Thanks for anwaring, Alan, you were right: that is his MAC Address. Sorry for that missing debug... I had just restarted server and lost all logs. Until this moment, no mac address appeared at radacct table, so I don’t have debug for that yet. For this, if I may ask, why user is registered in radacct table with mac address but in radius log appears his real username? And this one here, that is NOT a mac address: [local]:5432 radius@radius=> select * from radacct where radacctid = '6000795'; -[ RECORD 1 ]------+--------------------------------- radacctid | 6000795 acctsessionid | 38EBA713-00000041 acctuniqueid | 6b521bf17a61aa914f0f67b33c558e07 username | 347117 groupname | realm | nasipaddress | 10.34.15.221 nasportid | 2 nasporttype | Wireless-802.11 acctstarttime | 2020-06-23 11:18:40-03 acctupdatetime | 2020-06-23 11:18:40-03 acctstoptime | acctinterval | acctsessiontime | 0 acctauthentic | RADIUS connectinfo_start | CONNECT 54Mbps 802.11g connectinfo_stop | acctinputoctets | 0 acctoutputoctets | 0 calledstationid | 5C-D9-98-14-37-48:MPDFT callingstationid | 48-49-C7-71-79-66 acctterminatecause | servicetype | framedprotocol | framedipaddress | Time: 4.267 ms [local]:5432 radius@radius=> Reading debug, real login is "luciana.nogueira" Here the debug log for this entry: =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.06.23 12:21:07 =~=~=~=~=~=~=~=~=~=~=~= grep -E "\(4925[7-9]\)|\(4926[0-7]\)" debug.log (49257) Received Access-Request Id 151 from 10.34.15.221:1384 to 10.34.242.3:1812 length 151 (49257) User-Name = "347117" (49257) NAS-IP-Address = 10.34.15.221 (49257) NAS-Port = 2 (49257) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49257) Calling-Station-Id = "48-49-C7-71-79-66" (49257) Framed-MTU = 1400 (49257) NAS-Port-Type = Wireless-802.11 (49257) Connect-Info = "CONNECT 54Mbps 802.11g" (49257) EAP-Message = 0x0200000b01333437313137 (49257) Message-Authenticator = 0x05d29ff74e6c4903b1ab83208153a6ad (49257) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49257) authorize { (49257) policy filter_username { (49257) if (&User-Name) { (49257) if (&User-Name) -> TRUE (49257) if (&User-Name) { (49257) if (&User-Name != "%{tolower:%{User-Name}}") { (49257) EXPAND %{tolower:%{User-Name}} (49257) --> 347117 (49257) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49257) if (&User-Name =~ / /) { (49257) if (&User-Name =~ / /) -> FALSE (49257) if (&User-Name =~ /@[^@]*@/ ) { (49257) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49257) if (&User-Name =~ /\.\./ ) { (49257) if (&User-Name =~ /\.\./ ) -> FALSE (49257) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49257) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49257) if (&User-Name =~ /\.$/) { (49257) if (&User-Name =~ /\.$/) -> FALSE (49257) if (&User-Name =~ /@\./) { (49257) if (&User-Name =~ /@\./) -> FALSE (49257) } # if (&User-Name) = notfound (49257) } # policy filter_username = notfound (49257) [preprocess] = ok (49257) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49257) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49257) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49257) auth_log: EXPAND %t (49257) auth_log: --> Tue Jun 23 11:18:40 2020 (49257) [auth_log] = ok (49257) [chap] = noop (49257) [mschap] = noop (49257) [digest] = noop (49257) suffix: Checking for suffix after "@" (49257) suffix: No '@' in User-Name = "347117", looking up realm NULL (49257) suffix: No such realm "NULL" (49257) [suffix] = noop (49257) eap: Peer sent EAP Response (code 2) ID 0 length 11 (49257) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (49257) [eap] = ok (49257) } # authorize = ok (49257) Found Auth-Type = eap (49257) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49257) authenticate { (49257) eap: Peer sent packet with method EAP Identity (1) (49257) eap: Calling submodule eap_md5 to process data (49257) eap_md5: Issuing MD5 Challenge (49257) eap: Sending EAP Request (code 1) ID 1 length 22 (49257) eap: EAP session adding &reply:State = 0x343264483433605b (49257) [eap] = handled (49257) } # authenticate = handled (49257) Using Post-Auth-Type Challenge (49257) Post-Auth-Type sub-section not found. Ignoring. (49257) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49257) Sent Access-Challenge Id 151 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49257) EAP-Message = 0x010100160410f293b8de33b4c8cebe98befea9b4bfc6 (49257) Message-Authenticator = 0x00000000000000000000000000000000 (49257) State = 0x343264483433605baa04a227c6849a7d (49257) Finished request (49258) Received Access-Request Id 152 from 10.34.15.221:1384 to 10.34.242.3:1812 length 164 (49258) User-Name = "347117" (49258) NAS-IP-Address = 10.34.15.221 (49258) NAS-Port = 2 (49258) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49258) Calling-Station-Id = "48-49-C7-71-79-66" (49258) Framed-MTU = 1400 (49258) NAS-Port-Type = Wireless-802.11 (49258) Connect-Info = "CONNECT 54Mbps 802.11g" (49258) EAP-Message = 0x020100060319 (49258) State = 0x343264483433605baa04a227c6849a7d (49258) Message-Authenticator = 0x2e74fdc7c9c9592fc2232375736fd39e (49258) session-state: No cached attributes (49258) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49258) authorize { (49258) policy filter_username { (49258) if (&User-Name) { (49258) if (&User-Name) -> TRUE (49258) if (&User-Name) { (49258) if (&User-Name != "%{tolower:%{User-Name}}") { (49258) EXPAND %{tolower:%{User-Name}} (49258) --> 347117 (49258) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49258) if (&User-Name =~ / /) { (49258) if (&User-Name =~ / /) -> FALSE (49258) if (&User-Name =~ /@[^@]*@/ ) { (49258) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49258) if (&User-Name =~ /\.\./ ) { (49258) if (&User-Name =~ /\.\./ ) -> FALSE (49258) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49258) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49258) if (&User-Name =~ /\.$/) { (49258) if (&User-Name =~ /\.$/) -> FALSE (49258) if (&User-Name =~ /@\./) { (49258) if (&User-Name =~ /@\./) -> FALSE (49258) } # if (&User-Name) = notfound (49258) } # policy filter_username = notfound (49258) [preprocess] = ok (49258) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49258) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49258) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49258) auth_log: EXPAND %t (49258) auth_log: --> Tue Jun 23 11:18:40 2020 (49258) [auth_log] = ok (49258) [chap] = noop (49258) [mschap] = noop (49258) [digest] = noop (49258) suffix: Checking for suffix after "@" (49258) suffix: No '@' in User-Name = "347117", looking up realm NULL (49258) suffix: No such realm "NULL" (49258) [suffix] = noop (49258) eap: Peer sent EAP Response (code 2) ID 1 length 6 (49258) eap: No EAP Start, assuming it's an on-going EAP conversation (49258) [eap] = updated (49258) files: Failed resolving UID: No error (49258) files: Failed resolving UID: No error (49258) files: Failed resolving UID: No error (49258) files: Failed resolving UID: No error (49258) files: Failed resolving UID: No error (49258) [files] = noop (49258) sql: EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49258) sql: --> 347117 (49258) sql: SQL-User-Name set to '347117' (49258) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (49258) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '347117' ORDER BY id (49258) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '347117' ORDER BY id (49258) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (49258) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='347117' ORDER BY priority (49258) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='347117' ORDER BY priority (49258) sql: User not found in any groups (49258) [sql] = notfound (49258) [expiration] = noop (49258) [logintime] = noop (49258) if (ok) { (49258) if (ok) -> FALSE (49258) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type (49258) pap: WARNING: Authentication will fail unless a "known good" password is available (49258) [pap] = noop (49258) } # authorize = updated (49258) Found Auth-Type = eap (49258) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49258) authenticate { (49258) eap: Expiring EAP session with state 0x9e6734429e602efe (49258) eap: Finished EAP session with state 0x343264483433605b (49258) eap: Previous EAP request found for state 0x343264483433605b, released from the list (49258) eap: Peer sent packet with method EAP NAK (3) (49258) eap: Found mutually acceptable type PEAP (25) (49258) eap: Calling submodule eap_peap to process data (49258) eap_peap: Initiating new EAP-TLS session (49258) eap_peap: [eaptls start] = request (49258) eap: Sending EAP Request (code 1) ID 2 length 6 (49258) eap: EAP session adding &reply:State = 0x3432644835307d5b (49258) [eap] = handled (49258) } # authenticate = handled (49258) Using Post-Auth-Type Challenge (49258) Post-Auth-Type sub-section not found. Ignoring. (49258) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49258) Sent Access-Challenge Id 152 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49258) EAP-Message = 0x010200061920 (49258) Message-Authenticator = 0x00000000000000000000000000000000 (49258) State = 0x3432644835307d5baa04a227c6849a7d (49258) Finished request (49259) Received Access-Request Id 153 from 10.34.15.221:1384 to 10.34.242.3:1812 length 326 (49259) User-Name = "347117" (49259) NAS-IP-Address = 10.34.15.221 (49259) NAS-Port = 2 (49259) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49259) Calling-Station-Id = "48-49-C7-71-79-66" (49259) Framed-MTU = 1400 (49259) NAS-Port-Type = Wireless-802.11 (49259) Connect-Info = "CONNECT 54Mbps 802.11g" (49259) EAP-Message = 0x020200a819800000009e1603010099010000950303262d96da74efd8b3abd9ea487f3eefd244880121eafd4d7ae21333a470c9fa8000003cc02cc030009fc02bc02f009ec00ac024c014c0280039006bc009c023c013c02700330067c007c011009d009c0035003d002f003c00050004000a00ff010000 (49259) State = 0x3432644835307d5baa04a227c6849a7d (49259) Message-Authenticator = 0x50041aeb08622f23641026170cf40598 (49259) session-state: No cached attributes (49259) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49259) authorize { (49259) policy filter_username { (49259) if (&User-Name) { (49259) if (&User-Name) -> TRUE (49259) if (&User-Name) { (49259) if (&User-Name != "%{tolower:%{User-Name}}") { (49259) EXPAND %{tolower:%{User-Name}} (49259) --> 347117 (49259) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49259) if (&User-Name =~ / /) { (49259) if (&User-Name =~ / /) -> FALSE (49259) if (&User-Name =~ /@[^@]*@/ ) { (49259) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49259) if (&User-Name =~ /\.\./ ) { (49259) if (&User-Name =~ /\.\./ ) -> FALSE (49259) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49259) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49259) if (&User-Name =~ /\.$/) { (49259) if (&User-Name =~ /\.