problem using eap-tls and calling-station-id with postgresql
Bode Benjamin
b.bode at tu-braunschweig.de
Thu Sep 25 14:36:16 CEST 2014
Dear freeradius-users,
we got freeradius working and are using only eap-tls. Now we are
trying to check if the users MAC-Address is the right one.
Each user gets one public IP-Address (via dhcp); to assure that they
don't do mac-spoofing we need this feature.
Right now our problem is, when using eap-tls, the sql module don't
seem to check the calling-station-id in the radcheck-table against the
calling-station-id in the request.
For the user laptop sql return ok, although the calling-station-ip in
the table is gibberish.
When trying the same thing with the user blub (and using a incorrect
MAC) sql returns user notfound (that is what we want) and the request
gets rejected.
So it don't seems to be a problem with our NAS.
Any idea why this is not working with eap-tls?
What have we done wrong?
Best regards, Benjamin
Our tables are:
radcheck
id | username | attribute | op | value
----+---------------+--------------------+----+-------------------
1 | laptop | Auth-Type | := | EAP
2 | RAT | Auth-Type | := | EAP
3 | laptop | Calling-Station-Id | == | aa-bb-cc-dd-ee-ff
4 | blub | Cleartext-Password | := | password
5 | blub | Calling-Station-Id | == | 00-1c-25-9e-33-05
radius=> select * from radgroupreply;
id | groupname | attribute | op | value
----+-----------+--------------------+----+---------------------
1 | test | Framed-Protocol | := | PPP
2 | test | Service-Type | := | Framed-User
3 | test | Framed-Compression | := | Van-Jacobsen-TCP-IP
All users are in the group 'test'.
FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Dec
16 2012 at 13:28:43
Copyright (C) 1999-2009 The FreeRADIUS server project and
contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/soh
including configuration file /etc/freeradius/modules/dynamic_clients
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/replicate
including configuration file /etc/freeradius/modules/logintime
including configuration file
/etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/redis
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/opendirectory
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/unix
including configuration file
/etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/rediswho
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/sql.conf
including configuration file
/etc/freeradius/sql/postgresql/dialup.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file
/etc/freeradius/sites-enabled/inner-tunnel
main {
user = "freerad"
group = "freerad"
allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
name = "freeradius"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/freeradius"
run_dir = "/var/run/freeradius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/freeradius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/freeradius/freeradius.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
require_message_authenticator = yes
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "somesecret"
nastype = "other"
}
client 192.168.0.201 {
require_message_authenticator = no
secret = "somesecret"
login = "operator"
password = "password"
}
client 192.168.0.240 {
require_message_authenticator = no
secret = "somesecret"
login = "operator"
password = "password"
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file
/etc/freeradius/modules/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file
/etc/freeradius/modules/expr
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file
/etc/freeradius/modules/expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file
/etc/freeradius/modules/logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
}
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/radiusd.conf
modules {
Module: Creating Auth-Type = digest
Module: Creating Post-Auth-Type = REJECT
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file
/etc/freeradius/modules/pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file
/etc/freeradius/modules/chap
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file
/etc/freeradius/modules/mschap
mschap {
use_mppe = yes
require_encryption = no
require_strong = no
with_ntdomain_hack = no
allow_retry = yes
}
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file
/etc/freeradius/modules/digest
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file
/etc/freeradius/modules/unix
unix {
radwtmp = "/var/log/freeradius/radwtmp"
}
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file
/etc/freeradius/eap.conf
eap {
default_eap_type = "tls"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
CA_path = "/etc/freeradius/certs"
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/server.key"
