap_peap: Received TLS ACK
(2) eap_peap: Received TLS ACK
(2) eap_peap: ACK handshake fragment handler
(2) eap_peap: eaptls_verify returned 1
(2) eap_peap: eaptls_process returned 13
(2) eap_peap: FR_TLS_HANDLED
(2) eap: EAP session adding &reply:State = 0x5d232d885f2734dd
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) Post-Auth-Type sub-section not found.  Ignoring.
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) Sent Access-Challenge Id 101 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(2)   EAP-Message = 0x010403e81940c62d385a960250f6b378ff612d4e0358d9e5148a4625e6eb2f327082ccac93595352448e797948d8e21b0e9ce3a327425387a40fd951a553641188a18a0043138afb9919c64efc9d62007450b116f5a314ea1febd84785af8dd231b48cbd10608dfaf8ba002ab346f2a6298790750a64a3
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0x5d232d885f2734dd60443f4cd8d35175
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 246 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(3)   User-Name = '00703070@harper-adams.ac.uk'
(3)   NAS-IP-Address = 192.168.30.121
(3)   NAS-Port = 0
(3)   NAS-Identifier = '192.168.30.121'
(3)   NAS-Port-Type = Wireless-802.11
(3)   Calling-Station-Id = '96006F089222'
(3)   Called-Station-Id = '001A1E01CF58'
(3)   Service-Type = Framed-User
(3)   Framed-MTU = 1100
(3)   EAP-Message = 0x020400061900
(3)   State = 0x5d232d885f2734dd60443f4cd8d35175
(3)   Aruba-Essid-Name = 'eduroam'
(3)   Aruba-Location-Id = 'CETLfoyer_AP01'
(3)   Aruba-AP-Group = 'apg-comp'
(3)   Message-Authenticator = 0xf2cc65af35bb01ad9e3dad5a7462c71d
(3) session-state: No cached attributes
(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(3)   authorize {
(3)     policy eduroam_filter {
(3)       if (User-Name !~ /@/) {
(3)       if (User-Name !~ /@/)  -> FALSE
(3)       if ("%{User-Name}" =~ /@$/) {
(3)       EXPAND %{User-Name}
(3)          --> 00703070@harper-adams.ac.uk
(3)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(3)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(3)       EXPAND %{User-Name}
(3)          --> 00703070@harper-adams.ac.uk
(3)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(3)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(3)       EXPAND %{User-Name}
(3)          --> 00703070@harper-adams.ac.uk
(3)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(3)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(3)       EXPAND %{User-Name}
(3)          --> 00703070@harper-adams.ac.uk
(3)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(3)     } # policy eduroam_filter = notfound
(3)     [preprocess] = ok
(3)     policy operator-name.authorize {
(3)       if ("%{client:Operator-Name}") {
(3)       EXPAND %{client:Operator-Name}
(3)          --> 1harper-adams.ac.uk
(3)       if ("%{client:Operator-Name}")  -> TRUE
(3)       if ("%{client:Operator-Name}")  {
(3)         update request {
(3)           EXPAND %{client:Operator-Name}
(3)              --> 1harper-adams.ac.uk
(3)           &Operator-Name = 1harper-adams.ac.uk
(3)         } # update request = noop
(3)       } # if ("%{client:Operator-Name}")  = noop
(3)     } # policy operator-name.authorize = noop
(3)     policy cui.authorize {
(3)       if ("%{client:add_cui}" == 'yes') {
(3)       EXPAND %{client:add_cui}
(3)          --> yes
(3)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(3)       if ("%{client:add_cui}" == 'yes')  {
(3)         update request {
(3)           &Chargeable-User-Identity := 0x00
(3)         } # update request = noop
(3)       } # if ("%{client:add_cui}" == 'yes')  = noop
(3)     } # policy cui.authorize = noop
(3)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(3)     EXPAND %{User-Name}
(3)        --> 00703070@harper-adams.ac.uk
(3)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(3)     else {
(3) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(3) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(3) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(3) auth_log: EXPAND %t
(3) auth_log:    --> Mon Sep  7 19:55:28 2020
(3)       [auth_log] = ok
(3)     } # else = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(3) suffix: Found realm "harper-adams.ac.uk"
(3) suffix: Adding Stripped-User-Name = "00703070"
(3) suffix: Adding Realm = "harper-adams.ac.uk"
(3) suffix: Authentication realm is LOCAL
(3)     [suffix] = ok
(3)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(3)     EXPAND %{User-Name}
(3)        --> 00703070@harper-adams.ac.uk
(3)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(3)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(3)       [noop] = noop
(3)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(3)     ... skipping elsif for request 3: Preceding "if" was taken
(3)     ... skipping elsif for request 3: Preceding "if" was taken
(3)     ... skipping elsif for request 3: Preceding "if" was taken
(3)     ... skipping else for request 3: Preceding "if" was taken
(3) eap: Peer sent code Response (2) ID 4 length 6
(3) eap: Continuing tunnel setup
(3)     [eap] = ok
(3)   } # authorize = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0x5d232d885f2734dd
(3) eap: Finished EAP session with state 0x5d232d885f2734dd
(3) eap: Previous EAP request found for state 0x5d232d885f2734dd, released from the list
(3) eap: Peer sent method PEAP (25)
(3) eap: EAP PEAP (25)
(3) eap: Calling eap_peap to process EAP data
(3) eap_peap: processing EAP-TLS
(3) eap_peap: Received TLS ACK
(3) eap_peap: Received TLS ACK
(3) eap_peap: ACK handshake fragment handler
(3) eap_peap: eaptls_verify returned 1
(3) eap_peap: eaptls_process returned 13
(3) eap_peap: FR_TLS_HANDLED
(3) eap: EAP session adding &reply:State = 0x5d232d885e2634dd
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) Post-Auth-Type sub-section not found.  Ignoring.