$/) -> FALSE (49259) if (&User-Name =~ /@\./) { (49259) if (&User-Name =~ /@\./) -> FALSE (49259) } # if (&User-Name) = notfound (49259) } # policy filter_username = notfound (49259) [preprocess] = ok (49259) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49259) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49259) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49259) auth_log: EXPAND %t (49259) auth_log: --> Tue Jun 23 11:18:40 2020 (49259) [auth_log] = ok (49259) [chap] = noop (49259) [mschap] = noop (49259) [digest] = noop (49259) suffix: Checking for suffix after "@" (49259) suffix: No '@' in User-Name = "347117", looking up realm NULL (49259) suffix: No such realm "NULL" (49259) [suffix] = noop (49259) eap: Peer sent EAP Response (code 2) ID 2 length 168 (49259) eap: Continuing tunnel setup (49259) [eap] = ok (49259) } # authorize = ok (49259) Found Auth-Type = eap (49259) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49259) authenticate { (49259) eap: Expiring EAP session with state 0x9e6734429e602efe (49259) eap: Finished EAP session with state 0x3432644835307d5b (49259) eap: Previous EAP request found for state 0x3432644835307d5b, released from the list (49259) eap: Peer sent packet with method EAP PEAP (25) (49259) eap: Calling submodule eap_peap to process data (49259) eap_peap: Continuing EAP-TLS (49259) eap_peap: Peer indicated complete TLS record size will be 158 bytes (49259) eap_peap: Got complete TLS record (158 bytes) (49259) eap_peap: [eaptls verify] = length included (49259) eap_peap: (other): before SSL initialization (49259) eap_peap: TLS_accept: before SSL initialization (49259) eap_peap: TLS_accept: before SSL initialization (49259) eap_peap: <<< recv TLS 1.2 [length 0099] (49259) eap_peap: TLS_accept: SSLv3/TLS read client hello (49259) eap_peap: >>> send TLS 1.2 [length 003d] (49259) eap_peap: TLS_accept: SSLv3/TLS write server hello (49259) eap_peap: >>> send TLS 1.2 [length 0309] (49259) eap_peap: TLS_accept: SSLv3/TLS write certificate (49259) eap_peap: >>> send TLS 1.2 [length 014d] (49259) eap_peap: TLS_accept: SSLv3/TLS write key exchange (49259) eap_peap: >>> send TLS 1.2 [length 0004] (49259) eap_peap: TLS_accept: SSLv3/TLS write server done (49259) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done (49259) eap_peap: In SSL Handshake Phase (49259) eap_peap: In SSL Accept mode (49259) eap_peap: [eaptls process] = handled (49259) eap: Sending EAP Request (code 1) ID 3 length 1004 (49259) eap: EAP session adding &reply:State = 0x3432644836317d5b (49259) [eap] = handled (49259) } # authenticate = handled (49259) Using Post-Auth-Type Challenge (49259) Post-Auth-Type sub-section not found. Ignoring. (49259) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49259) Sent Access-Challenge Id 153 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49259) EAP-Message = 0x010303ec19c0000004ab160303003d020000390303f241d7c71827a10f2a9b2a858a6aa1d49a9d9ac5b04e7214afadfd6e9e950a4500c030000011ff01000100000b0004030001020017000016030303090b0003050003020002ff308202fb308201e3a003020102020900c2aeeb1715cab80a300d0609 (49259) Message-Authenticator = 0x00000000000000000000000000000000 (49259) State = 0x3432644836317d5baa04a227c6849a7d (49259) Finished request (49260) Received Access-Request Id 154 from 10.34.15.221:1384 to 10.34.242.3:1812 length 164 (49260) User-Name = "347117" (49260) NAS-IP-Address = 10.34.15.221 (49260) NAS-Port = 2 (49260) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49260) Calling-Station-Id = "48-49-C7-71-79-66" (49260) Framed-MTU = 1400 (49260) NAS-Port-Type = Wireless-802.11 (49260) Connect-Info = "CONNECT 54Mbps 802.11g" (49260) EAP-Message = 0x020300061900 (49260) State = 0x3432644836317d5baa04a227c6849a7d (49260) Message-Authenticator = 0x1f873dbabab484975e0fafe17930a45a (49260) session-state: No cached attributes (49260) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49260) authorize { (49260) policy filter_username { (49260) if (&User-Name) { (49260) if (&User-Name) -> TRUE (49260) if (&User-Name) { (49260) if (&User-Name != "%{tolower:%{User-Name}}") { (49260) EXPAND %{tolower:%{User-Name}} (49260) --> 347117 (49260) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49260) if (&User-Name =~ / /) { (49260) if (&User-Name =~ / /) -> FALSE (49260) if (&User-Name =~ /@[^@]*@/ ) { (49260) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49260) if (&User-Name =~ /\.\./ ) { (49260) if (&User-Name =~ /\.\./ ) -> FALSE (49260) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49260) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49260) if (&User-Name =~ /\.$/) { (49260) if (&User-Name =~ /\.$/) -> FALSE (49260) if (&User-Name =~ /@\./) { (49260) if (&User-Name =~ /@\./) -> FALSE (49260) } # if (&User-Name) = notfound (49260) } # policy filter_username = notfound (49260) [preprocess] = ok (49260) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49260) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49260) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49260) auth_log: EXPAND %t (49260) auth_log: --> Tue Jun 23 11:18:40 2020 (49260) [auth_log] = ok (49260) [chap] = noop (49260) [mschap] = noop (49260) [digest] = noop (49260) suffix: Checking for suffix after "@" (49260) suffix: No '@' in User-Name = "347117", looking up realm NULL (49260) suffix: No such realm "NULL" (49260) [suffix] = noop (49260) eap: Peer sent EAP Response (code 2) ID 3 length 6 (49260) eap: Continuing tunnel setup (49260) [eap] = ok (49260) } # authorize = ok (49260) Found Auth-Type = eap (49260) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49260) authenticate { (49260) eap: Expiring EAP session with state 0x9e6734429e602efe (49260) eap: Finished EAP session with state 0x3432644836317d5b (49260) eap: Previous EAP request found for state 0x3432644836317d5b, released from the list (49260) eap: Peer sent packet with method EAP PEAP (25) (49260) eap: Calling submodule eap_peap to process data (49260) eap_peap: Continuing EAP-TLS (49260) eap_peap: Peer ACKed our handshake fragment (49260) eap_peap: [eaptls verify] = request (49260) eap_peap: [eaptls process] = handled (49260) eap: Sending EAP Request (code 1) ID 4 length 207 (49260) eap: EAP session adding &reply:State = 0x3432644837367d5b (49260) [eap] = handled (49260) } # authenticate = handled (49260) Using Post-Auth-Type Challenge (49260) Post-Auth-Type sub-section not found. Ignoring. (49260) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49260) Sent Access-Challenge Id 154 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49260) EAP-Message = 0x010400cf1900305906ade17209efbcdb1498025ff3d98879761462b514b58ec19daff0e28525b8909274c327a5b9f22c77451d049714cbe1b8e95e49ff1eb91889a006f05bba93c0807640ba9eeb989f8c432facb809700019a772e41794c376b7529859d9e66686b46b10ac8917506a28b5c755f6f8b1 (49260) Message-Authenticator = 0x00000000000000000000000000000000 (49260) State = 0x3432644837367d5baa04a227c6849a7d (49260) Finished request (49261) Received Access-Request Id 155 from 10.34.15.221:1384 to 10.34.242.3:1812 length 294 (49261) User-Name = "347117" (49261) NAS-IP-Address = 10.34.15.221 (49261) NAS-Port = 2 (49261) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49261) Calling-Station-Id = "48-49-C7-71-79-66" (49261) Framed-MTU = 1400 (49261) NAS-Port-Type = Wireless-802.11 (49261) Connect-Info = "CONNECT 54Mbps 802.11g" (49261) EAP-Message = 0x0204008819800000007e1603030046100000424104e347c229d4720d030776a26d2195a9d2619346feaa947b8d43fe9fad8481577166a001a8d60a615e17594c4f5d1c555f15ad394a27ea517bd9a9ee202255842914030300010116030300280000000000000000129345887899d05232b771b7479ff7 (49261) State = 0x3432644837367d5baa04a227c6849a7d (49261) Message-Authenticator = 0x8f80e28e4efc8628917e8dcbe18e0622 (49261) session-state: No cached attributes (49261) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49261) authorize { (49261) policy filter_username { (49261) if (&User-Name) { (49261) if (&User-Name) -> TRUE (49261) if (&User-Name) { (49261) if (&User-Name != "%{tolower:%{User-Name}}") { (49261) EXPAND %{tolower:%{User-Name}} (49261) --> 347117 (49261) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49261) if (&User-Name =~ / /) { (49261) if (&User-Name =~ / /) -> FALSE (49261) if (&User-Name =~ /@[^@]*@/ ) { (49261) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49261) if (&User-Name =~ /\.\./ ) { (49261) if (&User-Name =~ /\.\./ ) -> FALSE (49261) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49261) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49261) if (&User-Name =~ /\.$/) { (49261) if (&User-Name =~ /\.$/) -> FALSE (49261) if (&User-Name =~ /@\./) { (49261) if (&User-Name =~ /@\./) -> FALSE (49261) } # if (&User-Name) = notfound (49261) } # policy filter_username = notfound (49261) [preprocess] = ok (49261) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49261) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49261) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49261) auth_log: EXPAND %t (49261) auth_log: --> Tue Jun 23 11:18:40 2020 (49261) [auth_log] = ok (49261) [chap] = noop (49261) [mschap] = noop (49261) [digest] = noop (49261) suffix: Checking for suffix after "@" (49261) suffix: No '@' in User-Name = "347117", looking up realm NULL (49261) suffix: No such realm "NULL" (49261) [suffix] = noop (49261) eap: Peer sent EAP Response (code 2) ID 4 length 136 (49261) eap: Continuing tunnel setup (49261) [eap] = ok (49261) } # authorize = ok (49261) Found Auth-Type = eap (49261) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49261) authenticate { (49261) eap: Expiring EAP session with state 0x9e6734429e602efe (49261) eap: Finished EAP session with state 0x3432644837367d5b (49261) eap: Previous EAP request found for state 0x3432644837367d5b, released from the list (49261) eap: Peer sent packet with method EAP PEAP (25) (49261) eap: Calling submodule eap_peap to process data (49261) eap_peap: Continuing EAP-TLS (49261) eap_peap: Peer indicated complete TLS record size will be 126 bytes (49261) eap_peap: Got complete TLS record (126 bytes) (49261) eap_peap: [eaptls verify] = length included (49261) eap_peap: TLS_accept: SSLv3/TLS write server done (49261) eap_peap: <<< recv TLS 1.2 [length 0046] (49261) eap_peap: TLS_accept: SSLv3/TLS read client key exchange (49261) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec (49261) eap_peap: <<< recv TLS 1.2 [length 0010] (49261) eap_peap: TLS_accept: SSLv3/TLS read finished (49261) eap_peap: >>> send TLS 1.2 [length 0001] (49261) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec (49261) eap_peap: >>> send TLS 1.2 [length 0010] (49261) eap_peap: TLS_accept: SSLv3/TLS write finished (49261) eap_peap: (other): SSL negotiation finished successfully (49261) eap_peap: SSL Connection Established (49261) eap_peap: [eaptls process] = handled (49261) eap: Sending EAP Request (code 1) ID 5 length 57 (49261) eap: EAP session adding &reply:State = 0x3432644830377d5b (49261) [eap] = handled (49261) } # authenticate = handled (49261) Using Post-Auth-Type Challenge (49261) Post-Auth-Type sub-section not found. Ignoring. (49261) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49261) Sent Access-Challenge Id 155 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49261) EAP-Message = 0x01050039190014030300010116030300288ad05ce60e5ee56aa8fd940dbf64fb565398577f45d3a8687b23d15f21a95ece7c4c893f88783014 (49261) Message-Authenticator = 0x00000000000000000000000000000000 (49261) State = 0x3432644830377d5baa04a227c6849a7d (49261) Finished request (49262) Received Access-Request Id 156 from 10.34.15.221:1384 to 10.34.242.3:1812 length 164 (49262) User-Name = "347117" (49262) NAS-IP-Address = 10.34.15.221 (49262) NAS-Port = 2 (49262) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49262) Calling-Station-Id = "48-49-C7-71-79-66" (49262) Framed-MTU = 1400 (49262) NAS-Port-Type = Wireless-802.11 (49262) Connect-Info = "CONNECT 54Mbps 802.11g" (49262) EAP-Message = 0x020500061900 (49262) State = 0x3432644830377d5baa04a227c6849a7d (49262) Message-Authenticator = 0x9a71a530fc4e39a0cda671f47b038d60 (49262) session-state: No cached attributes (49262) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49262) authorize { (49262) policy filter_username { (49262) if (&User-Name) { (49262) if (&User-Name) -> TRUE (49262) if (&User-Name) { (49262) if (&User-Name != "%{tolower:%{User-Name}}") { (49262) EXPAND %{tolower:%{User-Name}} (49262) --> 347117 (49262) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49262) if (&User-Name =~ / /) { (49262) if (&User-Name =~ / /) -> FALSE (49262) if (&User-Name =~ /@[^@]*@/ ) { (49262) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49262) if (&User-Name =~ /\.