certificate_file = "/etc/freeradius/certs/server.pem"
CA_file = "/etc/freeradius/certs/ca.pem"
private_key_password = "secretpw"
dh_file = "/etc/freeradius/certs/dh"
random_file = "/dev/urandom"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/etc/freeradius/certs/bootstrap"
ecdh_curve = "prime256v1"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
}
}
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file
/etc/freeradius/modules/preprocess
preprocess {
huntgroups = "/etc/freeradius/huntgroups"
hints = "/etc/freeradius/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file
/etc/freeradius/modules/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_sql
Module: Instantiating module "sql" from file
/etc/freeradius/sql.conf
sql {
driver = "rlm_sql_postgresql"
server = "localhost"
port = ""
login = "radius"
password = "password"
radius_db = "radius"
read_groups = yes
sqltrace = no
sqltracefile = "/var/log/freeradius/sqltrace.sql"
readclients = no
deletestalesessions = yes
num_sql_socks = 5
lifetime = 0
max_queries = 0
sql_user_name = "%{User-Name}"
default_user_profile = ""
nas_query = "SELECT id, nasname, shortname, type, secret, server FROM
nas"
authorize_check_query = "SELECT id, UserName, Attribute, Value, Op
FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id, UserName, Attribute, Value, Op
FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id"
authorize_group_check_query = "SELECT id, GroupName, Attribute, Value,
op FROM radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY
id"
authorize_group_reply_query = "SELECT id, GroupName, Attribute, Value,
op FROM radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY
id"
accounting_onoff_query = "UPDATE radacct SET AcctStopTime =
('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval),
AcctSessionTime = (EXTRACT(EPOCH FROM ('%S'::timestamp with time zone
- AcctStartTime::timestamp with time zone -
'%{%{Acct-Delay-Time}:-0}'::interval)))::BIGINT, AcctTerminateCause
= '%{Acct-Terminate-Cause}', AcctStopDelay = 0 WHERE AcctStopTime
IS NULL AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <=
'%S'::timestamp"
accounting_update_query = "UPDATE radacct SET FramedIPAddress =
NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime =
'%{Acct-Session-Time}', AcctInputOctets =
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets =
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId =
'%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND
NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL"
accounting_update_query_alt = "INSERT INTO radacct (AcctSessionId,
AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType,
AcctStartTime, AcctSessionTime, AcctAuthentic, AcctInputOctets,
AcctOutputOctets, CalledStationId, CallingStationId, ServiceType,
FramedProtocol, FramedIPAddress, XAscendSessionSvrKey)
VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',
'%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}',
%{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval -
'%{%{Acct-Session-Time}:-0}'::interval), '%{Acct-Session-Time}',
'%{Acct-Authentic}', (('%{%{Acct-Input-Gigawords}:-0}'::bigint <<
32) + '%{%{Acct-Input-Octets}:-0}'::bigint),
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}',
NULLIF('%{Framed-IP-Address}', '')::inet,
'%{X-Ascend-Session-Svr-Key}')"
accounting_start_query = "INSERT INTO radacct (AcctSessionId,
AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId,
NASPortType, AcctStartTime, AcctAuthentic, ConnectInfo_start,
CalledStationId, CallingStationId, ServiceType, FramedProtocol,
FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey)
VALUES('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',
'%{SQL-User-Name}', NULLIF('%{Realm}', ''), '%{NAS-IP-Address}',
%{%{NAS-Port}:-NULL}, '%{NAS-Port-Type}', ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}',
'%{Connect-Info}', '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}',
NULLIF('%{Framed-IP-Address}', '')::inet, 0,
'%{X-Ascend-Session-Svr-Key}')"
accounting_start_query_alt = "UPDATE radacct SET AcctStartTime =
('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval),
AcctStartDelay = 0, ConnectInfo_start = '%{Connect-Info}' WHERE
AcctSessionId = '%{Acct-Session-Id}' AND UserName =
'%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND
AcctStopTime IS NULL"
accounting_stop_query = "UPDATE radacct SET AcctStopTime =
('%S'::timestamp - '%{%{Acct-Delay-Time}:-0}'::interval),
AcctSessionTime = CASE WHEN '%{Acct-Session-Time}' = '' THEN
(EXTRACT(EPOCH FROM ('%S'::TIMESTAMP WITH TIME ZONE -
AcctStartTime::TIMESTAMP WITH TIME ZONE -
'%{%{Acct-Delay-Time}:-0}'::INTERVAL)))::BIGINT ELSE
NULLIF('%{Acct-Session-Time}','')::BIGINT END, AcctInputOctets =
