In the default inner-tunnel post-auth block there's a config block to inject the real username into the outer Access-Accept, however it doesn't seem to do that on FreeRADIUS 3/3.1: (6) post-auth { (6) update outer.reply { (6) eap_ttls : expand: "%{request:User-Name}" -> '@local.com' (6) eap_ttls : User-Name = "@local.com" (6) } # update outer.reply = noop (6) } # post-auth = noop My understanding is that %{request:User-Name} should have expanded to 'steve@local.com'. Am I misinterpreting what the block does, or is this a bug? Thanks, Adam Bishop gpg: 0x6609D460 Janet, the UK's research and education network. --- debug.log --- [root@skeletor sbin]# radiusd -X radiusd: FreeRADIUS Version 3.1.0 (git #3965001), for host x86_64-unknown-linux-gnu, built on Nov 22 2013 at 15:39:10 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License For more information about these matters, see the file named COPYRIGHT Starting - reading configuration files ... including dictionary file /usr/local/etc/raddb/dictionary including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/mods-enabled/ including configuration file /usr/local/etc/raddb/mods-enabled/linelog including configuration file /usr/local/etc/raddb/mods-enabled/always including configuration file /usr/local/etc/raddb/mods-enabled/utf8 including configuration file /usr/local/etc/raddb/mods-enabled/expr including configuration file /usr/local/etc/raddb/mods-enabled/exec including configuration file /usr/local/etc/raddb/mods-enabled/detail including configuration file /usr/local/etc/raddb/mods-enabled/preprocess including configuration file /usr/local/etc/raddb/mods-enabled/chap including configuration file /usr/local/etc/raddb/mods-enabled/radutmp including configuration file /usr/local/etc/raddb/mods-enabled/echo including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients including configuration file /usr/local/etc/raddb/mods-enabled/mschap including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap including configuration file /usr/local/etc/raddb/mods-enabled/dhcp including configuration file /usr/local/etc/raddb/mods-enabled/expiration including configuration file /usr/local/etc/raddb/mods-enabled/pap including configuration file /usr/local/etc/raddb/mods-enabled/realm including configuration file /usr/local/etc/raddb/mods-enabled/passwd including configuration file /usr/local/etc/raddb/mods-enabled/replicate including configuration file /usr/local/etc/raddb/mods-enabled/digest including configuration file /usr/local/etc/raddb/mods-enabled/eap including configuration file /usr/local/etc/raddb/mods-enabled/soh including configuration file /usr/local/etc/raddb/mods-enabled/unix including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp including configuration file /usr/local/etc/raddb/mods-enabled/files including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter including configuration file /usr/local/etc/raddb/mods-enabled/logintime including configuration file /usr/local/etc/raddb/mods-enabled/detail.log including files in directory /usr/local/etc/raddb/policy.d/ including configuration file /usr/local/etc/raddb/policy.d/accounting including configuration file /usr/local/etc/raddb/policy.d/filter including configuration file /usr/local/etc/raddb/policy.d/operator-name including configuration file /usr/local/etc/raddb/policy.d/dhcp including configuration file /usr/local/etc/raddb/policy.d/cui including configuration file /usr/local/etc/raddb/policy.d/control including configuration file /usr/local/etc/raddb/policy.d/eap including configuration file /usr/local/etc/raddb/policy.d/canonicalization including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/default main { security { allow_core_dumps = no } } main { name = "radiusd" prefix = "/usr/local" localstatedir = "/usr/local/var" sbindir = "/usr/local/sbin" logdir = "/usr/local/var/log/radius" run_dir = "/usr/local/var/run/radiusd" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no colourise = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } limit { max_connections = 16 max_requests = 0 lifetime = 0 idle_timeout = 0 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nas_type = "other" proto = "*" limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } radiusd: #### Instantiating modules #### instantiate { } modules { # Loaded module rlm_linelog # Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog linelog { filename = "/usr/local/var/log/radius/linelog" permissions = 384 format = "This is a log message for %{User-Name}" reference = "%{%{Packet-Type}:-format}" } # Loaded module rlm_always # Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always always fail { rcode = "fail" simulcount = 0 mpp = no } # Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always always reject { rcode = "reject" simulcount = 0 mpp = no } # Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always always noop { rcode = "noop" simulcount = 0 mpp = no } # Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always always handled { rcode = "handled" simulcount = 0 mpp = no } # Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always always updated { rcode = "updated" simulcount = 0 mpp = no } # Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always always notfound { rcode = "notfound" simulcount = 0 mpp = no } # Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always always ok { rcode = "ok" simulcount = 0 mpp = no } # Loaded module rlm_utf8 # Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8 # Loaded module rlm_expr # Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr expr { safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } # Loaded module rlm_exec # Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } # Loaded module rlm_detail # Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail detail { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Loaded module rlm_preprocess # Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups" hints = "/usr/local/etc/raddb/mods-config/preprocess/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints # Loaded module rlm_chap # Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap # Loaded module rlm_radutmp # Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 384 caller_id = yes } # Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = "request" output_pairs = "reply" shell_escape = yes } # Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth exec ntlm_auth { wait = yes program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" shell_escape = yes } # Loaded module rlm_dynamic_clients # Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients # Loaded module rlm_mschap # Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes passchange { } allow_retry = yes } # Loaded module rlm_cache # Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap cache cache_eap { key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}" ttl = 15 max_entries = 16384 epoch = 0 add_stats = no } # Loaded module rlm_dhcp # Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp # Loaded module rlm_expiration # Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration # Loaded module rlm_pap # Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap pap { auto_header = no normalise = yes } # Loaded module rlm_realm # Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm realm IPASS { format = "prefix" delimiter = "/" ignore_default = no ignore_null = no } # Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } # Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm realm realmpercent { format = "suffix" delimiter = "%" ignore_default = no ignore_null = no } # Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } # Loaded module rlm_passwd # Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd passwd etc_passwd { filename = "/etc/passwd" format = "*User-Name:Crypt-Password:" delimiter = ":" ignore_nislike = no ignore_empty = yes allow_multiple_keys = no hash_size = 100 } rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no # Loaded module rlm_replicate # Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate # Loaded module rlm_digest # Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest # Loaded module rlm_eap # Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no mod_accounting_username_bug = no max_sessions = 4096 } # Linked to sub-module rlm_eap_md5 # Linked to sub-module rlm_eap_leap # Linked to sub-module rlm_eap_gtc gtc { challenge = "Password: " auth_type = "PAP" } # Linked to sub-module rlm_eap_tls tls { tls = "tls-common" } tls-config tls-common { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 ca_path = "/usr/local/etc/raddb/certs" pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" ca_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = yes lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = yes } } # Linked to sub-module rlm_eap_ttls ttls { tls = "tls-common" default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_peap peap { tls = "tls-common" default_method = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no require_client_cert = no } Using cached TLS configuration from previous invocation # Linked to sub-module rlm_eap_mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } # Loaded module rlm_soh # Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh soh { dhcp = yes } # Loaded module rlm_unix # Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } # Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp radutmp sradutmp { filename = "/usr/local/var/log/radius/sradutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes permissions = 420 caller_id = no } # Loaded module rlm_files # Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files files { filename = "/usr/local/etc/raddb/mods-config/files/authorize" usersfile = "/usr/local/etc/raddb/mods-config/files/authorize" acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting" preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy" compat = "no" } reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy # Loaded module rlm_attr_filter # Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.post-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy # Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.pre-proxy { filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy # Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_reject { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject # Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.access_challenge { filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge # Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response # Loaded module rlm_logintime # Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime logintime { minimum_timeout = 60 } # Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail auth_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail reply_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail pre_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } # Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log detail post_proxy_log { filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" permissions = 384 dir_permissions = 493 locking = no log_packet_header = no } } # modules radiusd: #### Loading Virtual Servers #### server { # from file /usr/local/etc/raddb/radiusd.conf } # server server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel # Loading authenticate {...} # Loading authorize {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading session {...} # Loading post-proxy {...} # Loading post-auth {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) } # server inner-tunnel server default { # from file /usr/local/etc/raddb/sites-enabled/default # Creating Auth-Type = digest # Loading authenticate {...} # Loading authorize {...} # Loading virtual module filter_username WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) WARNING: Ignoring "ldap" (see raddb/mods-available/README.rst) # Loading preacct {...} # Loading virtual module acct_unique # Loading accounting {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) # Loading post-proxy {...} # Loading post-auth {...} WARNING: Ignoring "sql" (see raddb/mods-available/README.rst) # Loading virtual module remove_reply_message_if_eap # Loading virtual module remove_reply_message_if_eap } # server default radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } listen { type = "auth" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } listen { type = "acct" ipaddr = * port = 0 limit { max_connections = 16 lifetime = 0 idle_timeout = 30 } } Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Opening new proxy address * port 1814 Listening on proxy address * port 1814 Ready to process requests rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=0, length=128 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x0200000f01406c6f63616c2e636f6d Message-Authenticator = 0xb0eb6d57455df58ddcd61a6bd2a0d8d2 (0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (0) authorize { (0) filter_username filter_username { (0) ? if (!User-Name) (0) ? if (!User-Name) -> FALSE (0) ? if (User-Name != "%{tolower:%{User-Name}}") (0) expand: "%{tolower:%{User-Name}}" -> '@local.com' (0) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (0) ? if (User-Name =~ / /) (0) ? if (User-Name =~ / /) -> FALSE (0) ? if (User-Name =~ /@.