\./ ) { (49262) if (&User-Name =~ /\.\./ ) -> FALSE (49262) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49262) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49262) if (&User-Name =~ /\.$/) { (49262) if (&User-Name =~ /\.$/) -> FALSE (49262) if (&User-Name =~ /@\./) { (49262) if (&User-Name =~ /@\./) -> FALSE (49262) } # if (&User-Name) = notfound (49262) } # policy filter_username = notfound (49262) [preprocess] = ok (49262) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49262) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49262) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49262) auth_log: EXPAND %t (49262) auth_log: --> Tue Jun 23 11:18:40 2020 (49262) [auth_log] = ok (49262) [chap] = noop (49262) [mschap] = noop (49262) [digest] = noop (49262) suffix: Checking for suffix after "@" (49262) suffix: No '@' in User-Name = "347117", looking up realm NULL (49262) suffix: No such realm "NULL" (49262) [suffix] = noop (49262) eap: Peer sent EAP Response (code 2) ID 5 length 6 (49262) eap: Continuing tunnel setup (49262) [eap] = ok (49262) } # authorize = ok (49262) Found Auth-Type = eap (49262) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49262) authenticate { (49262) eap: Expiring EAP session with state 0x9e6734429e602efe (49262) eap: Finished EAP session with state 0x3432644830377d5b (49262) eap: Previous EAP request found for state 0x3432644830377d5b, released from the list (49262) eap: Peer sent packet with method EAP PEAP (25) (49262) eap: Calling submodule eap_peap to process data (49262) eap_peap: Continuing EAP-TLS (49262) eap_peap: Peer ACKed our handshake fragment. handshake is finished (49262) eap_peap: [eaptls verify] = success (49262) eap_peap: [eaptls process] = success (49262) eap_peap: Session established. Decoding tunneled attributes (49262) eap_peap: PEAP state TUNNEL ESTABLISHED (49262) eap: Sending EAP Request (code 1) ID 6 length 40 (49262) eap: EAP session adding &reply:State = 0x3432644831347d5b (49262) [eap] = handled (49262) } # authenticate = handled (49262) Using Post-Auth-Type Challenge (49262) Post-Auth-Type sub-section not found. Ignoring. (49262) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49262) Sent Access-Challenge Id 156 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49262) EAP-Message = 0x010600281900170303001d8ad05ce60e5ee56b04ae2e2e3b80438ad90309abe6117ae0e5da1b62b4 (49262) Message-Authenticator = 0x00000000000000000000000000000000 (49262) State = 0x3432644831347d5baa04a227c6849a7d (49262) Finished request (49263) Received Access-Request Id 157 from 10.34.15.221:1384 to 10.34.242.3:1812 length 210 (49263) User-Name = "347117" (49263) NAS-IP-Address = 10.34.15.221 (49263) NAS-Port = 2 (49263) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49263) Calling-Station-Id = "48-49-C7-71-79-66" (49263) Framed-MTU = 1400 (49263) NAS-Port-Type = Wireless-802.11 (49263) Connect-Info = "CONNECT 54Mbps 802.11g" (49263) EAP-Message = 0x0206003419001703030029000000000000000128fd4cc44d77dddfae0f69a41d8c6d206cad6d4b0935736eb8e7051c2e6845eeff (49263) State = 0x3432644831347d5baa04a227c6849a7d (49263) Message-Authenticator = 0x8eb9fb4fd0d08a9bab42661adcc8d699 (49263) session-state: No cached attributes (49263) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49263) authorize { (49263) policy filter_username { (49263) if (&User-Name) { (49263) if (&User-Name) -> TRUE (49263) if (&User-Name) { (49263) if (&User-Name != "%{tolower:%{User-Name}}") { (49263) EXPAND %{tolower:%{User-Name}} (49263) --> 347117 (49263) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49263) if (&User-Name =~ / /) { (49263) if (&User-Name =~ / /) -> FALSE (49263) if (&User-Name =~ /@[^@]*@/ ) { (49263) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49263) if (&User-Name =~ /\.\./ ) { (49263) if (&User-Name =~ /\.\./ ) -> FALSE (49263) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49263) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49263) if (&User-Name =~ /\.$/) { (49263) if (&User-Name =~ /\.$/) -> FALSE (49263) if (&User-Name =~ /@\./) { (49263) if (&User-Name =~ /@\./) -> FALSE (49263) } # if (&User-Name) = notfound (49263) } # policy filter_username = notfound (49263) [preprocess] = ok (49263) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49263) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49263) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49263) auth_log: EXPAND %t (49263) auth_log: --> Tue Jun 23 11:18:40 2020 (49263) [auth_log] = ok (49263) [chap] = noop (49263) [mschap] = noop (49263) [digest] = noop (49263) suffix: Checking for suffix after "@" (49263) suffix: No '@' in User-Name = "347117", looking up realm NULL (49263) suffix: No such realm "NULL" (49263) [suffix] = noop (49263) eap: Peer sent EAP Response (code 2) ID 6 length 52 (49263) eap: Continuing tunnel setup (49263) [eap] = ok (49263) } # authorize = ok (49263) Found Auth-Type = eap (49263) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49263) authenticate { (49263) eap: Expiring EAP session with state 0x9e6734429e602efe (49263) eap: Finished EAP session with state 0x3432644831347d5b (49263) eap: Previous EAP request found for state 0x3432644831347d5b, released from the list (49263) eap: Peer sent packet with method EAP PEAP (25) (49263) eap: Calling submodule eap_peap to process data (49263) eap_peap: Continuing EAP-TLS (49263) eap_peap: [eaptls verify] = ok (49263) eap_peap: Done initial handshake (49263) eap_peap: [eaptls process] = ok (49263) eap_peap: Session established. Decoding tunneled attributes (49263) eap_peap: PEAP state WAITING FOR INNER IDENTITY (49263) eap_peap: Identity - luciana.nogueira (49263) eap_peap: Got inner identity 'luciana.nogueira' (49263) eap_peap: Setting default EAP type for tunneled EAP session (49263) eap_peap: Got tunneled request (49263) eap_peap: EAP-Message = 0x02060015016c756369616e612e6e6f677565697261 (49263) eap_peap: Setting User-Name to luciana.nogueira (49263) eap_peap: Sending tunneled request to inner-tunnel (49263) eap_peap: EAP-Message = 0x02060015016c756369616e612e6e6f677565697261 (49263) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (49263) eap_peap: User-Name = "luciana.nogueira" (49263) Virtual server inner-tunnel received request (49263) EAP-Message = 0x02060015016c756369616e612e6e6f677565697261 (49263) FreeRADIUS-Proxied-To = 127.0.0.1 (49263) User-Name = "luciana.nogueira" (49263) WARNING: Outer User-Name is not anonymized. User privacy is compromised. (49263) server inner-tunnel { (49263) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49263) authorize { (49263) policy filter_username { (49263) if (&User-Name) { (49263) if (&User-Name) -> TRUE (49263) if (&User-Name) { (49263) if (&User-Name != "%{tolower:%{User-Name}}") { (49263) EXPAND %{tolower:%{User-Name}} (49263) --> luciana.nogueira (49263) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49263) if (&User-Name =~ / /) { (49263) if (&User-Name =~ / /) -> FALSE (49263) if (&User-Name =~ /@[^@]*@/ ) { (49263) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49263) if (&User-Name =~ /\.\./ ) { (49263) if (&User-Name =~ /\.\./ ) -> FALSE (49263) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49263) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49263) if (&User-Name =~ /\.$/) { (49263) if (&User-Name =~ /\.$/) -> FALSE (49263) if (&User-Name =~ /@\./) { (49263) if (&User-Name =~ /@\./) -> FALSE (49263) } # if (&User-Name) = notfound (49263) } # policy filter_username = notfound (49263) [chap] = noop (49263) [mschap] = noop (49263) suffix: Checking for suffix after "@" (49263) suffix: No '@' in User-Name = "luciana.nogueira", looking up realm NULL (49263) suffix: No such realm "NULL" (49263) [suffix] = noop (49263) update control { (49263) &Proxy-To-Realm := LOCAL (49263) } # update control = noop (49263) eap: Peer sent EAP Response (code 2) ID 6 length 21 (49263) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize (49263) [eap] = ok (49263) } # authorize = ok (49263) Found Auth-Type = eap (49263) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49263) authenticate { (49263) eap: Peer sent packet with method EAP Identity (1) (49263) eap: Calling submodule eap_mschapv2 to process data (49263) eap_mschapv2: Issuing Challenge (49263) eap: Sending EAP Request (code 1) ID 7 length 43 (49263) eap: EAP session adding &reply:State = 0x214671d321416b6e (49263) [eap] = handled (49263) } # authenticate = handled (49263) } # server inner-tunnel (49263) Virtual server sending reply (49263) EAP-Message = 0x0107002b1a01070026109a0612b5b180d839a6e75523a82f49ec667265657261646975732d332e302e3132 (49263) Message-Authenticator = 0x00000000000000000000000000000000 (49263) State = 0x214671d321416b6e6c123acd822f47ac (49263) eap_peap: Got tunneled reply code 11 (49263) eap_peap: EAP-Message = 0x0107002b1a01070026109a0612b5b180d839a6e75523a82f49ec667265657261646975732d332e302e3132 (49263) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (49263) eap_peap: State = 0x214671d321416b6e6c123acd822f47ac (49263) eap_peap: Got tunneled reply RADIUS code 11 (49263) eap_peap: EAP-Message = 0x0107002b1a01070026109a0612b5b180d839a6e75523a82f49ec667265657261646975732d332e302e3132 (49263) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (49263) eap_peap: State = 0x214671d321416b6e6c123acd822f47ac (49263) eap_peap: Got tunneled Access-Challenge (49263) eap: Sending EAP Request (code 1) ID 7 length 74 (49263) eap: EAP session adding &reply:State = 0x3432644832357d5b (49263) [eap] = handled (49263) } # authenticate = handled (49263) Using Post-Auth-Type Challenge (49263) Post-Auth-Type sub-section not