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) Sent Access-Challenge Id 246 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(3)   EAP-Message = 0x0105038e1900f6e330ad8b0cf435a181bda481ba3081b7310b3009060355040613024742311330110603550408130a5368726f7073686972653110300e060355040713074e6577706f72743120301e060355040a1317486172706572204164616d7320556e69766572736974793130302e06092a864886
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0x5d232d885e2634dd60443f4cd8d35175
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 93 from 192.168.30.121:59063 to 192.168.10.211:1812 length 350
(4)   User-Name = '00703070@harper-adams.ac.uk'
(4)   NAS-IP-Address = 192.168.30.121
(4)   NAS-Port = 0
(4)   NAS-Identifier = '192.168.30.121'
(4)   NAS-Port-Type = Wireless-802.11
(4)   Calling-Station-Id = '96006F089222'
(4)   Called-Station-Id = '001A1E01CF58'
(4)   Service-Type = Framed-User
(4)   Framed-MTU = 1100
(4)   EAP-Message = 0x0205008819800000007e1603030046100000424104ea56d436078e56e2ae2b44a72fce084ff89022001433c236008ea69f4edb350f1ca370aa1f2747dde6eca44f4c0da3dc9a19cacbdb7a2dd9dd517c8db718015114030300010116030300280000000000000000710ce2eedf52a18519e02d3291cf76
(4)   State = 0x5d232d885e2634dd60443f4cd8d35175
(4)   Aruba-Essid-Name = 'eduroam'
(4)   Aruba-Location-Id = 'CETLfoyer_AP01'
(4)   Aruba-AP-Group = 'apg-comp'
(4)   Message-Authenticator = 0x3910c0df262016725b161488467b1bde
(4) session-state: No cached attributes
(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(4)   authorize {
(4)     policy eduroam_filter {
(4)       if (User-Name !~ /@/) {
(4)       if (User-Name !~ /@/)  -> FALSE
(4)       if ("%{User-Name}" =~ /@$/) {
(4)       EXPAND %{User-Name}
(4)          --> 00703070@harper-adams.ac.uk
(4)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(4)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(4)       EXPAND %{User-Name}
(4)          --> 00703070@harper-adams.ac.uk
(4)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(4)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(4)       EXPAND %{User-Name}
(4)          --> 00703070@harper-adams.ac.uk
(4)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(4)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(4)       EXPAND %{User-Name}
(4)          --> 00703070@harper-adams.ac.uk
(4)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(4)     } # policy eduroam_filter = notfound
(4)     [preprocess] = ok
(4)     policy operator-name.authorize {
(4)       if ("%{client:Operator-Name}") {
(4)       EXPAND %{client:Operator-Name}
(4)          --> 1harper-adams.ac.uk
(4)       if ("%{client:Operator-Name}")  -> TRUE
(4)       if ("%{client:Operator-Name}")  {
(4)         update request {
(4)           EXPAND %{client:Operator-Name}
(4)              --> 1harper-adams.ac.uk
(4)           &Operator-Name = 1harper-adams.ac.uk
(4)         } # update request = noop
(4)       } # if ("%{client:Operator-Name}")  = noop
(4)     } # policy operator-name.authorize = noop
(4)     policy cui.authorize {
(4)       if ("%{client:add_cui}" == 'yes') {
(4)       EXPAND %{client:add_cui}
(4)          --> yes
(4)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(4)       if ("%{client:add_cui}" == 'yes')  {
(4)         update request {
(4)           &Chargeable-User-Identity := 0x00
(4)         } # update request = noop
(4)       } # if ("%{client:add_cui}" == 'yes')  = noop
(4)     } # policy cui.authorize = noop
(4)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(4)     EXPAND %{User-Name}
(4)        --> 00703070@harper-adams.ac.uk
(4)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(4)     else {
(4) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(4) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(4) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(4) auth_log: EXPAND %t
(4) auth_log:    --> Mon Sep  7 19:55:28 2020
(4)       [auth_log] = ok
(4)     } # else = ok
(4)     [chap] = noop
(4)     [mschap] = noop
(4)     [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(4) suffix: Found realm "harper-adams.ac.uk"
(4) suffix: Adding Stripped-User-Name = "00703070"
(4) suffix: Adding Realm = "harper-adams.ac.uk"
(4) suffix: Authentication realm is LOCAL
(4)     [suffix] = ok
(4)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(4)     EXPAND %{User-Name}
(4)        --> 00703070@harper-adams.ac.uk
(4)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(4)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(4)       [noop] = noop
(4)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(4)     ... skipping elsif for request 4: Preceding "if" was taken
(4)     ... skipping elsif for request 4: Preceding "if" was taken
(4)     ... skipping elsif for request 4: Preceding "if" was taken
(4)     ... skipping else for request 4: Preceding "if" was taken
(4) eap: Peer sent code Response (2) ID 5 length 136
(4) eap: Continuing tunnel setup
(4)     [eap] = ok
(4)   } # authorize = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4)   authenticate {
(4) eap: Expiring EAP session with state 0x5d232d885e2634dd
(4) eap: Finished EAP session with state 0x5d232d885e2634dd
(4) eap: Previous EAP request found for state 0x5d232d885e2634dd, released from the list
(4) eap: Peer sent method PEAP (25)
(4) eap: EAP PEAP (25)
(4) eap: Calling eap_peap to process EAP data
(4) eap_peap: processing EAP-TLS
(4) eap_peap: TLS Length 126
(4) eap_peap: Length Included
(4) eap_peap: eaptls_verify returned 11
(4) eap_peap: <<< TLS 1.2  [length 0046]
(4) eap_peap: TLS_accept: SSLv3 read client key exchange A
(4) eap_peap: <<< TLS 1.2  [length 0001]
(4) eap_peap: <<< TLS 1.2  [length 0010]
(4) eap_peap: TLS_accept: SSLv3 read finished A
(4) eap_peap: >>> TLS 1.2  [length 0001]
(4) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(4) eap_peap: >>> TLS 1.2  [length 0010]
(4) eap_peap: TLS_accept: SSLv3 write finished A
(4) eap_peap: TLS_accept: SSLv3 flush data
  TLS: adding session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c to cache
(4) eap_peap: (other): SSL negotiation finished successfully
SSL Connection Established
(4) eap_peap: eaptls_process returned 13
(4) eap_peap: FR_TLS_HANDLED
(4) eap: EAP session adding &reply:State = 0x5d232d88592534dd
(4)     [eap] = handled
(4)   } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) Post-Auth-Type sub-section not found.  Ignoring.
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) Sent Access-Challenge Id 93 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(4)   EAP-Message = 0x0106003919001403030001011603030028dbf9a5fe6b58c9af4878bf5aad50c37591306f56a34e452abe46d4816656f7c59a7d672a722fba90
(4)   Message-Authenticator = 0x00000000000000000000000000000000
(4)   State = 0x5d232d88592534dd60443f4cd8d35175
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 254 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(5)   User-Name = '00703070@harper-adams.ac.uk'
(5)   NAS-IP-Address = 192.168.30.121
(5)   NAS-Port = 0
(5)   NAS-Identifier = '192.168.30.121'
(5)   NAS-Port-Type = Wireless-802.11
(5)   Calling-Station-Id = '96006F089222'