*@/ ) (0) ? if (User-Name =~ /@.*@/ ) -> FALSE (0) ? if (User-Name =~ /\\.\\./ ) (0) ? if (User-Name =~ /\\.\\./ ) -> FALSE (0) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (0) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (0) ? if (User-Name =~ /\\.$/) (0) ? if (User-Name =~ /\\.$/) -> FALSE (0) ? if (User-Name =~ /@\\./) (0) ? if (User-Name =~ /@\\./) -> FALSE (0) } # filter_username filter_username = notfound (0) [preprocess] = ok (0) [chap] = noop (0) [mschap] = noop (0) [digest] = noop (0) suffix : Looking up realm "local.com" for User-Name = "@local.com" (0) suffix : No such realm "local.com" (0) [suffix] = noop (0) eap : EAP packet type response id 0 length 15 (0) eap : EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (0) [eap] = ok (0) } # authorize = ok (0) Found Auth-Type = EAP (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (0) authenticate { (0) eap : Peer sent Identity (1) (0) eap : Calling eap_md5 to process EAP data rlm_eap_md5: Issuing Challenge (0) eap : New EAP session, adding 'State' attribute to reply 0xfb6cee96fb6deabf (0) [eap] = handled (0) } # authenticate = handled Sending Access-Challenge of id 0 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 EAP-Message = 0x01010016041026085380dcee9b048369ca482f0c9df9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6cee96fb6deabfe758ceb5654c59b3 (0) Finished request 0. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=1, length=137 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x020100060315 State = 0xfb6cee96fb6deabfe758ceb5654c59b3 Message-Authenticator = 0x497e51e395117c1e54eabec2390bb476 (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) ? if (!User-Name) (1) ? if (!User-Name) -> FALSE (1) ? if (User-Name != "%{tolower:%{User-Name}}") (1) expand: "%{tolower:%{User-Name}}" -> '@local.com' (1) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) ? if (User-Name =~ / /) (1) ? if (User-Name =~ / /) -> FALSE (1) ? if (User-Name =~ /@.*@/ ) (1) ? if (User-Name =~ /@.*@/ ) -> FALSE (1) ? if (User-Name =~ /\\.\\./ ) (1) ? if (User-Name =~ /\\.\\./ ) -> FALSE (1) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (1) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (1) ? if (User-Name =~ /\\.$/) (1) ? if (User-Name =~ /\\.$/) -> FALSE (1) ? if (User-Name =~ /@\\./) (1) ? if (User-Name =~ /@\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : Looking up realm "local.com" for User-Name = "@local.com" (1) suffix : No such realm "local.com" (1) [suffix] = noop (1) eap : EAP packet type response id 1 length 6 (1) eap : No EAP Start, assuming it's an on-going EAP conversation (1) [eap] = updated (1) [files] = noop (1) [expiration] = noop (1) [logintime] = noop (1) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type (1) WARNING: pap : Authentication will fail unless a "known good" password is available (1) [pap] = noop (1) } # authorize = updated (1) Found Auth-Type = EAP (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) authenticate { (1) eap : Expiring EAP session with state 0xfb6cee96fb6deabf (1) eap : Finished EAP session with state 0xfb6cee96fb6deabf (1) eap : Previous EAP request found for state 0xfb6cee96fb6deabf, released from the list (1) eap : Peer sent NAK (3) (1) eap : Found mutually acceptable type TTLS (21) (1) eap : Calling eap_ttls to process EAP data (1) eap_ttls : Flushing SSL sessions (of #0) (1) eap_ttls : Initiate (1) eap_ttls : Start returned 1 (1) eap : New EAP session, adding 'State' attribute to reply 0xfb6cee96fa6efbbf (1) [eap] = handled (1) } # authenticate = handled Sending Access-Challenge of id 1 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6cee96fa6efbbfe758ceb5654c59b3 (1) Finished request 1. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=2, length=243 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x0202007015001603010065010000610301528f7d625c4103fc18ddcb8c5f239d7e4e39601382be2a5fc963dd35b0e2384d00003a00390038008800870035008400160013000a00330032009a009900450044002f00960041000500040015001200090014001100080006000300ff0100 State = 0xfb6cee96fa6efbbfe758ceb5654c59b3 Message-Authenticator = 0x5d349f2c0841fe1a84a6e3cd8fdb7105 (2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (2) authorize { (2) filter_username filter_username { (2) ? if (!User-Name) (2) ? if (!User-Name) -> FALSE (2) ? if (User-Name != "%{tolower:%{User-Name}}") (2) expand: "%{tolower:%{User-Name}}" -> '@local.com' (2) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (2) ? if (User-Name =~ / /) (2) ? if (User-Name =~ / /) -> FALSE (2) ? if (User-Name =~ /@.*@/ ) (2) ? if (User-Name =~ /@.*@/ ) -> FALSE (2) ? if (User-Name =~ /\\.\\./ ) (2) ? if (User-Name =~ /\\.\\./ ) -> FALSE (2) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (2) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (2) ? if (User-Name =~ /\\.$/) (2) ? if (User-Name =~ /\\.$/) -> FALSE (2) ? if (User-Name =~ /@\\./) (2) ? if (User-Name =~ /@\\./) -> FALSE (2) } # filter_username filter_username = notfound (2) [preprocess] = ok (2) [chap] = noop (2) [mschap] = noop (2) [digest] = noop (2) suffix : Looking up realm "local.com" for User-Name = "@local.com" (2) suffix : No such realm "local.com" (2) [suffix] = noop (2) eap : EAP packet type response id 2 length 112 (2) eap : Continuing tunnel setup (2) [eap] = ok (2) } # authorize = ok (2) Found Auth-Type = EAP (2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (2) authenticate { (2) eap : Expiring EAP session with state 0xfb6cee96fa6efbbf (2) eap : Finished EAP session with state 0xfb6cee96fa6efbbf (2) eap : Previous EAP request found for state 0xfb6cee96fa6efbbf, released from the list (2) eap : Peer sent TTLS (21) (2) eap : EAP TTLS (21) (2) eap : Calling eap_ttls to process EAP data (2) eap_ttls : Authenticate (2) eap_ttls : processing EAP-TLS (2) eap_ttls : eaptls_verify returned 7 (2) eap_ttls : Done initial handshake (2) eap_ttls : (other): before/accept initialization (2) eap_ttls : TLS_accept: before/accept initialization (2) eap_ttls : <<< TLS 1.0 Handshake [length 0065], ClientHello (2) eap_ttls : TLS_accept: SSLv3 read client hello A (2) eap_ttls : >>> TLS 1.0 Handshake [length 0051], ServerHello (2) eap_ttls : TLS_accept: SSLv3 write server hello A (2) eap_ttls : >>> TLS 1.0 Handshake [length 08d0], Certificate (2) eap_ttls : TLS_accept: SSLv3 write certificate A (2) eap_ttls : >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange (2) eap_ttls : TLS_accept: SSLv3 write key exchange A (2) eap_ttls : >>> TLS 1.0 Handshake [length 0004], ServerHelloDone (2) eap_ttls : TLS_accept: SSLv3 write server done A (2) eap_ttls : TLS_accept: SSLv3 flush data (2) eap_ttls : TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode (2) eap_ttls : eaptls_process returned 13 (2) eap : New EAP session, adding 'State' attribute to reply 0xfb6cee96f96ffbbf (2) [eap] = handled (2) } # authenticate = handled Sending Access-Challenge of id 2 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6cee96f96ffbbfe758ceb5654c59b3 (2) Finished request 2. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=3, length=137 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x020300061500 State = 0xfb6cee96f96ffbbfe758ceb5654c59b3 Message-Authenticator = 0xc7fe9057d4aa56fab4eb4f40b5f95855 (3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (3) authorize { (3) filter_username filter_username { (3) ? if (!User-Name) (3) ? if (!User-Name) -> FALSE (3) ? if (User-Name != "%{tolower:%{User-Name}}") (3) expand: "%{tolower:%{User-Name}}" -> '@local.com' (3) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (3) ? if (User-Name =~ / /) (3) ? if (User-Name =~ / /) -> FALSE (3) ? if (User-Name =~ /@.*@/ ) (3) ? if (User-Name =~ /@.*@/ ) -> FALSE (3) ? if (User-Name =~ /\\.\\./ ) (3) ? if (User-Name =~ /\\.\\./ ) -> FALSE (3) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (3) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (3) ? if (User-Name =~ /\\.$/) (3) ? if (User-Name =~ /\\.