found. Ignoring. (49263) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49263) Sent Access-Challenge Id 157 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49263) EAP-Message = 0x0107004a1900170303003f8ad05ce60e5ee56c153fb28473439215526db8736ab97058edf5170bf7b140e9d16783b78ce6e18c1cb2d3fa04bb51df1ecdc736140a04d7d4e797dc3229c3 (49263) Message-Authenticator = 0x00000000000000000000000000000000 (49263) State = 0x3432644832357d5baa04a227c6849a7d (49263) Finished request (49264) Received Access-Request Id 158 from 10.34.15.221:1384 to 10.34.242.3:1812 length 264 (49264) User-Name = "347117" (49264) NAS-IP-Address = 10.34.15.221 (49264) NAS-Port = 2 (49264) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49264) Calling-Station-Id = "48-49-C7-71-79-66" (49264) Framed-MTU = 1400 (49264) NAS-Port-Type = Wireless-802.11 (49264) Connect-Info = "CONNECT 54Mbps 802.11g" (49264) EAP-Message = 0x0207006a1900170303005f0000000000000002d9c7a4e9ae59cfe3d90af91aa0aee002c3b4dc78422285bc88a8e33d7ffa1e58aa98f6fac7d72b4dbffe3a3b4aeccaeaa42df4ab91e78e2aeee31026e98609cd8b51b88663710a6bb29088279292a2cb18a4259c051294 (49264) State = 0x3432644832357d5baa04a227c6849a7d (49264) Message-Authenticator = 0x4b17fd5d5a9b8fd97344948d8a46de86 (49264) session-state: No cached attributes (49264) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49264) authorize { (49264) policy filter_username { (49264) if (&User-Name) { (49264) if (&User-Name) -> TRUE (49264) if (&User-Name) { (49264) if (&User-Name != "%{tolower:%{User-Name}}") { (49264) EXPAND %{tolower:%{User-Name}} (49264) --> 347117 (49264) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49264) if (&User-Name =~ / /) { (49264) if (&User-Name =~ / /) -> FALSE (49264) if (&User-Name =~ /@[^@]*@/ ) { (49264) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49264) if (&User-Name =~ /\.\./ ) { (49264) if (&User-Name =~ /\.\./ ) -> FALSE (49264) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49264) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49264) if (&User-Name =~ /\.$/) { (49264) if (&User-Name =~ /\.$/) -> FALSE (49264) if (&User-Name =~ /@\./) { (49264) if (&User-Name =~ /@\./) -> FALSE (49264) } # if (&User-Name) = notfound (49264) } # policy filter_username = notfound (49264) [preprocess] = ok (49264) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49264) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49264) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49264) auth_log: EXPAND %t (49264) auth_log: --> Tue Jun 23 11:18:40 2020 (49264) [auth_log] = ok (49264) [chap] = noop (49264) [mschap] = noop (49264) [digest] = noop (49264) suffix: Checking for suffix after "@" (49264) suffix: No '@' in User-Name = "347117", looking up realm NULL (49264) suffix: No such realm "NULL" (49264) [suffix] = noop (49264) eap: Peer sent EAP Response (code 2) ID 7 length 106 (49264) eap: Continuing tunnel setup (49264) [eap] = ok (49264) } # authorize = ok (49264) Found Auth-Type = eap (49264) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49264) authenticate { (49264) eap: Expiring EAP session with state 0x9e6734429e602efe (49264) eap: Finished EAP session with state 0x3432644832357d5b (49264) eap: Previous EAP request found for state 0x3432644832357d5b, released from the list (49264) eap: Peer sent packet with method EAP PEAP (25) (49264) eap: Calling submodule eap_peap to process data (49264) eap_peap: Continuing EAP-TLS (49264) eap_peap: [eaptls verify] = ok (49264) eap_peap: Done initial handshake (49264) eap_peap: [eaptls process] = ok (49264) eap_peap: Session established. Decoding tunneled attributes (49264) eap_peap: PEAP state phase2 (49264) eap_peap: EAP method MSCHAPv2 (26) (49264) eap_peap: Got tunneled request (49264) eap_peap: EAP-Message = 0x0207004b1a02070046317d5d43a19660ebbee7c397f7438f711a00000000000000004fa6868fa93a73fa085c7782f38db715816854ca6d1cc81b006c756369616e612e6e6f677565697261 (49264) eap_peap: Setting User-Name to luciana.nogueira (49264) eap_peap: Sending tunneled request to inner-tunnel (49264) eap_peap: EAP-Message = 0x0207004b1a02070046317d5d43a19660ebbee7c397f7438f711a00000000000000004fa6868fa93a73fa085c7782f38db715816854ca6d1cc81b006c756369616e612e6e6f677565697261 (49264) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (49264) eap_peap: User-Name = "luciana.nogueira" (49264) eap_peap: State = 0x214671d321416b6e6c123acd822f47ac (49264) Virtual server inner-tunnel received request (49264) EAP-Message = 0x0207004b1a02070046317d5d43a19660ebbee7c397f7438f711a00000000000000004fa6868fa93a73fa085c7782f38db715816854ca6d1cc81b006c756369616e612e6e6f677565697261 (49264) FreeRADIUS-Proxied-To = 127.0.0.1 (49264) User-Name = "luciana.nogueira" (49264) State = 0x214671d321416b6e6c123acd822f47ac (49264) WARNING: Outer User-Name is not anonymized. User privacy is compromised. (49264) server inner-tunnel { (49264) session-state: No cached attributes (49264) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49264) authorize { (49264) policy filter_username { (49264) if (&User-Name) { (49264) if (&User-Name) -> TRUE (49264) if (&User-Name) { (49264) if (&User-Name != "%{tolower:%{User-Name}}") { (49264) EXPAND %{tolower:%{User-Name}} (49264) --> luciana.nogueira (49264) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49264) if (&User-Name =~ / /) { (49264) if (&User-Name =~ / /) -> FALSE (49264) if (&User-Name =~ /@[^@]*@/ ) { (49264) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49264) if (&User-Name =~ /\.\./ ) { (49264) if (&User-Name =~ /\.\./ ) -> FALSE (49264) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49264) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49264) if (&User-Name =~ /\.$/) { (49264) if (&User-Name =~ /\.$/) -> FALSE (49264) if (&User-Name =~ /@\./) { (49264) if (&User-Name =~ /@\./) -> FALSE (49264) } # if (&User-Name) = notfound (49264) } # policy filter_username = notfound (49264) [chap] = noop (49264) [mschap] = noop (49264) suffix: Checking for suffix after "@" (49264) suffix: No '@' in User-Name = "luciana.nogueira", looking up realm NULL (49264) suffix: No such realm "NULL" (49264) [suffix] = noop (49264) update control { (49264) &Proxy-To-Realm := LOCAL (49264) } # update control = noop (49264) eap: Peer sent EAP Response (code 2) ID 7 length 75 (49264) eap: No EAP Start, assuming it's an on-going EAP conversation (49264) [eap] = updated (49264) files: users: Matched entry DEFAULT at line 90 (49264) [files] = ok (49264) sql: EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49264) sql: --> luciana.nogueira (49264) sql: SQL-User-Name set to 'luciana.nogueira' (49264) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (49264) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'luciana.nogueira' ORDER BY id (49264) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'luciana.nogueira' ORDER BY id (49264) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (49264) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='luciana.nogueira' ORDER BY priority (49264) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='luciana.nogueira' ORDER BY priority (49264) sql: User not found in any groups (49264) [sql] = notfound (49264) [expiration] = noop (49264) [logintime] = noop (49264) [pap] = noop (49264) } # authorize = updated (49264) Found Auth-Type = eap (49264) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49264) authenticate { (49264) eap: Expiring EAP session with state 0x9e6734429e602efe (49264) eap: Finished EAP session with state 0x214671d321416b6e (49264) eap: Previous EAP request found for state 0x214671d321416b6e, released from the list (49264) eap: Peer sent packet with method EAP MSCHAPv2 (26) (49264) eap: Calling submodule eap_mschapv2 to process data (49264) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49264) eap_mschapv2: authenticate { (49264) mschap: Creating challenge hash with username: luciana.nogueira (49264) mschap: Client is using MS-CHAPv2 (49264) mschap: EXPAND %{mschap:User-Name} (49264) mschap: --> luciana.nogueira (49264) mschap: ERROR: No NT-Domain was found in the User-Name (49264) mschap: EXPAND %{mschap:NT-Domain} (49264) mschap: --> (49264) mschap: sending authentication request user='luciana.nogueira' domain='' (49264) mschap: Authenticated successfully (49264) mschap: Adding MS-CHAPv2 MPPE keys (49264) [mschap] = ok (49264) } # authenticate = ok (49264) MSCHAP Success (49264) eap: Sending EAP Request (code 1) ID 8 length 51 (49264) eap: EAP session adding &reply:State = 0x214671d3204e6b6e (49264) [eap] = handled (49264) } # authenticate = handled (49264) } # server inner-tunnel (49264) Virtual server sending reply (49264) Idle-Timeout = 300 (49264) EAP-Message = 0x010800331a0307002e533d37324435314333433134354231383437464635313334414535453342374531304436323434453630 (49264) Message-Authenticator = 0x00000000000000000000000000000000 (49264) State = 0x214671d3204e6b6e6c123acd822f47ac (49264) eap_peap: Got tunneled reply code 11 (49264) eap_peap: Idle-Timeout = 300 (49264) eap_peap: EAP-Message = 0x010800331a0307002e533d37324435314333433134354231383437464635313334414535453342374531304436323434453630 (49264) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (49264) eap_peap: State = 0x214671d3204e6b6e6c123acd822f47ac (49264) eap_peap: Got tunneled reply RADIUS code 11 (49264) eap_peap: Idle-Timeout = 300 (49264) eap_peap: EAP-Message = 0x010800331a0307002e533d37324435314333433134354231383437464635313334414535453342374531304436323434453630 (49264) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (49264) eap_peap: State = 0x214671d3204e6b6e6c123acd822f47ac (49264) eap_peap: Got tunneled Access-Challenge (49264) eap: Sending EAP Request (code 1) ID 8 length 82 (49264) eap: EAP session adding &reply:State = 0x34326448333a7d5b (49264) [eap] = handled (49264) } # authenticate = handled (49264) Using Post-Auth-Type Challenge (49264) Post-Auth-Type sub-section not found. Ignoring. (49264) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49264) Sent Access-Challenge Id 158 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49264) EAP-Message = 0x01080052190017030300478ad05ce60e5ee56dce23340a3be2c962cc4f7d1ee8e7ae9aef666bf4fac4aa03796c641f3b59020ff440d471af287ef622a0fb7b6e3775db7348671ab310c104c57ca5045628d7 (49264) Message-Authenticator = 0x00000000000000000000000000000000 (49264) State = 0x34326448333a7d5baa04a227c6849a7d (49264) Finished request (49265) Received Access-Request Id 159 from 10.34.15.221:1384 to 10.34.242.3:1812 length 195 (49265) User-Name = "347117" (49265) NAS-IP-Address = 10.34.15.221 (49265) NAS-Port = 2 (49265) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49265) Calling-Station-Id = "48-49-C7-71-79-66" (49265) Framed-MTU = 1400 (49265) NAS-Port-Type = Wireless-802.11 (49265) Connect-Info = "CONNECT 54Mbps 802.11g" (49265) EAP-Message = 0x020800251900170303001a00000000000000031247ab59722d1f524f21b21b65b88b21dc63 (49265) State = 0x34326448333a7d5baa04a227c6849a7d (49265) Message-Authenticator = 0x4e23dd00e538823df81cfcd85802e7d5 (49265) session-state: No cached attributes (49265) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49265) authorize { (49265) policy filter_username { (49265) if (&User-Name) { (49265) if (&User-Name) -> TRUE (49265) if (&User-Name) { (49265) if (&User-Name != "%{tolower:%{User-Name}}") { (49265) EXPAND %{tolower:%{User-Name}} (49265) --> 347117 (49265) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49265) if (&User-Name =~ / /) { (49265) if (&User-Name =~ / /) -> FALSE (49265) if (&User-Name =~ /@[^@]*@/ ) { (49265) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49265) if (&User-Name =~ /\.