(5)   Called-Station-Id = '001A1E01CF58'
(5)   Service-Type = Framed-User
(5)   Framed-MTU = 1100
(5)   EAP-Message = 0x020600061900
(5)   State = 0x5d232d88592534dd60443f4cd8d35175
(5)   Aruba-Essid-Name = 'eduroam'
(5)   Aruba-Location-Id = 'CETLfoyer_AP01'
(5)   Aruba-AP-Group = 'apg-comp'
(5)   Message-Authenticator = 0xc6d5fb9e7db34af2acf0e6c12d84368a
(5) session-state: No cached attributes
(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(5)   authorize {
(5)     policy eduroam_filter {
(5)       if (User-Name !~ /@/) {
(5)       if (User-Name !~ /@/)  -> FALSE
(5)       if ("%{User-Name}" =~ /@$/) {
(5)       EXPAND %{User-Name}
(5)          --> 00703070@harper-adams.ac.uk
(5)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(5)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(5)       EXPAND %{User-Name}
(5)          --> 00703070@harper-adams.ac.uk
(5)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(5)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(5)       EXPAND %{User-Name}
(5)          --> 00703070@harper-adams.ac.uk
(5)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(5)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(5)       EXPAND %{User-Name}
(5)          --> 00703070@harper-adams.ac.uk
(5)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(5)     } # policy eduroam_filter = notfound
(5)     [preprocess] = ok
(5)     policy operator-name.authorize {
(5)       if ("%{client:Operator-Name}") {
(5)       EXPAND %{client:Operator-Name}
(5)          --> 1harper-adams.ac.uk
(5)       if ("%{client:Operator-Name}")  -> TRUE
(5)       if ("%{client:Operator-Name}")  {
(5)         update request {
(5)           EXPAND %{client:Operator-Name}
(5)              --> 1harper-adams.ac.uk
(5)           &Operator-Name = 1harper-adams.ac.uk
(5)         } # update request = noop
(5)       } # if ("%{client:Operator-Name}")  = noop
(5)     } # policy operator-name.authorize = noop
(5)     policy cui.authorize {
(5)       if ("%{client:add_cui}" == 'yes') {
(5)       EXPAND %{client:add_cui}
(5)          --> yes
(5)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(5)       if ("%{client:add_cui}" == 'yes')  {
(5)         update request {
(5)           &Chargeable-User-Identity := 0x00
(5)         } # update request = noop
(5)       } # if ("%{client:add_cui}" == 'yes')  = noop
(5)     } # policy cui.authorize = noop
(5)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(5)     EXPAND %{User-Name}
(5)        --> 00703070@harper-adams.ac.uk
(5)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(5)     else {
(5) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(5) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(5) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(5) auth_log: EXPAND %t
(5) auth_log:    --> Mon Sep  7 19:55:28 2020
(5)       [auth_log] = ok
(5)     } # else = ok
(5)     [chap] = noop
(5)     [mschap] = noop
(5)     [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(5) suffix: Found realm "harper-adams.ac.uk"
(5) suffix: Adding Stripped-User-Name = "00703070"
(5) suffix: Adding Realm = "harper-adams.ac.uk"
(5) suffix: Authentication realm is LOCAL
(5)     [suffix] = ok
(5)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(5)     EXPAND %{User-Name}
(5)        --> 00703070@harper-adams.ac.uk
(5)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(5)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(5)       [noop] = noop
(5)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(5)     ... skipping elsif for request 5: Preceding "if" was taken
(5)     ... skipping elsif for request 5: Preceding "if" was taken
(5)     ... skipping elsif for request 5: Preceding "if" was taken
(5)     ... skipping else for request 5: Preceding "if" was taken
(5) eap: Peer sent code Response (2) ID 6 length 6
(5) eap: Continuing tunnel setup
(5)     [eap] = ok
(5)   } # authorize = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5)   authenticate {
(5) eap: Expiring EAP session with state 0x5d232d88592534dd
(5) eap: Finished EAP session with state 0x5d232d88592534dd
(5) eap: Previous EAP request found for state 0x5d232d88592534dd, released from the list
(5) eap: Peer sent method PEAP (25)
(5) eap: EAP PEAP (25)
(5) eap: Calling eap_peap to process EAP data
(5) eap_peap: processing EAP-TLS
(5) eap_peap: Received TLS ACK
(5) eap_peap: Received TLS ACK
(5) eap_peap: ACK handshake is finished
(5) eap_peap: eaptls_verify returned 3
(5) eap_peap: eaptls_process returned 3
(5) eap_peap: FR_TLS_SUCCESS
(5) eap_peap: Session established.  Decoding tunneled attributes
(5) eap_peap: PEAP state TUNNEL ESTABLISHED
(5) eap: EAP session adding &reply:State = 0x5d232d88582434dd
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found.  Ignoring.
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) Sent Access-Challenge Id 254 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(5)   EAP-Message = 0x010700281900170303001ddbf9a5fe6b58c9b06dc36a69e0eb76f60129709c828fc278149f06d1b9
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0x5d232d88582434dd60443f4cd8d35175
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 236 from 192.168.30.121:59063 to 192.168.10.211:1812 length 277
(6)   User-Name = '00703070@harper-adams.ac.uk'
(6)   NAS-IP-Address = 192.168.30.121
(6)   NAS-Port = 0
(6)   NAS-Identifier = '192.168.30.121'
(6)   NAS-Port-Type = Wireless-802.11
(6)   Calling-Station-Id = '96006F089222'
(6)   Called-Station-Id = '001A1E01CF58'
(6)   Service-Type = Framed-User
(6)   Framed-MTU = 1100
(6)   EAP-Message = 0x0207003f190017030300340000000000000001f7d1c2bc51c0f6614a1bc2831a5e10b3a0532248f7cde8cd0675872eafaf1768f108ad5c3b6a73038f8c63bf
(6)   State = 0x5d232d88582434dd60443f4cd8d35175
(6)   Aruba-Essid-Name = 'eduroam'
(6)   Aruba-Location-Id = 'CETLfoyer_AP01'
(6)   Aruba-AP-Group = 'apg-comp'
(6)   Message-Authenticator = 0x8a17b53039a0230e8b09c960ea038aea
(6) session-state: No cached attributes
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(6)   authorize {
(6)     policy eduroam_filter {
(6)       if (User-Name !~ /@/) {
(6)       if (User-Name !~ /@/)  -> FALSE
(6)       if ("%{User-Name}" =~ /@$/) {
(6)       EXPAND %{User-Name}
(6)          --> 00703070@harper-adams.ac.uk
(6)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(6)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(6)       EXPAND %{User-Name}
(6)          --> 00703070@harper-adams.ac.uk
(6)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(6)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(6)       EXPAND %{User-Name}
(6)          --> 00703070@harper-adams.ac.uk
(6)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(6)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(6)       EXPAND %{User-Name}
(6)          --> 00703070@harper-adams.ac.uk
(6)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(6)     } # policy eduroam_filter = notfound
(6)     [preprocess] = ok
(6)     policy operator-name.authorize {
(6)       if ("%{client:Operator-Name}") {
(6)       EXPAND %{client:Operator-Name}