$/) -> FALSE (3) ? if (User-Name =~ /@\\./) (3) ? if (User-Name =~ /@\\./) -> FALSE (3) } # filter_username filter_username = notfound (3) [preprocess] = ok (3) [chap] = noop (3) [mschap] = noop (3) [digest] = noop (3) suffix : Looking up realm "local.com" for User-Name = "@local.com" (3) suffix : No such realm "local.com" (3) [suffix] = noop (3) eap : EAP packet type response id 3 length 6 (3) eap : Continuing tunnel setup (3) [eap] = ok (3) } # authorize = ok (3) Found Auth-Type = EAP (3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (3) authenticate { (3) eap : Expiring EAP session with state 0xfb6cee96f96ffbbf (3) eap : Finished EAP session with state 0xfb6cee96f96ffbbf (3) eap : Previous EAP request found for state 0xfb6cee96f96ffbbf, released from the list (3) eap : Peer sent TTLS (21) (3) eap : EAP TTLS (21) (3) eap : Calling eap_ttls to process EAP data (3) eap_ttls : Authenticate (3) eap_ttls : processing EAP-TLS (3) eap_ttls : Received TLS ACK (3) eap_ttls : Received TLS ACK (3) eap_ttls : ACK handshake fragment handler (3) eap_ttls : eaptls_verify returned 1 (3) eap_ttls : eaptls_process returned 13 (3) eap : New EAP session, adding 'State' attribute to reply 0xfb6cee96f868fbbf (3) [eap] = handled (3) } # authenticate = handled Sending Access-Challenge of id 3 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6cee96f868fbbfe758ceb5654c59b3 (3) Finished request 3. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=4, length=137 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x020400061500 State = 0xfb6cee96f868fbbfe758ceb5654c59b3 Message-Authenticator = 0x15ed08c0d3e70f9a3d554be9547dcfca (4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (4) authorize { (4) filter_username filter_username { (4) ? if (!User-Name) (4) ? if (!User-Name) -> FALSE (4) ? if (User-Name != "%{tolower:%{User-Name}}") (4) expand: "%{tolower:%{User-Name}}" -> '@local.com' (4) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (4) ? if (User-Name =~ / /) (4) ? if (User-Name =~ / /) -> FALSE (4) ? if (User-Name =~ /@.*@/ ) (4) ? if (User-Name =~ /@.*@/ ) -> FALSE (4) ? if (User-Name =~ /\\.\\./ ) (4) ? if (User-Name =~ /\\.\\./ ) -> FALSE (4) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (4) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (4) ? if (User-Name =~ /\\.$/) (4) ? if (User-Name =~ /\\.$/) -> FALSE (4) ? if (User-Name =~ /@\\./) (4) ? if (User-Name =~ /@\\./) -> FALSE (4) } # filter_username filter_username = notfound (4) [preprocess] = ok (4) [chap] = noop (4) [mschap] = noop (4) [digest] = noop (4) suffix : Looking up realm "local.com" for User-Name = "@local.com" (4) suffix : No such realm "local.com" (4) [suffix] = noop (4) eap : EAP packet type response id 4 length 6 (4) eap : Continuing tunnel setup (4) [eap] = ok (4) } # authorize = ok (4) Found Auth-Type = EAP (4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (4) authenticate { (4) eap : Expiring EAP session with state 0xfb6cee96f868fbbf (4) eap : Finished EAP session with state 0xfb6cee96f868fbbf (4) eap : Previous EAP request found for state 0xfb6cee96f868fbbf, released from the list (4) eap : Peer sent TTLS (21) (4) eap : EAP TTLS (21) (4) eap : Calling eap_ttls to process EAP data (4) eap_ttls : Authenticate (4) eap_ttls : processing EAP-TLS (4) eap_ttls : Received TLS ACK (4) eap_ttls : Received TLS ACK (4) eap_ttls : ACK handshake fragment handler (4) eap_ttls : eaptls_verify returned 1 (4) eap_ttls : eaptls_process returned 13 (4) eap : New EAP session, adding 'State' attribute to reply 0xfb6cee96ff69fbbf (4) [eap] = handled (4) } # authenticate = handled Sending Access-Challenge of id 4 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6cee96ff69fbbfe758ceb5654c59b3 (4) Finished request 4. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=5, length=335 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x020500cc150016030100861000008200808d7b46d11ae0f4e8450514228f17088263827a6eb96568e276517ad6c6696a8783f134f629716694d22cd12f704fbd76c83a2ab65ef6cd00fd06e508659fce1da72d8037543c99503644ba7c1063ce2f695a421cfd579ac015cf03d6d4ed53124062448ce65eab6065bcc2a8e19679812b16dc4d99824d8c73ebad2c259945ef14030100010116030100301315597eb7e87ef42fd5fe208d22c6337f36ca7d23f14e151a3e15a13a2e4e79945179bdf27bdf00b6dc1b7acd69285a State = 0xfb6cee96ff69fbbfe758ceb5654c59b3 Message-Authenticator = 0xba48705a9fcf933e6c3d5da4f8d38826 (5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (5) authorize { (5) filter_username filter_username { (5) ? if (!User-Name) (5) ? if (!User-Name) -> FALSE (5) ? if (User-Name != "%{tolower:%{User-Name}}") (5) expand: "%{tolower:%{User-Name}}" -> '@local.com' (5) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (5) ? if (User-Name =~ / /) (5) ? if (User-Name =~ / /) -> FALSE (5) ? if (User-Name =~ /@.