\./ ) { (49265) if (&User-Name =~ /\.\./ ) -> FALSE (49265) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49265) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49265) if (&User-Name =~ /\.$/) { (49265) if (&User-Name =~ /\.$/) -> FALSE (49265) if (&User-Name =~ /@\./) { (49265) if (&User-Name =~ /@\./) -> FALSE (49265) } # if (&User-Name) = notfound (49265) } # policy filter_username = notfound (49265) [preprocess] = ok (49265) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49265) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49265) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49265) auth_log: EXPAND %t (49265) auth_log: --> Tue Jun 23 11:18:40 2020 (49265) [auth_log] = ok (49265) [chap] = noop (49265) [mschap] = noop (49265) [digest] = noop (49265) suffix: Checking for suffix after "@" (49265) suffix: No '@' in User-Name = "347117", looking up realm NULL (49265) suffix: No such realm "NULL" (49265) [suffix] = noop (49265) eap: Peer sent EAP Response (code 2) ID 8 length 37 (49265) eap: Continuing tunnel setup (49265) [eap] = ok (49265) } # authorize = ok (49265) Found Auth-Type = eap (49265) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49265) authenticate { (49265) eap: Expiring EAP session with state 0x9e6734429e602efe (49265) eap: Finished EAP session with state 0x34326448333a7d5b (49265) eap: Previous EAP request found for state 0x34326448333a7d5b, released from the list (49265) eap: Peer sent packet with method EAP PEAP (25) (49265) eap: Calling submodule eap_peap to process data (49265) eap_peap: Continuing EAP-TLS (49265) eap_peap: [eaptls verify] = ok (49265) eap_peap: Done initial handshake (49265) eap_peap: [eaptls process] = ok (49265) eap_peap: Session established. Decoding tunneled attributes (49265) eap_peap: PEAP state phase2 (49265) eap_peap: EAP method MSCHAPv2 (26) (49265) eap_peap: Got tunneled request (49265) eap_peap: EAP-Message = 0x020800061a03 (49265) eap_peap: Setting User-Name to luciana.nogueira (49265) eap_peap: Sending tunneled request to inner-tunnel (49265) eap_peap: EAP-Message = 0x020800061a03 (49265) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 (49265) eap_peap: User-Name = "luciana.nogueira" (49265) eap_peap: State = 0x214671d3204e6b6e6c123acd822f47ac (49265) Virtual server inner-tunnel received request (49265) EAP-Message = 0x020800061a03 (49265) FreeRADIUS-Proxied-To = 127.0.0.1 (49265) User-Name = "luciana.nogueira" (49265) State = 0x214671d3204e6b6e6c123acd822f47ac (49265) WARNING: Outer User-Name is not anonymized. User privacy is compromised. (49265) server inner-tunnel { (49265) session-state: No cached attributes (49265) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49265) authorize { (49265) policy filter_username { (49265) if (&User-Name) { (49265) if (&User-Name) -> TRUE (49265) if (&User-Name) { (49265) if (&User-Name != "%{tolower:%{User-Name}}") { (49265) EXPAND %{tolower:%{User-Name}} (49265) --> luciana.nogueira (49265) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49265) if (&User-Name =~ / /) { (49265) if (&User-Name =~ / /) -> FALSE (49265) if (&User-Name =~ /@[^@]*@/ ) { (49265) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49265) if (&User-Name =~ /\.\./ ) { (49265) if (&User-Name =~ /\.\./ ) -> FALSE (49265) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49265) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49265) if (&User-Name =~ /\.$/) { (49265) if (&User-Name =~ /\.$/) -> FALSE (49265) if (&User-Name =~ /@\./) { (49265) if (&User-Name =~ /@\./) -> FALSE (49265) } # if (&User-Name) = notfound (49265) } # policy filter_username = notfound (49265) [chap] = noop (49265) [mschap] = noop (49265) suffix: Checking for suffix after "@" (49265) suffix: No '@' in User-Name = "luciana.nogueira", looking up realm NULL (49265) suffix: No such realm "NULL" (49265) [suffix] = noop (49265) update control { (49265) &Proxy-To-Realm := LOCAL (49265) } # update control = noop (49265) eap: Peer sent EAP Response (code 2) ID 8 length 6 (49265) eap: No EAP Start, assuming it's an on-going EAP conversation (49265) [eap] = updated (49265) files: users: Matched entry DEFAULT at line 90 (49265) [files] = ok (49265) sql: EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49265) sql: --> luciana.nogueira (49265) sql: SQL-User-Name set to 'luciana.nogueira' (49265) sql: EXPAND SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id (49265) sql: --> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'luciana.nogueira' ORDER BY id (49265) sql: Executing select query: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'luciana.nogueira' ORDER BY id (49265) sql: EXPAND SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Name}' ORDER BY priority (49265) sql: --> SELECT GroupName FROM radusergroup WHERE UserName='luciana.nogueira' ORDER BY priority (49265) sql: Executing select query: SELECT GroupName FROM radusergroup WHERE UserName='luciana.nogueira' ORDER BY priority (49265) sql: User not found in any groups (49265) [sql] = notfound (49265) [expiration] = noop (49265) [logintime] = noop (49265) [pap] = noop (49265) } # authorize = updated (49265) Found Auth-Type = eap (49265) # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49265) authenticate { (49265) eap: Expiring EAP session with state 0x9e6734429e602efe (49265) eap: Finished EAP session with state 0x214671d3204e6b6e (49265) eap: Previous EAP request found for state 0x214671d3204e6b6e, released from the list (49265) eap: Peer sent packet with method EAP MSCHAPv2 (26) (49265) eap: Calling submodule eap_mschapv2 to process data (49265) eap: Sending EAP Success (code 3) ID 8 length 4 (49265) eap: Freeing handler (49265) [eap] = ok (49265) } # authenticate = ok (49265) # Executing section session from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49265) session { (49265) sql: EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49265) sql: --> luciana.nogueira (49265) sql: SQL-User-Name set to 'luciana.nogueira' (49265) sql: EXPAND SELECT COUNT(distinct callingstationid) FROM radacct WHERE UserName='%{SQL-User-Name}' AND CallingStationId<>'%{outer.request:Calling-Station-Id}' AND AcctStopTime IS NULL (49265) sql: --> SELECT COUNT(distinct callingstationid) FROM radacct WHERE UserName='luciana.nogueira' AND CallingStationId<>'48-49-C7-71-79-66' AND AcctStopTime IS NULL (49265) sql: Executing select query: SELECT COUNT(distinct callingstationid) FROM radacct WHERE UserName='luciana.nogueira' AND CallingStationId<>'48-49-C7-71-79-66' AND AcctStopTime IS NULL (49265) [sql] = ok (49265) } # session = ok (49265) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/inner-tunnel (49265) post-auth { (49265) reply_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail (49265) reply_log: --> /var/log/freeradius/radacct/10.34.15.221/reply-detail (49265) reply_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail expands to /var/log/freeradius/radacct/10.34.15.221/reply-detail (49265) reply_log: EXPAND %t (49265) reply_log: --> Tue Jun 23 11:18:40 2020 (49265) [reply_log] = ok (49265) } # post-auth = ok (49265) Login OK: [luciana.nogueira] (from client AP-SD1-A03-Q01 port 0 via TLS tunnel) (49265) } # server inner-tunnel (49265) Virtual server sending reply (49265) Idle-Timeout = 300 (49265) MS-MPPE-Encryption-Policy = Encryption-Allowed (49265) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (49265) MS-MPPE-Send-Key = 0x0442265aeb85be20654b653f432e0880 (49265) MS-MPPE-Recv-Key = 0x1e4c074598ed6ae313dab160b53e5d6c (49265) EAP-Message = 0x03080004 (49265) Message-Authenticator = 0x00000000000000000000000000000000 (49265) User-Name = "luciana.nogueira" (49265) eap_peap: Got tunneled reply code 2 (49265) eap_peap: Idle-Timeout = 300 (49265) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (49265) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (49265) eap_peap: MS-MPPE-Send-Key = 0x0442265aeb85be20654b653f432e0880 (49265) eap_peap: MS-MPPE-Recv-Key = 0x1e4c074598ed6ae313dab160b53e5d6c (49265) eap_peap: EAP-Message = 0x03080004 (49265) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (49265) eap_peap: User-Name = "luciana.nogueira" (49265) eap_peap: Got tunneled reply RADIUS code 2 (49265) eap_peap: Idle-Timeout = 300 (49265) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed (49265) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed (49265) eap_peap: MS-MPPE-Send-Key = 0x0442265aeb85be20654b653f432e0880 (49265) eap_peap: MS-MPPE-Recv-Key = 0x1e4c074598ed6ae313dab160b53e5d6c (49265) eap_peap: EAP-Message = 0x03080004 (49265) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 (49265) eap_peap: User-Name = "luciana.nogueira" (49265) eap_peap: Tunneled authentication was successful (49265) eap_peap: SUCCESS (49265) eap: Sending EAP Request (code 1) ID 9 length 46 (49265) eap: EAP session adding &reply:State = 0x343264483c3b7d5b (49265) [eap] = handled (49265) } # authenticate = handled (49265) Using Post-Auth-Type Challenge (49265) Post-Auth-Type sub-section not found. Ignoring. (49265) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49265) Sent Access-Challenge Id 159 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49265) EAP-Message = 0x0109002e190017030300238ad05ce60e5ee56e3f85995ad4d9fa3e7353121ef0323fdf5e8a60cf3b9b554a80d3dd (49265) Message-Authenticator = 0x00000000000000000000000000000000 (49265) State = 0x343264483c3b7d5baa04a227c6849a7d (49265) Finished request (49266) Received Access-Request Id 160 from 10.34.15.221:1384 to 10.34.242.3:1812 length 204 (49266) User-Name = "347117" (49266) NAS-IP-Address = 10.34.15.221 (49266) NAS-Port = 2 (49266) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49266) Calling-Station-Id = "48-49-C7-71-79-66" (49266) Framed-MTU = 1400 (49266) NAS-Port-Type = Wireless-802.11 (49266) Connect-Info = "CONNECT 54Mbps 802.11g" (49266) EAP-Message = 0x0209002e190017030300230000000000000004c778ad733d5b70db3716819554f83810f465ba77cd7845e575c9ff (49266) State = 0x343264483c3b7d5baa04a227c6849a7d (49266) Message-Authenticator = 0x855882f09e771e57421e4a41f6ea470c (49266) session-state: No cached attributes (49266) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default (49266) authorize { (49266) policy filter_username { (49266) if (&User-Name) { (49266) if (&User-Name) -> TRUE (49266) if (&User-Name) { (49266) if (&User-Name != "%{tolower:%{User-Name}}") { (49266) EXPAND %{tolower:%{User-Name}} (49266) --> 347117 (49266) if (&User-Name != "%{tolower:%{User-Name}}") -> FALSE (49266) if (&User-Name =~ / /) { (49266) if (&User-Name =~ / /) -> FALSE (49266) if (&User-Name =~ /@[^@]*@/ ) { (49266) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (49266) if (&User-Name =~ /\.