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets =
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint), AcctTerminateCause =
'%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress =
NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop =
'%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND
UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'
AND AcctStopTime IS NULL"
accounting_stop_query_alt = "INSERT INTO radacct (AcctSessionId,
AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType,
AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic,
ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId,
CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol,
FramedIPAddress, AcctStopDelay) values('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}', '%{SQL-User-Name}',
NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL},
'%{NAS-Port-Type}', ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval -
'%{%{Acct-Session-Time}:-0}'::interval), ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval), NULLIF('%{Acct-Session-Time}',
'')::bigint, '%{Acct-Authentic}', '%{Connect-Info}',
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint),
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint), '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Acct-Terminate-Cause}',
'%{Service-Type}', '%{Framed-Protocol}',
NULLIF('%{Framed-IP-Address}', '')::inet, 0)"
group_membership_query = "SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority"
connect_failure_retry_delay = 60
simul_count_query = ""
simul_verify_query = ""
postauth_query = "INSERT INTO radpostauth (username, pass, reply,
authdate) VALUES ('%{User-Name}',
'%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW())"
safe-characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/"
}
rlm_sql (sql): Driver rlm_sql_postgresql (module rlm_sql_postgresql)
loaded and linked
rlm_sql (sql): Attempting to connect to radius at localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_postgresql #4
rlm_sql (sql): Connected new DB handle, #4
Module: Checking preacct {...} for more modules to load
Module: Linked to module rlm_acct_unique
Module: Instantiating module "acct_unique" from file
/etc/freeradius/modules/acct_unique
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address,
NAS-Port"
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file
/etc/freeradius/modules/files
files {
usersfile = "/etc/freeradius/users"
acctusersfile = "/etc/freeradius/acct_users"
preproxy_usersfile = "/etc/freeradius/preproxy_users"
compat = "no"
}
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file
/etc/freeradius/modules/detail
detail {
detailfile =
"/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file
/etc/freeradius/modules/radutmp
radutmp {
filename = "/var/log/freeradius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.accounting_response" from
file /etc/freeradius/modules/attr_filter
attr_filter attr_filter.accounting_response {
attrsfile = "/etc/freeradius/attrs.accounting_response"
key = "%{User-Name}"
relaxed = no
}
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Instantiating module "attr_filter.access_reject" from file
/etc/freeradius/modules/attr_filter
attr_filter attr_filter.access_reject {
attrsfile = "/etc/freeradius/attrs.access_reject"
key = "%{User-Name}"
relaxed = no
}
} # modules
} # server
server inner-tunnel { # from file
/etc/freeradius/sites-enabled/inner-tunnel
modules {
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
... adding new socket proxy address * port 36698
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server
inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=35, length=209
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
EAP-Message = 0x02010012017369656c6e65746c6170746f70
Message-Authenticator = 0x0f86b899b3c80565b75a145e2e24cf1a
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 18
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 4
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 4
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.
Authentication may fail because of this.
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Requiring client certificate
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 35 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
EAP-Message = 0x010200060d20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x07b3109207b11d36b09a0ff2df4e9786
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=36, length=440
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x07b3109207b11d36b09a0ff2df4e9786
EAP-Message =