(6)          --> 1harper-adams.ac.uk
(6)       if ("%{client:Operator-Name}")  -> TRUE
(6)       if ("%{client:Operator-Name}")  {
(6)         update request {
(6)           EXPAND %{client:Operator-Name}
(6)              --> 1harper-adams.ac.uk
(6)           &Operator-Name = 1harper-adams.ac.uk
(6)         } # update request = noop
(6)       } # if ("%{client:Operator-Name}")  = noop
(6)     } # policy operator-name.authorize = noop
(6)     policy cui.authorize {
(6)       if ("%{client:add_cui}" == 'yes') {
(6)       EXPAND %{client:add_cui}
(6)          --> yes
(6)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(6)       if ("%{client:add_cui}" == 'yes')  {
(6)         update request {
(6)           &Chargeable-User-Identity := 0x00
(6)         } # update request = noop
(6)       } # if ("%{client:add_cui}" == 'yes')  = noop
(6)     } # policy cui.authorize = noop
(6)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(6)     EXPAND %{User-Name}
(6)        --> 00703070@harper-adams.ac.uk
(6)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(6)     else {
(6) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(6) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(6) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(6) auth_log: EXPAND %t
(6) auth_log:    --> Mon Sep  7 19:55:28 2020
(6)       [auth_log] = ok
(6)     } # else = ok
(6)     [chap] = noop
(6)     [mschap] = noop
(6)     [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(6) suffix: Found realm "harper-adams.ac.uk"
(6) suffix: Adding Stripped-User-Name = "00703070"
(6) suffix: Adding Realm = "harper-adams.ac.uk"
(6) suffix: Authentication realm is LOCAL
(6)     [suffix] = ok
(6)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(6)     EXPAND %{User-Name}
(6)        --> 00703070@harper-adams.ac.uk
(6)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(6)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(6)       [noop] = noop
(6)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(6)     ... skipping elsif for request 6: Preceding "if" was taken
(6)     ... skipping elsif for request 6: Preceding "if" was taken
(6)     ... skipping elsif for request 6: Preceding "if" was taken
(6)     ... skipping else for request 6: Preceding "if" was taken
(6) eap: Peer sent code Response (2) ID 7 length 63
(6) eap: Continuing tunnel setup
(6)     [eap] = ok
(6)   } # authorize = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6)   authenticate {
(6) eap: Expiring EAP session with state 0x5d232d88582434dd
(6) eap: Finished EAP session with state 0x5d232d88582434dd
(6) eap: Previous EAP request found for state 0x5d232d88582434dd, released from the list
(6) eap: Peer sent method PEAP (25)
(6) eap: EAP PEAP (25)
(6) eap: Calling eap_peap to process EAP data
(6) eap_peap: processing EAP-TLS
(6) eap_peap: eaptls_verify returned 7
(6) eap_peap: Done initial handshake
(6) eap_peap: eaptls_process returned 7
(6) eap_peap: FR_TLS_OK
(6) eap_peap: Session established.  Decoding tunneled attributes
(6) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(6) eap_peap: Identity - 00703070@harper-adams.ac.uk
(6) eap_peap: Got inner identity '00703070@harper-adams.ac.uk'
(6) eap_peap: Setting default EAP type for tunneled EAP session
(6) eap_peap: Got tunneled request
(6) eap_peap:   EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) eap_peap: Setting User-Name to 00703070@harper-adams.ac.uk
(6) eap_peap: Sending tunneled request to inner-tunnel
(6) eap_peap:   EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(6) eap_peap:   User-Name = '00703070@harper-adams.ac.uk'
(6) eap_peap:   NAS-IP-Address = 192.168.30.121
(6) eap_peap:   NAS-Port = 0
(6) eap_peap:   NAS-Identifier = '192.168.30.121'
(6) eap_peap:   NAS-Port-Type = Wireless-802.11
(6) eap_peap:   Calling-Station-Id = '96006F089222'
(6) eap_peap:   Called-Station-Id = '001A1E01CF58'
(6) eap_peap:   Service-Type = Framed-User
(6) eap_peap:   Framed-MTU = 1100
(6) eap_peap:   Aruba-Essid-Name = 'eduroam'
(6) eap_peap:   Aruba-Location-Id = 'CETLfoyer_AP01'
(6) eap_peap:   Aruba-AP-Group = 'apg-comp'
(6) eap_peap:   Event-Timestamp = 'Sep  7 2020 19:55:28 BST'
(6) eap_peap:   Operator-Name = '1harper-adams.ac.uk'
(6) eap_peap:   Chargeable-User-Identity := 0x00
(6) Virtual server inner-tunnel received request
(6)   EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6)   FreeRADIUS-Proxied-To = 127.0.0.1
(6)   User-Name = '00703070@harper-adams.ac.uk'
(6)   NAS-IP-Address = 192.168.30.121
(6)   NAS-Port = 0
(6)   NAS-Identifier = '192.168.30.121'
(6)   NAS-Port-Type = Wireless-802.11
(6)   Calling-Station-Id = '96006F089222'
(6)   Called-Station-Id = '001A1E01CF58'
(6)   Service-Type = Framed-User
(6)   Framed-MTU = 1100
(6)   Aruba-Essid-Name = 'eduroam'
(6)   Aruba-Location-Id = 'CETLfoyer_AP01'
(6)   Aruba-AP-Group = 'apg-comp'
(6)   Event-Timestamp = 'Sep  7 2020 19:55:28 BST'
(6)   Operator-Name = '1harper-adams.ac.uk'
(6)   Chargeable-User-Identity := 0x00
(6) server inner-tunnel {
(6)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(6)     authorize {
(6)       [chap] = noop
(6)       [mschap] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(6) suffix: Found realm "harper-adams.ac.uk"
(6) suffix: Adding Stripped-User-Name = "00703070"
(6) suffix: Adding Realm = "harper-adams.ac.uk"
(6) suffix: Authentication realm is LOCAL
(6)       [suffix] = ok
(6)       update control {
(6)         &Proxy-To-Realm := LOCAL
(6)       } # update control = noop
(6) eap: Peer sent code Response (2) ID 7 length 32
(6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(6)       [eap] = ok
(6)     } # authorize = ok
(6)   Found Auth-Type = EAP
(6)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(6)     authenticate {
(6) eap: Peer sent method Identity (1)
(6) eap: Calling eap_mschapv2 to process EAP data
(6) eap_mschapv2: Issuing Challenge
(6) eap: EAP session adding &reply:State = 0xcef5e17acefdfb91
(6)       [eap] = handled
(6)     } # authenticate = handled
(6) } # server inner-tunnel
(6) Virtual server sending reply
(6)   EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled reply code 11
(6) eap_peap:   EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap:   State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled reply RADIUS code 11
(6) eap_peap:   EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap:   State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled Access-Challenge
(6) eap: EAP session adding &reply:State = 0x5d232d885b2b34dd
(6)     [eap] = handled
(6)   } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) Post-Auth-Type sub-section not found.  Ignoring.
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) Sent Access-Challenge Id 236 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(6)   EAP-Message = 0x010800491900170303003edbf9a5fe6b58c9b1f544c668c8ce20a13bbdddec520dff4b916704c39eb5cd65054c4d14c94d5a4c2febf9467b7a0fb1cb9210743e34f5fc43aa84eb3dbd
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0x5d232d885b2b34dd60443f4cd8d35175
(6) Finished request
Waking up in 4.9 seconds.