*@/ ) (5) ? if (User-Name =~ /@.*@/ ) -> FALSE (5) ? if (User-Name =~ /\\.\\./ ) (5) ? if (User-Name =~ /\\.\\./ ) -> FALSE (5) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (5) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (5) ? if (User-Name =~ /\\.$/) (5) ? if (User-Name =~ /\\.$/) -> FALSE (5) ? if (User-Name =~ /@\\./) (5) ? if (User-Name =~ /@\\./) -> FALSE (5) } # filter_username filter_username = notfound (5) [preprocess] = ok (5) [chap] = noop (5) [mschap] = noop (5) [digest] = noop (5) suffix : Looking up realm "local.com" for User-Name = "@local.com" (5) suffix : No such realm "local.com" (5) [suffix] = noop (5) eap : EAP packet type response id 5 length 204 (5) eap : Continuing tunnel setup (5) [eap] = ok (5) } # authorize = ok (5) Found Auth-Type = EAP (5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (5) authenticate { (5) eap : Expiring EAP session with state 0xfb6cee96ff69fbbf (5) eap : Finished EAP session with state 0xfb6cee96ff69fbbf (5) eap : Previous EAP request found for state 0xfb6cee96ff69fbbf, released from the list (5) eap : Peer sent TTLS (21) (5) eap : EAP TTLS (21) (5) eap : Calling eap_ttls to process EAP data (5) eap_ttls : Authenticate (5) eap_ttls : processing EAP-TLS (5) eap_ttls : eaptls_verify returned 7 (5) eap_ttls : Done initial handshake (5) eap_ttls : <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange (5) eap_ttls : TLS_accept: SSLv3 read client key exchange A (5) eap_ttls : <<< TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_ttls : <<< TLS 1.0 Handshake [length 0010], Finished (5) eap_ttls : TLS_accept: SSLv3 read finished A (5) eap_ttls : >>> TLS 1.0 ChangeCipherSpec [length 0001] (5) eap_ttls : TLS_accept: SSLv3 write change cipher spec A (5) eap_ttls : >>> TLS 1.0 Handshake [length 0010], Finished (5) eap_ttls : TLS_accept: SSLv3 write finished A (5) eap_ttls : TLS_accept: SSLv3 flush data SSL: adding session 1791efc62a658dba0e11086b0749168e97c29f02bc30edff9ca87309a906cb1d to cache (5) eap_ttls : (other): SSL negotiation finished successfully SSL Connection Established (5) eap_ttls : eaptls_process returned 13 (5) eap : New EAP session, adding 'State' attribute to reply 0xfb6cee96fe6afbbf (5) [eap] = handled (5) } # authenticate = handled Sending Access-Challenge of id 5 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 EAP-Message = 0x0106004515800000003b1403010001011603010030a05734192e79810a8d64d1a9a7e7789e702ff989baf7a57b968401eacfdc6c86bdf4be2dfdaa03d01b77c065a677fb97 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb6cee96fe6afbbfe758ceb5654c59b3 (5) Finished request 5. Waking up in 0.3 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 34960, id=6, length=259 User-Name = '@local.com' NAS-IP-Address = 127.0.0.1 Calling-Station-Id = '02-00-00-00-00-01' Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = 'CONNECT 11Mbps 802.11b' EAP-Message = 0x0206008015001703010020031c24c5ebf62f75a2c4aa02d6bcc9aef20e66c76d92730bcb397f0ce59a8acc17030100504ecedee67f27e4ed359a2efc2793eaca2f1d9efc7107e29f6ae7d215d62df3945d978bcff12b58e2f8ffed10fba0abeea0fa1e5bb19d5e1bfd296596e83ecaf8b64afd3922e32487a944393e9eacb86f State = 0xfb6cee96fe6afbbfe758ceb5654c59b3 Message-Authenticator = 0x51271701cf938399cc423611b0dc48eb (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (6) authorize { (6) filter_username filter_username { (6) ? if (!User-Name) (6) ? if (!User-Name) -> FALSE (6) ? if (User-Name != "%{tolower:%{User-Name}}") (6) expand: "%{tolower:%{User-Name}}" -> '@local.com' (6) ? if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (6) ? if (User-Name =~ / /) (6) ? if (User-Name =~ / /) -> FALSE (6) ? if (User-Name =~ /@.*@/ ) (6) ? if (User-Name =~ /@.*@/ ) -> FALSE (6) ? if (User-Name =~ /\\.\\./ ) (6) ? if (User-Name =~ /\\.