0x020200e70d0016030100dc010000d8030154240358e334928ae57349df5318f66758b4456a181c619a24a453bd387de2c8000066c014c00ac022c0210039003800880087c00fc00500350084c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032009a009900450044c00ec004002f00960041c011c007c00cc002000500040015001200090014001100080006000300ff01000049000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f0010001100230000000f000101
Message-Authenticator = 0xdeb315aa8319160ad3e0a8f45abcd622
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 231
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 3
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] eaptls_verify returned 7
[tls] Done initial handshake
[tls] (other): before/accept initialization
[tls] TLS_accept: before/accept initialization
[tls] <<< TLS 1.0 Handshake [length 00dc], ClientHello
[tls] TLS_accept: SSLv3 read client hello A
[tls] >>> TLS 1.0 Handshake [length 003e], ServerHello
[tls] TLS_accept: SSLv3 write server hello A
[tls] >>> TLS 1.0 Handshake [length 084e], Certificate
[tls] TLS_accept: SSLv3 write certificate A
[tls] >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange
[tls] TLS_accept: SSLv3 write key exchange A
[tls] >>> TLS 1.0 Handshake [length 00a2], CertificateRequest
[tls] TLS_accept: SSLv3 write certificate request A
[tls] TLS_accept: SSLv3 flush data
[tls] TLS_accept: Need to read more data: SSLv3 read client
certificate A
In SSL Handshake Phase
In SSL Accept mode
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 36 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
EAP-Message =
0x010304000dc000000a8d160301003e0200003a03015424014593826c5e6a348da5db149e49c19028c000c97ef787bd5f6c99dcb0ff00c014000012ff01000100000b000403000102000f000101160301084e0b00084a0008470003a23082039e30820286a003020102020101300d06092a864886f70d010104050030818f310b3009060355040613024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b3019060355040314126672
EAP-Message =
0x6565726164697573407369656c6e6574301e170d3134303630333231303935375a170d3135303532393231303935375a307c310b3009060355040613024445311630140603550408130d4e69656465727361636873656e31153013060355040a130c5369656c4e657420652e562e311b30190603550403141266726565726164697573407369656c6e65743121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e646530820122300d06092a864886f70d01010105000382010f003082010a0282010100c9762cddafffc5c07cbda4837818a0bf2d8991d7d60ced34959b52919406ceea0976fcc3f93f827c18f21409e39d
EAP-Message =
0x1f61fd0e3974c1244992c239ef5dc89a0068c6f0d94179bb344c764112b61cc7af3052ca44c271b2a51953897534bb08df8730f1cfeab65a80ce4d0d44ebbd5f9f8edb38a1aeb8239247889496fd44d88dcdf43d9bc690b5ef8c6d07c676de4f9884749c18d3678a6a0614cc14595c24da3080aa1fcff2a6e3b03a2653126519ffe87906b21d677c0bb8bbe7b8942d69f6f3579dfe6f38139035cc5f3cc0a770e6b6047ccb935f0d430b29f2bee21c488c4e16715383a2e44edf7487eccb3b275981329d3b61af17517803069718ec4e05d10203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104
EAP-Message =
0x050003820101005e31c1a5b1f0d98c53d27298feb3f2b205619f90eef1308b0da9d6de97e2595208ce64b3f0e70ba8a2679503e4c69634d704790107cd53e74ebde931b8bb378910f43c53e83fabe0b27e7cd8722029bb08d332fca5d78e80a5ca81537e882f3aa8af83c22476b35d0586793ae5cdbb787b5e47ec0457ca3ba9ac3b07c7d76c5585779e91428e30c3854f32565106fa01c36ad30febd8fb1fa9cdad0e18ab4a80c68ef295acb4debf1bc1badce44319b73686a608ecf8bfdcdc39ef672c7dd52b158896b2d82308301504cc1c691da03ca4b3b606a68765c28efb82de68bee26a12fba4d541df29d84a6b03407eb659e822cabfccc051
EAP-Message = 0x84987d4416bac3ce663a0004
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x07b3109206b01d36b09a0ff2df4e9786
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=37, length=215
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x07b3109206b01d36b09a0ff2df4e9786
EAP-Message = 0x020300060d00
Message-Authenticator = 0x6637ee5e9340fa991ee9045e8fffb4ef
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 2
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] Received TLS ACK
[tls] ACK handshake fragment handler
[tls] eaptls_verify returned 1
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 37 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
EAP-Message =
0x010404000dc000000a8d9f3082049b30820383a00302010202090097606b3e1c8bf851300d06092a864886f70d010105050030818f310b3009060355040613024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b30190603550403141266726565726164697573407369656c6e6574301e170d3134303630333231303935375a170d3135303532393231303935375a30818f310b3009060355040613024445311630140603550408
EAP-Message =
0x130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b30190603550403141266726565726164697573407369656c6e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4e297c9714cfe6bda4dd3f3ea9f8f1d21e785bd6132b34a478366072b781909f7ac55f59e8a8d5fd79a9a5976b4e3066155a08e2d4627d8ea52833403ee9381470ae165bdc2e2cdd65405535c9a33d81c15c31a1f116e5a925e419e667dc7ab9edac0
EAP-Message =