(7) Received Access-Request Id 109 from 192.168.30.121:59063 to 192.168.10.211:1812 length 251
(7)   User-Name = '00703070@harper-adams.ac.uk'
(7)   NAS-IP-Address = 192.168.30.121
(7)   NAS-Port = 0
(7)   NAS-Identifier = '192.168.30.121'
(7)   NAS-Port-Type = Wireless-802.11
(7)   Calling-Station-Id = '96006F089222'
(7)   Called-Station-Id = '001A1E01CF58'
(7)   Service-Type = Framed-User
(7)   Framed-MTU = 1100
(7)   EAP-Message = 0x020800251900170303001a00000000000000025abd5dd6bbbaa0d2d85ec8fd3fc775e655b6
(7)   State = 0x5d232d885b2b34dd60443f4cd8d35175
(7)   Aruba-Essid-Name = 'eduroam'
(7)   Aruba-Location-Id = 'CETLfoyer_AP01'
(7)   Aruba-AP-Group = 'apg-comp'
(7)   Message-Authenticator = 0xaf7a8dee6f40dcbd4932d108769f58b3
(7) session-state: No cached attributes
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(7)   authorize {
(7)     policy eduroam_filter {
(7)       if (User-Name !~ /@/) {
(7)       if (User-Name !~ /@/)  -> FALSE
(7)       if ("%{User-Name}" =~ /@$/) {
(7)       EXPAND %{User-Name}
(7)          --> 00703070@harper-adams.ac.uk
(7)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(7)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(7)       EXPAND %{User-Name}
(7)          --> 00703070@harper-adams.ac.uk
(7)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(7)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(7)       EXPAND %{User-Name}
(7)          --> 00703070@harper-adams.ac.uk
(7)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(7)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(7)       EXPAND %{User-Name}
(7)          --> 00703070@harper-adams.ac.uk
(7)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(7)     } # policy eduroam_filter = notfound
(7)     [preprocess] = ok
(7)     policy operator-name.authorize {
(7)       if ("%{client:Operator-Name}") {
(7)       EXPAND %{client:Operator-Name}
(7)          --> 1harper-adams.ac.uk
(7)       if ("%{client:Operator-Name}")  -> TRUE
(7)       if ("%{client:Operator-Name}")  {
(7)         update request {
(7)           EXPAND %{client:Operator-Name}
(7)              --> 1harper-adams.ac.uk
(7)           &Operator-Name = 1harper-adams.ac.uk
(7)         } # update request = noop
(7)       } # if ("%{client:Operator-Name}")  = noop
(7)     } # policy operator-name.authorize = noop
(7)     policy cui.authorize {
(7)       if ("%{client:add_cui}" == 'yes') {
(7)       EXPAND %{client:add_cui}
(7)          --> yes
(7)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(7)       if ("%{client:add_cui}" == 'yes')  {
(7)         update request {
(7)           &Chargeable-User-Identity := 0x00
(7)         } # update request = noop
(7)       } # if ("%{client:add_cui}" == 'yes')  = noop
(7)     } # policy cui.authorize = noop
(7)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(7)     EXPAND %{User-Name}
(7)        --> 00703070@harper-adams.ac.uk
(7)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(7)     else {
(7) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(7) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(7) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(7) auth_log: EXPAND %t
(7) auth_log:    --> Mon Sep  7 19:55:28 2020
(7)       [auth_log] = ok
(7)     } # else = ok
(7)     [chap] = noop
(7)     [mschap] = noop
(7)     [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(7) suffix: Found realm "harper-adams.ac.uk"
(7) suffix: Adding Stripped-User-Name = "00703070"
(7) suffix: Adding Realm = "harper-adams.ac.uk"
(7) suffix: Authentication realm is LOCAL
(7)     [suffix] = ok
(7)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(7)     EXPAND %{User-Name}
(7)        --> 00703070@harper-adams.ac.uk
(7)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(7)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(7)       [noop] = noop
(7)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(7)     ... skipping elsif for request 7: Preceding "if" was taken
(7)     ... skipping elsif for request 7: Preceding "if" was taken
(7)     ... skipping elsif for request 7: Preceding "if" was taken
(7)     ... skipping else for request 7: Preceding "if" was taken
(7) eap: Peer sent code Response (2) ID 8 length 37
(7) eap: Continuing tunnel setup
(7)     [eap] = ok
(7)   } # authorize = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7)   authenticate {
(7) eap: Expiring EAP session with state 0xcef5e17acefdfb91
(7) eap: Finished EAP session with state 0x5d232d885b2b34dd
(7) eap: Previous EAP request found for state 0x5d232d885b2b34dd, released from the list
(7) eap: Peer sent method PEAP (25)
(7) eap: EAP PEAP (25)
(7) eap: Calling eap_peap to process EAP data
(7) eap_peap: processing EAP-TLS
(7) eap_peap: eaptls_verify returned 7
(7) eap_peap: Done initial handshake
(7) eap_peap: eaptls_process returned 7
(7) eap_peap: FR_TLS_OK
(7) eap_peap: Session established.  Decoding tunneled attributes
(7) eap_peap: PEAP state phase2
(7) eap_peap: EAP type NAK (3)
(7) eap_peap: Got tunneled request
(7) eap_peap:   EAP-Message = 0x020800060306
(7) eap_peap: Setting User-Name to 00703070@harper-adams.ac.uk
(7) eap_peap: Sending tunneled request to inner-tunnel
(7) eap_peap:   EAP-Message = 0x020800060306
(7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(7) eap_peap:   User-Name = '00703070@harper-adams.ac.uk'
(7) eap_peap:   State = 0xcef5e17acefdfb9195ed82a9e621722d
(7) eap_peap:   NAS-IP-Address = 192.168.30.121
(7) eap_peap:   NAS-Port = 0
(7) eap_peap:   NAS-Identifier = '192.168.30.121'
(7) eap_peap:   NAS-Port-Type = Wireless-802.11
(7) eap_peap:   Calling-Station-Id = '96006F089222'
(7) eap_peap:   Called-Station-Id = '001A1E01CF58'
(7) eap_peap:   Service-Type = Framed-User
(7) eap_peap:   Framed-MTU = 1100
(7) eap_peap:   Aruba-Essid-Name = 'eduroam'
(7) eap_peap:   Aruba-Location-Id = 'CETLfoyer_AP01'
(7) eap_peap:   Aruba-AP-Group = 'apg-comp'
(7) eap_peap:   Event-Timestamp = 'Sep  7 2020 19:55:28 BST'
(7) eap_peap:   Operator-Name = '1harper-adams.ac.uk'
(7) eap_peap:   Chargeable-User-Identity := 0x00
(7) Virtual server inner-tunnel received request
(7)   EAP-Message = 0x020800060306
(7)   FreeRADIUS-Proxied-To = 127.0.0.1
(7)   User-Name = '00703070@harper-adams.ac.uk'
(7)   State = 0xcef5e17acefdfb9195ed82a9e621722d
(7)   NAS-IP-Address = 192.168.30.121
(7)   NAS-Port = 0
(7)   NAS-Identifier = '192.168.30.121'
(7)   NAS-Port-Type = Wireless-802.11
(7)   Calling-Station-Id = '96006F089222'
(7)   Called-Station-Id = '001A1E01CF58'
(7)   Service-Type = Framed-User
(7)   Framed-MTU = 1100
(7)   Aruba-Essid-Name = 'eduroam'
(7)   Aruba-Location-Id = 'CETLfoyer_AP01'
(7)   Aruba-AP-Group = 'apg-comp'
(7)   Event-Timestamp = 'Sep  7 2020 19:55:28 BST'
(7)   Operator-Name = '1harper-adams.ac.uk'
(7)   Chargeable-User-Identity := 0x00
(7) server inner-tunnel {
(7)   session-state: No cached attributes
(7)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7)     authorize {
(7)       [chap] = noop
(7)       [mschap] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(7) suffix: Found realm "harper-adams.ac.uk"
(7) suffix: Adding Stripped-User-Name = "00703070"
(7) suffix: Adding Realm = "harper-adams.ac.uk"
(7) suffix: Authentication realm is LOCAL
(7)       [suffix] = ok
(7)       update control {
(7)         &Proxy-To-Realm := LOCAL
(7)       } # update control = noop
(7) eap: Peer sent code Response (2) ID 8 length 6
(7) eap: No EAP Start, assuming it's an on-going EAP conversation
(7)       [eap] = updated
(7)       [files] = noop
(7)       [expiration] = noop
(7)       [logintime] = noop
(7)       [pap] = noop
(7)     } # authorize = updated
(7)   Found Auth-Type = EAP
(7)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7)     authenticate {
(7) eap: Expiring EAP session with state 0xcef5e17acefdfb91
(7) eap: Finished EAP session with state 0xcef5e17acefdfb91
(7) eap: Previous EAP request found for state 0xcef5e17acefdfb91, released from the list
(7) eap: Peer sent method NAK (3)
(7) eap: Found mutually acceptable type GTC (6)
(7) eap: Calling eap_gtc to process EAP data
(7) eap_gtc: EXPAND Password:
(7) eap_gtc:    --> Password:
(7) eap: EAP session adding &reply:State = 0xcef5e17acffce791
(7)       [eap] = handled
(7)     } # authenticate = handled
(7) } # server inner-tunnel
(7) Virtual server sending reply
(7)   EAP-Message = 0x0109000f0650617373776f72643a20
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled reply code 11
(7) eap_peap:   EAP-Message = 0x0109000f0650617373776f72643a20
(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap:   State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled reply RADIUS code 11
(7) eap_peap:   EAP-Message = 0x0109000f0650617373776f72643a20
(7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap:   State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled Access-Challenge
(7) eap: EAP session adding &reply:State = 0x5d232d885a2a34dd
(7)     [eap] = handled
(7)   } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) Post-Auth-Type sub-section not found.  Ignoring.