\./ ) { (49266) if (&User-Name =~ /\.\./ ) -> FALSE (49266) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { (49266) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE (49266) if (&User-Name =~ /\.$/) { (49266) if (&User-Name =~ /\.$/) -> FALSE (49266) if (&User-Name =~ /@\./) { (49266) if (&User-Name =~ /@\./) -> FALSE (49266) } # if (&User-Name) = notfound (49266) } # policy filter_username = notfound (49266) [preprocess] = ok (49266) auth_log: EXPAND /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail (49266) auth_log: --> /var/log/freeradius/radacct/10.34.15.221/auth-detail (49266) auth_log: /var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail expands to /var/log/freeradius/radacct/10.34.15.221/auth-detail (49266) auth_log: EXPAND %t (49266) auth_log: --> Tue Jun 23 11:18:40 2020 (49266) [auth_log] = ok (49266) [chap] = noop (49266) [mschap] = noop (49266) [digest] = noop (49266) suffix: Checking for suffix after "@" (49266) suffix: No '@' in User-Name = "347117", looking up realm NULL (49266) suffix: No such realm "NULL" (49266) [suffix] = noop (49266) eap: Peer sent EAP Response (code 2) ID 9 length 46 (49266) eap: Continuing tunnel setup (49266) [eap] = ok (49266) } # authorize = ok (49266) Found Auth-Type = eap (49266) # Executing group from file /etc/freeradius/3.0/sites-enabled/default (49266) authenticate { (49266) eap: Expiring EAP session with state 0x9e6734429e602efe (49266) eap: Finished EAP session with state 0x343264483c3b7d5b (49266) eap: Previous EAP request found for state 0x343264483c3b7d5b, released from the list (49266) eap: Peer sent packet with method EAP PEAP (25) (49266) eap: Calling submodule eap_peap to process data (49266) eap_peap: Continuing EAP-TLS (49266) eap_peap: [eaptls verify] = ok (49266) eap_peap: Done initial handshake (49266) eap_peap: [eaptls process] = ok (49266) eap_peap: Session established. Decoding tunneled attributes (49266) eap_peap: PEAP state send tlv success (49266) eap_peap: Received EAP-TLV response (49266) eap_peap: Success (49266) eap: Sending EAP Success (code 3) ID 9 length 4 (49266) eap: Freeing handler (49266) [eap] = ok (49266) } # authenticate = ok (49266) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default (49266) post-auth { (49266) update { (49266) No attributes updated (49266) } # update = noop (49266) sql: EXPAND .query (49266) sql: --> .query (49266) sql: Using query template 'query' (49266) sql: EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49266) sql: --> 347117 (49266) sql: SQL-User-Name set to '347117' (49266) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', '%{Called-Station-Id}', '%{Calling-Station-Id}', TO_TIMESTAMP(%{integer:Event-Timestamp})) (49266) sql: --> INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('347117', 'Chap-Password', 'Access-Accept', '5C-D9-98-14-37-48:MPDFT', '48-49-C7-71-79-66', TO_TIMESTAMP(1592921920)) (49266) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, calledstationid, callingstationid, authdate) VALUES('347117', 'Chap-Password', 'Access-Accept', '5C-D9-98-14-37-48:MPDFT', '48-49-C7-71-79-66', TO_TIMESTAMP(1592921920)) (49266) sql: SQL query returned: success (49266) sql: 1 record(s) updated (49266) [sql] = ok (49266) [exec] = noop (49266) policy remove_reply_message_if_eap { (49266) if (&reply:EAP-Message && &reply:Reply-Message) { (49266) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (49266) else { (49266) [noop] = noop (49266) } # else = noop (49266) } # policy remove_reply_message_if_eap = noop (49266) } # post-auth = ok (49266) Login OK: [347117] (from client AP-SD1-A03-Q01 port 2 cli 48-49-C7-71-79-66) (49266) Sent Access-Accept Id 160 from 10.34.242.3:1812 to 10.34.15.221:1384 length 0 (49266) MS-MPPE-Recv-Key = 0x542d83c1eb40f8c303c2eb8158cb7e7db2151c3568559646f0ae6cc2b4834cdc (49266) MS-MPPE-Send-Key = 0xe5c545e00159f5d356a41a506a2bfdda247960a2b6a0044c7bf9037a48336c63 (49266) EAP-Message = 0x03090004 (49266) Message-Authenticator = 0x00000000000000000000000000000000 (49266) User-Name = "347117" (49266) Finished request (49267) Received Accounting-Request Id 161 from 10.34.15.221:1386 to 10.34.242.3:1813 length 145 (49267) Acct-Session-Id = "38EBA713-00000041" (49267) Acct-Status-Type = Start (49267) Acct-Authentic = RADIUS (49267) User-Name = "347117" (49267) NAS-IP-Address = 10.34.15.221 (49267) NAS-Port = 2 (49267) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49267) Calling-Station-Id = "48-49-C7-71-79-66" (49267) NAS-Port-Type = Wireless-802.11 (49267) Connect-Info = "CONNECT 54Mbps 802.11g" (49267) # Executing section preacct from file /etc/freeradius/3.0/sites-enabled/default (49267) preacct { (49267) [preprocess] = ok (49267) update request { (49267) EXPAND %{expr: %l - %{%{Acct-Session-Time}:-0} - %{%{Acct-Delay-Time}:-0}} (49267) --> 1592921920 (49267) FreeRADIUS-Acct-Session-Start-Time = Jun 23 2020 11:18:40 -03 (49267) } # update request = noop (49267) policy acct_unique { (49267) update request { (49267) Tmp-String-9 := "ai:" (49267) } # update request = noop (49267) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) { (49267) EXPAND %{hex:&Class} (49267) --> (49267) EXPAND ^%{hex:&Tmp-String-9} (49267) --> ^61693a (49267) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE (49267) else { (49267) update request { (49267) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{Calling-Station-Id}} (49267) --> 6b521bf17a61aa914f0f67b33c558e07 (49267) &Acct-Unique-Session-Id := 6b521bf17a61aa914f0f67b33c558e07 (49267) } # update request = noop (49267) } # else = noop (49267) } # policy acct_unique = noop (49267) suffix: Checking for suffix after "@" (49267) suffix: No '@' in User-Name = "347117", looking up realm NULL (49267) suffix: No such realm "NULL" (49267) [suffix] = noop (49267) files: acct_users: Matched entry DEFAULT at line 22 (49267) files: EXPAND %{%{Stripped-User-Name}:-%{User-Name}} (49267) files: --> 347117 (49267) [files] = ok (49267) } # preacct = ok (49267) # Executing section accounting from file /etc/freeradius/3.0/sites-enabled/default (49267) accounting { (49267) log_accounting: EXPAND Accounting-Request.%{%{Acct-Status-Type}:-unknown} (49267) log_accounting: --> Accounting-Request.Start (49267) log_accounting: EXPAND %{date:Event-Timestamp} Connect: [%{User-Name}] (did %{Called-Station-Id} cli %{Calling-Station-Id} port %{NAS-Port} ip %{Framed-IP-Address}) (49267) log_accounting: --> Tue, 23-06-2020 11:18:40 Connect: [347117] (did 5C-D9-98-14-37-48:MPDFT cli 48-49-C7-71-79-66 port 2 ip ) (49267) log_accounting: EXPAND /var/log/freeradius/linelog-accounting (49267) log_accounting: --> /var/log/freeradius/linelog-accounting (49267) [log_accounting] = ok (49267) sql: EXPAND %{tolower:type.%{%{Acct-Status-Type}:-none}.query} (49267) sql: --> type.start.query (49267) sql: Using query template 'query' (49267) sql: EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49267) sql: --> 347117 (49267) sql: SQL-User-Name set to '347117' (49267) sql: EXPAND INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_Stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIpAddress) VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}}', NULLIF('%{%{NAS-Port-ID}:-%{NAS-Port}}', ''), '%{NAS-Port-Type}', TO_TIMESTAMP(%{integer:Event-Timestamp}), TO_TIMESTAMP(%{integer:Event-Timestamp}), NULL, 0, '%{Acct-Authentic}', '%{Connect-Info}', NULL, 0, 0, '%{Called-Station-Id}', '%{Calling-Station-Id}', NULL, '%{Service-Type}', '%{Framed-Protocol}', NULLIF('%{Framed-IP-Address}', '')::inet) (49267) sql: --> INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_Stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIpAddress) VALUES('38EBA713-00000041', '6b521bf17a61aa914f0f67b33c558e07', '347117', NULLIF('', ''), '10.34.15.221', NULLIF('2', ''), 'Wireless-802.11', TO_TIMESTAMP(1592921920), TO_TIMESTAMP(1592921920), NULL, 0, 'RADIUS', 'CONNECT 54Mbps 802.11g', NULL, 0, 0, '5C-D9-98-14-37-48:MPDFT', '48-49-C7-71-79-66', NULL, '', '', NULLIF('', '')::inet) (49267) sql: Executing query: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctUpdateTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_Stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIpAddress) VALUES('38EBA713-00000041', '6b521bf17a61aa914f0f67b33c558e07', '347117', NULLIF('', ''), '10.34.15.221', NULLIF('2', ''), 'Wireless-802.11', TO_TIMESTAMP(1592921920), TO_TIMESTAMP(1592921920), NULL, 0, 'RADIUS', 'CONNECT 54Mbps 802.11g', NULL, 0, 0, '5C-D9-98-14-37-48:MPDFT', '48-49-C7-71-79-66', NULL, '', '', NULLIF('', '')::inet) (49267) sql: SQL query returned: success (49267) sql: 1 record(s) updated (49267) [sql] = ok (49267) if (&request:Acct-Status-Type == start) { (49267) if (&request:Acct-Status-Type == start) -> TRUE (49267) if (&request:Acct-Status-Type == start) { (49267) EXPAND %{tolower:%{%{Stripped-User-Name}:-%{%{User-Name}:-none}}} (49267) --> 347117 (49267) SQL-User-Name set to '347117' (49267) Executing query: UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(1592921920), AcctUpdateTime = TO_TIMESTAMP(1592921920), AcctTerminateCause = 'Stalled-session', ConnectInfo_stop = 'CONNECT 54Mbps 802.11g' WHERE UserName = '347117' AND AcctUniqueId <> '6b521bf17a61aa914f0f67b33c558e07' AND CallingStationId = '48-49-C7-71-79-66' AND AcctStopTime IS NULL (49267) SQL query affected no rows (49267) EXPAND %{sql:UPDATE radacct SET AcctStopTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctUpdateTime = TO_TIMESTAMP(%{integer:Event-Timestamp}), AcctTerminateCause = 'Stalled-session', ConnectInfo_stop = '%{Connect-Info}' WHERE UserName = '%{tolower:%{%{Stripped-User-Name}:-%{User-Name}}}' AND AcctUniqueId <> '%{Acct-Unique-Session-Id}' AND CallingStationId = '%{Calling-Station-Id}' AND AcctStopTime IS NULL} (49267) --> (49267) } # if (&request:Acct-Status-Type == start) = ok (49267) [exec] = noop (49267) attr_filter.accounting_response: EXPAND %{User-Name} (49267) attr_filter.accounting_response: --> 347117 (49267) attr_filter.accounting_response: Matched entry DEFAULT at line 12 (49267) [attr_filter.accounting_response] = updated (49267) } # accounting = updated (49267) Sent Accounting-Response Id 161 from 10.34.242.3:1813 to 10.34.15.221:1386 length 0 (49267) Finished request (49267) Cleaning up request packet ID 161 with timestamp +43054 (49257) Cleaning up request packet ID 151 with timestamp +43054 (49258) Cleaning up request packet ID 152 with timestamp +43054 (49259) Cleaning up request packet ID 153 with timestamp +43054 (49260) Cleaning up request packet ID 154 with timestamp +43054 (49261) Cleaning up request packet ID 155 with timestamp +43054 (49262) Cleaning up request packet ID 156 with timestamp +43054 (49263) Cleaning up request packet ID 157 with timestamp +43054 (49264) Cleaning up request packet ID 158 with timestamp +43054 (49265) Cleaning up request packet ID 159 with timestamp +43054 (49266) Cleaning up request packet ID 160 with timestamp +43054 root@vp2-seg-008:/var/log/freeradius#