\\./ ) -> FALSE (6) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) (6) ? if ((User-Name =~ /@/) && (User-Name !~ /@(.+)\\.(.+)$/)) -> FALSE (6) ? if (User-Name =~ /\\.$/) (6) ? if (User-Name =~ /\\.$/) -> FALSE (6) ? if (User-Name =~ /@\\./) (6) ? if (User-Name =~ /@\\./) -> FALSE (6) } # filter_username filter_username = notfound (6) [preprocess] = ok (6) [chap] = noop (6) [mschap] = noop (6) [digest] = noop (6) suffix : Looking up realm "local.com" for User-Name = "@local.com" (6) suffix : No such realm "local.com" (6) [suffix] = noop (6) eap : EAP packet type response id 6 length 128 (6) eap : Continuing tunnel setup (6) [eap] = ok (6) } # authorize = ok (6) Found Auth-Type = EAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (6) authenticate { (6) eap : Expiring EAP session with state 0xfb6cee96fe6afbbf (6) eap : Finished EAP session with state 0xfb6cee96fe6afbbf (6) eap : Previous EAP request found for state 0xfb6cee96fe6afbbf, released from the list (6) eap : Peer sent TTLS (21) (6) eap : EAP TTLS (21) (6) eap : Calling eap_ttls to process EAP data (6) eap_ttls : Authenticate (6) eap_ttls : processing EAP-TLS (6) eap_ttls : eaptls_verify returned 7 (6) eap_ttls : Done initial handshake (6) eap_ttls : eaptls_process returned 7 (6) eap_ttls : Session established. Proceeding to decode tunneled attributes (6) eap_ttls : Got tunneled request User-Name = 'steve@local.com' User-Password = 'testing' (6) eap_ttls : Sending tunneled request User-Name = 'steve@local.com' User-Password = 'testing' server inner-tunnel { (6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (6) authorize { (6) [chap] = noop (6) [mschap] = noop (6) suffix : Looking up realm "local.com" for User-Name = "steve@local.com" (6) suffix : No such realm "local.com" (6) [suffix] = noop (6) update control { (6) Proxy-To-Realm := 'LOCAL' (6) } # update control = noop (6) eap : No EAP-Message, not doing EAP (6) [eap] = noop (6) files : users: Matched entry steve@local.com at line 74 (6) [files] = ok (6) [expiration] = noop (6) [logintime] = noop (6) [pap] = updated (6) } # authorize = updated (6) Found Auth-Type = PAP (6) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (6) Auth-Type PAP { (6) pap : login attempt with password "testing" (6) pap : Using clear text password "testing" (6) pap : User authenticated successfully (6) [pap] = ok (6) } # Auth-Type PAP = ok (6) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (6) post-auth { (6) update outer.reply { (6) eap_ttls : expand: "%{request:User-Name}" -> '@local.com' (6) eap_ttls : User-Name = "@local.com" (6) } # update outer.reply = noop (6) } # post-auth = noop } # server inner-tunnel (6) eap_ttls : Got tunneled reply code 2 (6) eap_ttls : Got tunneled Access-Accept (6) eap_ttls : Saving session 1791efc62a658dba0e11086b0749168e97c29f02bc30edff9ca87309a906cb1d vps 0x1e1a890 in the cache (6) eap : Freeing handler (6) [eap] = ok (6) } # authenticate = ok (6) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default (6) post-auth { (6) [exec] = noop (6) remove_reply_message_if_eap remove_reply_message_if_eap { (6) ? if (reply:EAP-Message && reply:Reply-Message) (6) ? if (reply:EAP-Message && reply:Reply-Message) -> FALSE (6) else else { (6) [noop] = noop (6) } # else else = noop (6) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (6) } # post-auth = noop Sending Access-Accept of id 6 from 127.0.0.1 port 1812 to 127.0.0.1 port 34960 User-Name = '@local.com' MS-MPPE-Recv-Key = 0x82c050d1536fe8761e42da5328f916be2d04b5ab269e40cf6348e130bd293b99 MS-MPPE-Send-Key = 0xc25dfbe86c7a41c5b8c3efbbb20d439090e5a0da6b4a7aa4501c8c5c510e2eb1 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 (6) Finished request 6. Waking up in 0.3 seconds. Waking up in 4.6 seconds. (0) Cleaning up request packet ID 0 with timestamp +3 (1) Cleaning up request packet ID 1 with timestamp +3 (2) Cleaning up request packet ID 2 with timestamp +3 (3) Cleaning up request packet ID 3 with timestamp +3 (4) Cleaning up request packet ID 4 with timestamp +3 (5) Cleaning up request packet ID 5 with timestamp +3 (6) Cleaning up request packet ID 6 with timestamp +3 Ready to process requests Janet(UK) is a trading name of Jisc Collections and Janet Limited, a not-for-profit company which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238