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) Sent Access-Challenge Id 109 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(7)   EAP-Message = 0x0109002e19001703030023dbf9a5fe6b58c9b2c86f77544490173e291a25dd612c301797c162a5c8fc06f66e5112
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x5d232d885a2a34dd60443f4cd8d35175
(7) Finished request
Waking up in 4.9 seconds.
(8) Received Access-Request Id 95 from 192.168.30.121:59063 to 192.168.10.211:1812 length 265
(8)   User-Name = '00703070@harper-adams.ac.uk'
(8)   NAS-IP-Address = 192.168.30.121
(8)   NAS-Port = 0
(8)   NAS-Identifier = '192.168.30.121'
(8)   NAS-Port-Type = Wireless-802.11
(8)   Calling-Station-Id = '96006F089222'
(8)   Called-Station-Id = '001A1E01CF58'
(8)   Service-Type = Framed-User
(8)   Framed-MTU = 1100
(8)   EAP-Message = 0x02090033190017030300280000000000000003e26173435d91e7f61b6321efcb63810a55eedad5f9ee2e3b1bd11f0c34e5d051
(8)   State = 0x5d232d885a2a34dd60443f4cd8d35175
(8)   Aruba-Essid-Name = 'eduroam'
(8)   Aruba-Location-Id = 'CETLfoyer_AP01'
(8)   Aruba-AP-Group = 'apg-comp'
(8)   Message-Authenticator = 0x6290f9ac9790288097d9abada7f4cf76
(8) session-state: No cached attributes
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(8)   authorize {
(8)     policy eduroam_filter {
(8)       if (User-Name !~ /@/) {
(8)       if (User-Name !~ /@/)  -> FALSE
(8)       if ("%{User-Name}" =~ /@$/) {
(8)       EXPAND %{User-Name}
(8)          --> 00703070@harper-adams.ac.uk
(8)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(8)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(8)       EXPAND %{User-Name}
(8)          --> 00703070@harper-adams.ac.uk
(8)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(8)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(8)       EXPAND %{User-Name}
(8)          --> 00703070@harper-adams.ac.uk
(8)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(8)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(8)       EXPAND %{User-Name}
(8)          --> 00703070@harper-adams.ac.uk
(8)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(8)     } # policy eduroam_filter = notfound
(8)     [preprocess] = ok
(8)     policy operator-name.authorize {
(8)       if ("%{client:Operator-Name}") {
(8)       EXPAND %{client:Operator-Name}
(8)          --> 1harper-adams.ac.uk
(8)       if ("%{client:Operator-Name}")  -> TRUE
(8)       if ("%{client:Operator-Name}")  {
(8)         update request {
(8)           EXPAND %{client:Operator-Name}
(8)              --> 1harper-adams.ac.uk
(8)           &Operator-Name = 1harper-adams.ac.uk
(8)         } # update request = noop
(8)       } # if ("%{client:Operator-Name}")  = noop
(8)     } # policy operator-name.authorize = noop
(8)     policy cui.authorize {
(8)       if ("%{client:add_cui}" == 'yes') {
(8)       EXPAND %{client:add_cui}
(8)          --> yes
(8)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(8)       if ("%{client:add_cui}" == 'yes')  {
(8)         update request {
(8)           &Chargeable-User-Identity := 0x00
(8)         } # update request = noop
(8)       } # if ("%{client:add_cui}" == 'yes')  = noop
(8)     } # policy cui.authorize = noop
(8)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(8)     EXPAND %{User-Name}
(8)        --> 00703070@harper-adams.ac.uk
(8)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(8)     else {
(8) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(8) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(8) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(8) auth_log: EXPAND %t
(8) auth_log:    --> Mon Sep  7 19:55:28 2020
(8)       [auth_log] = ok
(8)     } # else = ok
(8)     [chap] = noop
(8)     [mschap] = noop
(8)     [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(8) suffix: Found realm "harper-adams.ac.uk"
(8) suffix: Adding Stripped-User-Name = "00703070"
(8) suffix: Adding Realm = "harper-adams.ac.uk"
(8) suffix: Authentication realm is LOCAL
(8)     [suffix] = ok
(8)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(8)     EXPAND %{User-Name}
(8)        --> 00703070@harper-adams.ac.uk
(8)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(8)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(8)       [noop] = noop
(8)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(8)     ... skipping elsif for request 8: Preceding "if" was taken
(8)     ... skipping elsif for request 8: Preceding "if" was taken
(8)     ... skipping elsif for request 8: Preceding "if" was taken
(8)     ... skipping else for request 8: Preceding "if" was taken
(8) eap: Peer sent code Response (2) ID 9 length 51
(8) eap: Continuing tunnel setup
(8)     [eap] = ok
(8)   } # authorize = ok
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8)   authenticate {
(8) eap: Expiring EAP session with state 0xcef5e17acffce791
(8) eap: Finished EAP session with state 0x5d232d885a2a34dd
(8) eap: Previous EAP request found for state 0x5d232d885a2a34dd, released from the list
(8) eap: Peer sent method PEAP (25)
(8) eap: EAP PEAP (25)
(8) eap: Calling eap_peap to process EAP data
(8) eap_peap: processing EAP-TLS
(8) eap_peap: eaptls_verify returned 7
(8) eap_peap: Done initial handshake
(8) eap_peap: eaptls_process returned 7
(8) eap_peap: FR_TLS_OK
(8) eap_peap: Session established.  Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP type GTC (6)
(8) eap_peap: Got tunneled request
(8) eap_peap:   EAP-Message = 0x020900140654726964656e743234313030303239
(8) eap_peap: Setting User-Name to 00703070@harper-adams.ac.uk
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap:   EAP-Message = 0x020900140654726964656e743234313030303239
(8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap:   User-Name = '00703070@harper-adams.ac.uk'
(8) eap_peap:   State = 0xcef5e17acffce79195ed82a9e621722d
(8) eap_peap:   NAS-IP-Address = 192.168.30.121
(8) eap_peap:   NAS-Port = 0
(8) eap_peap:   NAS-Identifier = '192.168.30.121'
(8) eap_peap:   NAS-Port-Type = Wireless-802.11
(8) eap_peap:   Calling-Station-Id = '96006F089222'
(8) eap_peap:   Called-Station-Id = '001A1E01CF58'
(8) eap_peap:   Service-Type = Framed-User
(8) eap_peap:   Framed-MTU = 1100
(8) eap_peap:   Aruba-Essid-Name = 'eduroam'
(8) eap_peap:   Aruba-Location-Id = 'CETLfoyer_AP01'
(8) eap_peap:   Aruba-AP-Group = 'apg-comp'
(8) eap_peap:   Event-Timestamp = 'Sep  7 2020 19:55:28 BST'
(8) eap_peap:   Operator-Name = '1harper-adams.ac.uk'
(8) eap_peap:   Chargeable-User-Identity := 0x00
(8) Virtual server inner-tunnel received request
(8)   EAP-Message = 0x020900140654726964656e743234313030303239
(8)   FreeRADIUS-Proxied-To = 127.0.0.1
(8)   User-Name = '00703070@harper-adams.ac.uk'
(8)   State = 0xcef5e17acffce79195ed82a9e621722d
(8)   NAS-IP-Address = 192.168.30.121
(8)   NAS-Port = 0
(8)   NAS-Identifier = '192.168.30.121'
(8)   NAS-Port-Type = Wireless-802.11
(8)   Calling-Station-Id = '96006F089222'