I understang... Well, I thought something for these two problems, but before try to implement them, I would like your opinion, if possible: FIRST: for the problem of outer username being different from inner-tunnel. Is it possible do something like this? IF inner-tunnel-username <> outer-username Set outer-username equal to innet-tunnel-username Does this solution can cause crazy inserts at radacct table or cause user to receive deny access to wifi? SECOND: for the problema of mac address being registered at radacct table: I will try to create some check at username for account packets like this: IF username is equal to calling-station-id(in lowercase and without "-") Then set username to (select username from radacct where calling-station-id = 'MAC' and username <> 'wrong mac string' limit 1;) Thanks!! I hope you don’t get angry with me for doing this mass =P -----Mensagem original----- De: Freeradius-Users <freeradius-users-bounces+daniel.pena=mpdft.mp.br@lists.freeradius.org> Em nome de Alan DeKok Enviada em: terça-feira, 23 de junho de 2020 12:47 Para: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Assunto: Re: RES: Incorrect username being registered by freeradius On Jun 23, 2020, at 11:34 AM, Daniel Guimaraes Pena <daniel.pena@mpdft.mp.br> wrote:

Thanks for anwaring, Alan, you were right: that is his MAC Address.

Good.

Until this moment, no mac address appeared at radacct table, so I don’t have debug for that yet. For this, if I may ask, why user is registered in radacct table with mac address but in radius log appears his real username?