(8)   Called-Station-Id = '001A1E01CF58'
(8)   Service-Type = Framed-User
(8)   Framed-MTU = 1100
(8)   Aruba-Essid-Name = 'eduroam'
(8)   Aruba-Location-Id = 'CETLfoyer_AP01'
(8)   Aruba-AP-Group = 'apg-comp'
(8)   Event-Timestamp = 'Sep  7 2020 19:55:28 BST'
(8)   Operator-Name = '1harper-adams.ac.uk'
(8)   Chargeable-User-Identity := 0x00
(8) server inner-tunnel {
(8)   session-state: No cached attributes
(8)   # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8)     authorize {
(8)       [chap] = noop
(8)       [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(8) suffix: Found realm "harper-adams.ac.uk"
(8) suffix: Adding Stripped-User-Name = "00703070"
(8) suffix: Adding Realm = "harper-adams.ac.uk"
(8) suffix: Authentication realm is LOCAL
(8)       [suffix] = ok
(8)       update control {
(8)         &Proxy-To-Realm := LOCAL
(8)       } # update control = noop
(8) eap: Peer sent code Response (2) ID 9 length 20
(8) eap: No EAP Start, assuming it's an on-going EAP conversation
(8)       [eap] = updated
(8)       [files] = noop
(8)       [expiration] = noop
(8)       [logintime] = noop
(8)       [pap] = noop
(8)     } # authorize = updated
(8)   Found Auth-Type = EAP
(8)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8)     authenticate {
(8) eap: Expiring EAP session with state 0xcef5e17acffce791
(8) eap: Finished EAP session with state 0xcef5e17acffce791
(8) eap: Previous EAP request found for state 0xcef5e17acffce791, released from the list
(8) eap: Peer sent method GTC (6)
(8) eap: EAP GTC (6)
(8) eap: Calling eap_gtc to process EAP data
(8) eap_gtc: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) eap_gtc:   Auth-Type PAP {
(8) pap: Login attempt with password
(8) pap: No password configured for the user.  Cannot do authentication
(8)     [pap] = fail
(8)   } # Auth-Type PAP = fail
(8) eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed
(8) eap: Failed in EAP select
(8)       [eap] = invalid
(8)     } # authenticate = invalid
(8)   Failed to authenticate the user
(8)   Using Post-Auth-Type Reject
(8)   # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8)     Post-Auth-Type REJECT {
(8) attr_filter.access_reject: EXPAND %{User-Name}
(8) attr_filter.access_reject:    --> 00703070@harper-adams.ac.uk
(8) attr_filter.access_reject: Matched entry DEFAULT at line 18
(8)       [attr_filter.access_reject] = updated
(8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}
(8) inner_tunnel_server_log:    --> inner_tunnel_server_log.Access-Reject
(8) inner_tunnel_server_log: EXPAND /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d
(8) inner_tunnel_server_log:    --> /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-20200907
(8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject
(8) inner_tunnel_server_log:    --> inner_tunnel_server_log#Mon Sep  7 19:55:28 2020#USERNAME=00703070@harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020900140654726964656e743234313030303239#RESULT=Access-Reject
(8)       [inner_tunnel_server_log] = ok
(8)       update outer.session-state {
(8)         &Module-Failure-Message := &Module-Failure-Message -> eap: Failed continuing EAP GTC (6) session. EAP sub-module failed
(8)       } # update outer.session-state = noop
(8)     } # Post-Auth-Type REJECT = updated
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8)   EAP-Message = 0x04090004
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Got tunneled reply code 3
(8) eap_peap:   EAP-Message = 0x04090004
(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Got tunneled reply RADIUS code 3
(8) eap_peap:   EAP-Message = 0x04090004
(8) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Tunneled authentication was rejected
(8) eap_peap: FAILURE
(8) eap: EAP session adding &reply:State = 0x5d232d88552934dd
(8)     [eap] = handled
(8)   } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) Post-Auth-Type sub-section not found.  Ignoring.
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) session-state: Saving cached attributes
(8)   Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed'
(8) Sent Access-Challenge Id 95 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(8)   EAP-Message = 0x010a002e19001703030023dbf9a5fe6b58c9b35409b5950099335ab262a924b463f36eeabe34c5e86c199e0fb490
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x5d232d88552934dd60443f4cd8d35175
(8) Finished request
Waking up in 4.9 seconds.
(9) Received Access-Request Id 205 from 192.168.30.121:59063 to 192.168.10.211:1812 length 260
(9)   User-Name = '00703070@harper-adams.ac.uk'
(9)   NAS-IP-Address = 192.168.30.121
(9)   NAS-Port = 0
(9)   NAS-Identifier = '192.168.30.121'
(9)   NAS-Port-Type = Wireless-802.11
(9)   Calling-Station-Id = '96006F089222'
(9)   Called-Station-Id = '001A1E01CF58'
(9)   Service-Type = Framed-User
(9)   Framed-MTU = 1100
(9)   EAP-Message = 0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490
(9)   State = 0x5d232d88552934dd60443f4cd8d35175
(9)   Aruba-Essid-Name = 'eduroam'
(9)   Aruba-Location-Id = 'CETLfoyer_AP01'
(9)   Aruba-AP-Group = 'apg-comp'
(9)   Message-Authenticator = 0x9fd80c90ae227ad00b39d0f216ca9efb
(9) session-state: Found cached attributes
(9)   Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed'
(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(9)   authorize {
(9)     policy eduroam_filter {
(9)       if (User-Name !~ /@/) {
(9)       if (User-Name !~ /@/)  -> FALSE
(9)       if ("%{User-Name}" =~ /@$/) {
(9)       EXPAND %{User-Name}
(9)          --> 00703070@harper-adams.ac.uk
(9)       if ("%{User-Name}" =~ /@$/)  -> FALSE
(9)       if ("%{User-Name}" =~ /@gmail\.com$/) {
(9)       EXPAND %{User-Name}
(9)          --> 00703070@harper-adams.ac.uk
(9)       if ("%{User-Name}" =~ /@gmail\.com$/)  -> FALSE
(9)       if ("%{User-Name}" =~ /@yahoo\.com$/) {
(9)       EXPAND %{User-Name}
(9)          --> 00703070@harper-adams.ac.uk
(9)       if ("%{User-Name}" =~ /@yahoo\.com$/)  -> FALSE
(9)       if ("%{User-Name}" =~ /@hotmail\.com$/) {
(9)       EXPAND %{User-Name}
(9)          --> 00703070@harper-adams.ac.uk
(9)       if ("%{User-Name}" =~ /@hotmail\.com$/)  -> FALSE
(9)     } # policy eduroam_filter = notfound
(9)     [preprocess] = ok
(9)     policy operator-name.authorize {
(9)       if ("%{client:Operator-Name}") {
(9)       EXPAND %{client:Operator-Name}
(9)          --> 1harper-adams.ac.uk
(9)       if ("%{client:Operator-Name}")  -> TRUE
(9)       if ("%{client:Operator-Name}")  {
(9)         update request {
(9)           EXPAND %{client:Operator-Name}
(9)              --> 1harper-adams.ac.uk
(9)           &Operator-Name = 1harper-adams.ac.uk
(9)         } # update request = noop
(9)       } # if ("%{client:Operator-Name}")  = noop
(9)     } # policy operator-name.authorize = noop
(9)     policy cui.authorize {
(9)       if ("%{client:add_cui}" == 'yes') {
(9)       EXPAND %{client:add_cui}
(9)          --> yes
(9)       if ("%{client:add_cui}" == 'yes')  -> TRUE
(9)       if ("%{client:add_cui}" == 'yes')  {
(9)         update request {
(9)           &Chargeable-User-Identity := 0x00
(9)         } # update request = noop
(9)       } # if ("%{client:add_cui}" == 'yes')  = noop
(9)     } # policy cui.authorize = noop
(9)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/) {
(9)     EXPAND %{User-Name}
(9)        --> 00703070@harper-adams.ac.uk
(9)     if ("%{User-Name}" =~ /EduroamSupport@harper-adams\.ac\.uk$/)  -> FALSE
(9)     else {
(9) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(9) auth_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(9) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(9) auth_log: EXPAND %t
(9) auth_log:    --> Mon Sep  7 19:55:28 2020
(9)       [auth_log] = ok
(9)     } # else = ok
(9)     [chap] = noop
(9)     [mschap] = noop
(9)     [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070@harper-adams.ac.uk"
(9) suffix: Found realm "harper-adams.ac.uk"
(9) suffix: Adding Stripped-User-Name = "00703070"
(9) suffix: Adding Realm = "harper-adams.ac.uk"
(9) suffix: Authentication realm is LOCAL
(9)     [suffix] = ok
(9)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(9)     EXPAND %{User-Name}
(9)        --> 00703070@harper-adams.ac.uk
(9)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  -> TRUE
(9)     if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  {
(9)       [noop] = noop
(9)     } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/)  = noop
(9)     ... skipping elsif for request 9: Preceding "if" was taken
(9)     ... skipping elsif for request 9: Preceding "if" was taken
(9)     ... skipping elsif for request 9: Preceding "if" was taken
(9)     ... skipping else for request 9: Preceding "if" was taken
(9) eap: Peer sent code Response (2) ID 10 length 46
(9) eap: Continuing tunnel setup
(9)     [eap] = ok
(9)   } # authorize = ok
(9) Found Auth-Type = EAP
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9)   authenticate {
(9) eap: Expiring EAP session with state 0x5d232d88552934dd
(9) eap: Finished EAP session with state 0x5d232d88552934dd
(9) eap: Previous EAP request found for state 0x5d232d88552934dd, released from the list
(9) eap: Peer sent method PEAP (25)
(9) eap: EAP PEAP (25)
(9) eap: Calling eap_peap to process EAP data
(9) eap_peap: processing EAP-TLS
(9) eap_peap: eaptls_verify returned 7
(9) eap_peap: Done initial handshake
(9) eap_peap: eaptls_process returned 7
(9) eap_peap: FR_TLS_OK
(9) eap_peap: Session established.  Decoding tunneled attributes
(9) eap_peap: PEAP state send tlv failure
(9) eap_peap: Received EAP-TLV response
(9) eap_peap:   The users session was previously rejected: returning reject (again.)
(9) eap_peap:   This means you need to read the PREVIOUS messages in the debug output
(9) eap_peap:   to find out the reason why the user was rejected
(9) eap_peap:   Look for "reject" or "fail".  Those earlier messages will tell you
(9) eap_peap:   what went wrong, and how to fix the problem
  SSL: Removing session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c from the cache
(9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed
(9) eap: Failed in EAP select
(9)     [eap] = invalid
(9)   } # authenticate = invalid
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9)   Post-Auth-Type REJECT {
(9) attr_filter.access_reject: EXPAND %{User-Name}
(9) attr_filter.access_reject:    --> 00703070@harper-adams.ac.uk
(9) attr_filter.access_reject: Matched entry DEFAULT at line 18
(9)     [attr_filter.access_reject] = updated
(9)     [eap] = noop
(9)     policy remove_reply_message_if_eap {
(9)       if (&reply:EAP-Message && &reply:Reply-Message) {
(9)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(9)       else {
(9)         [noop] = noop
(9)       } # else = noop
(9)     } # policy remove_reply_message_if_eap = noop
(9) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
(9) reply_log:    --> /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907
(9) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907
(9) reply_log: EXPAND %t
(9) reply_log:    --> Mon Sep  7 19:55:28 2020
(9)     [reply_log] = ok
(9) default_server_log: EXPAND default_server_log.%{%{reply:Packet-Type}:-format}
(9) default_server_log:    --> default_server_log.Access-Reject
(9) default_server_log: EXPAND /usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d
(9) default_server_log:    --> /usr/local/var/log/radius/radacct/default_server_log/default_server_log-20200907
(9) default_server_log: EXPAND default_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject
(9) default_server_log:    --> default_server_log#Mon Sep  7 19:55:28 2020#USERNAME=00703070@harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490#RESULT=Access-Reject
(9)     [default_server_log] = ok
(9) on-site-reject-log: EXPAND on-site-reject-log.%{%{reply:Packet-Type}:-format}
(9) on-site-reject-log:    --> on-site-reject-log.Access-Reject
(9) on-site-reject-log: EXPAND /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d
(9) on-site-reject-log:    --> /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-20200907
(9) on-site-reject-log: EXPAND %S#USERNAME=%{%{request:User-Name}:-NO-USER-NAME}#MACADDR=%{%{Calling-Station-Id}:-NO-MAC-ADDR}##DEVICE=%{%{request:Aruba-Device-Type}:-NO-DEVICE-TYPE}#LOCATION=%{%{request:Aruba-Location-Id}:-NO-LOCATION-ID}#ERRORMSG=%{%{reply:Reply-Message}:-%{&session-state:Module-Failure-Message}}
(9) on-site-reject-log:    --> 2020-09-07 19:55:28#USERNAME=00703070@harper-adams.ac.uk#MACADDR=96006F089222##DEVICE=NO-DEVICE-TYPE#LOCATION=CETLfoyer_AP01#ERRORMSG=eap: Failed continuing EAP GTC (6) session. EAP sub-module failed
(9)     [on-site-reject-log] = ok
(9)   } # Post-Auth-Type REJECT = updated
(9) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(9) <delay>: Sending delayed response
(9) <delay>: Sent Access-Reject Id 205 from 192.168.10.211:1812 to 192.168.30.121:59063 length 44
(9) <delay>:   EAP-Message = 0x040a0004
(9) <delay>:   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) <done>: Cleaning up request packet ID 66 with timestamp +5
(1) <done>: Cleaning up request packet ID 36 with timestamp +5
(2) <done>: Cleaning up request packet ID 101 with timestamp +5
(3) <done>: Cleaning up request packet ID 246 with timestamp +5
(4) <done>: Cleaning up request packet ID 93 with timestamp +5
(5) <done>: Cleaning up request packet ID 254 with timestamp +5
(6) <done>: Cleaning up request packet ID 236 with timestamp +5
(7) <done>: Cleaning up request packet ID 109 with timestamp +5
(8) <done>: Cleaning up request packet ID 95 with timestamp +5
(9) <delay>: Cleaning up request packet ID 205 with timestamp +5
Ready to process requests

EAP-GTC Error - Samsung S20+ connecting to eduroam

Shaun Hoofe

Matthew Newton

Shaun Hoofe

Alan Buxey

tags

participants (3)