Because the NAS sends accounting packets which contain the MAC address in the User-Name field. And, it sends authentication packets which contain the real name in the User-Name field. FreeRADIUS does NOT control this. It's at the mercy of whatever the NAS sends.

Reading debug, real login is "luciana.nogueira" Here the debug log for this entry: =~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.06.23 12:21:07 =~=~=~=~=~=~=~=~=~=~=~= grep -E "\(4925[7-9]\)|\(4926[0-7]\)" debug.log (49257) Received Access-Request Id 151 from 10.34.15.221:1384 to 10.34.242.3:1812 length 151 (49257) User-Name = "347117" (49257) NAS-IP-Address = 10.34.15.221 (49257) NAS-Port = 2 (49257) Called-Station-Id = "5C-D9-98-14-37-48:MPDFT" (49257) Calling-Station-Id = "48-49-C7-71-79-66" (49257) Framed-MTU = 1400 (49257) NAS-Port-Type = Wireless-802.11 (49257) Connect-Info = "CONNECT 54Mbps 802.11g" (49257) EAP-Message = 0x0200000b01333437313137

The end-user machine is creating that EAP-Message. Which contains "34717" as the name. i.e. hex 333437313137 is "34717" In order to fix that, you need to fix the end users machine to send a real name. There is nothing you can do to the NAS or FreeRADIUS to fix this issue. Generally, the outer user name should be something like "@example.com", or "anonymous". The inner-tunnel is receiving the name "luciana.nogueira", which is fine. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

On Jun 23, 2020, at 12:47 PM, Daniel Guimaraes Pena <daniel.pena@mpdft.mp.br> wrote:

Well, I thought something for these two problems, but before try to implement them, I would like your opinion, if possible:

FIRST: for the problem of outer username being different from inner-tunnel. Is it possible do something like this? IF inner-tunnel-username <> outer-username Set outer-username equal to innet-tunnel-username Does this solution can cause crazy inserts at radacct table or cause user to receive deny access to wifi?

It will break things. Instead of working around broken systems, you should just fix the broken systems.

SECOND: for the problema of mac address being registered at radacct table: I will try to create some check at username for account packets like this: IF username is equal to calling-station-id(in lowercase and without "-") Then set username to (select username from radacct where calling-station-id = 'MAC' and username <> 'wrong mac string' limit 1;)

The solution is to just set the User-Name in the Access-Accept reply. The NAS *should* use that in later accounting requests: post-auth { ... update reply { User-Name := &request:User-Name } }

Thanks!! I hope you don’t get angry with me for doing this mass =P

Nope. My frustration is with people who ask question, and argue with the answers. So long as you're trying to understand, I'm happy to help. Alan DeKok.