0xfbc3edcc9413c0dd44c20058a463e12483304115a189cef5f4c1a9e39b79b9d4c9bd074be68fd5664d1b781561c30624136f0c1df37e56b976ead0ec00337e7fda306d434dce07c828dcbd4596f6c124764a39516f604aed5f967d452f1968b8c20e8e350241fe94f806a708ef08a00d52b966510b67a3ea1f1c86687b35b51eb70920eac263a23bcbdf7e3eabe4b51e7ff10431894e17c25c6b7874d30203010001a381f73081f4301d0603551d0e041604142f967e3138107f1b9738d2539cebe632c35045513081c40603551d230481bc3081b980142f967e3138107f1b9738d2539cebe632c3504551a18195a4819230818f310b30090603550406
EAP-Message =
0x13024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b30190603550403141266726565726164697573407369656c6e657482090097606b3e1c8bf851300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010031f4ac37eb4125a30827d22da0b7def59b77619ac322e4a518525f2292057853442634b46b7cb5f69b7944aa3eec90243ee2de1453bb7a2c7ab8fdd02880a21eb2097a382247ace38b95
EAP-Message = 0x2d89e524a87882e45098e69c
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x07b3109205b71d36b09a0ff2df4e9786
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=38, length=215
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x07b3109205b71d36b09a0ff2df4e9786
EAP-Message = 0x020400060d00
Message-Authenticator = 0x67716a43b571a9813560079942dae9a7
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 1
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] Received TLS ACK
[tls] ACK handshake fragment handler
[tls] eaptls_verify returned 1
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 38 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
EAP-Message =
0x010502ab0d8000000a8d84121a48832ada64b740ceef48eb4f332e09d19fb4ac04376640c55242f655e13dc49bab876726a782cff2f8a3798415dbb2a427f070fa74de2cfb40b9b7b471df1301e61f188eae20ee1ba40d7768aead0d5343babad7217ed6abee27f1375f8f39651d6c4ff59953e1e1e0f30e705774d614e899e11f31ef7bda6e0a0bf1ae3659419ae9e6ee85024f257f577784e7de07537011f4be32f60559f09634ca3a9b8632a3e73e418d1a2b160301014b0c0001470300174104cc5a9a6ee2d2054a33392efd26743a913855ebc9dd2d92da44b3cee59db08692238af5dd9fb12e46f3928a1822b2c87c0397b0696c0fef3bc92707
EAP-Message =
0xdd4b8485ff01009971ac1185d37527b0e896c6bf25736c0e63ebc42194117bb39afafef61020374abe689e940e31c3159e5e999381b12a2894669e404a73680289034e3ef9c8f74114836670a1eafc18a20575c293ff85cd77de629e8660a1abfc51ecafb0f18420c99300d4035968b4c8e3aa00f35267598e3aa0844799779f9b83b9e3df5ad62afa39ece6328fc743de37124bd988cfe02dd6b0c85af8d9101a2261efffa70726e343bf697cff77720dae455edba0726538b3fb65785598402d5946c11b8fad4cc875f0c81e663a1f77ff7ccf707162ea7dfefb8a6640af8ce67b5d528c9daed9e22e57d05f62dcfbfa8f452df8df9c8ce13c35b9d7
EAP-Message =
0x646b3c835635f1342d3516030100a20d00009a030102400094009230818f310b3009060355040613024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b30190603550403141266726565726164697573407369656c6e65740e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x07b3109204b61d36b09a0ff2df4e9786
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=39, length=1529
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x07b3109204b61d36b09a0ff2df4e9786
EAP-Message =
0x0205051e0dc0000009e616030108500b00084c0008490003a4308203a030820288a003020102020102300d06092a864886f70d010104050030818f310b3009060355040613024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b30190603550403141266726565726164697573407369656c6e6574301e170d3134303630353131343433355a170d3135303533313131343433355a307e310b300906035504061302444531163014
EAP-Message =
0x0603550408130d4e69656465727361636873656e31153013060355040a130c5369656c4e657420652e562e311630140603550403130d7369656c6e65746c6170746f703128302606092a864886f70d01090116197369656c6e65746c6170746f70406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c374bf92dc4db1db05191cde2aa1691c8184980fe05d0548b97c99777dcc808390d457f457e7c7e1af9616fad75875acfb5a8780a6a11e5ed65f5945c25354d9cd1d34411849d116e6366e3d1c657a0b1b579fd24f3b889662383611d038d36aba04373367c3be29870f24767fe4f3
EAP-Message =
0xd227fcedaff18e1776eadcfbc7aa78a0805cda6977658e875a2252cda92256ef0a6daec53526a9dc5851cf397acdaec2371c81b5ad164c704a5ff84fb811fb76b5cf8bdece9977bcf74cf346d9fa9cb1050dd91096f188866b00eb91616e023596eb1e5caa4586c0e5ac79ebc81d87892e013deef5c5fb2cb33bff9c38147e7b60889433e7d99588bb25ac8abd9698959b0203010001a317301530130603551d25040c300a06082b06010505070302300d06092a864886f70d010104050003820101007ebb20e618f114a6f3c211afed8fae934b636cb44abdf36d9ffd07d6fe871c30680257fedad1732b8a503aedc43f97cd6c951f302e8c916a9fbe
EAP-Message =
0x1c20b2750f1ff190a82cde9cae29e591c8da44c06fcfae3adfad3d84c02c1b50a032dc7962f5a8a544d0a7f61abc4d71f36a3b00c0f44ecb97ffcd95a9adb582b38c47ac1f74db023d25a3a6f863a81855888272b11c4cc305e29ea94f5ea35b83ee603b2e676023938e1273ad15b0249d73f12962dc4f4f83748c07ae07fdac8fec9e062785b86c77f62c35025bd60c023a9c94ec00bd7edf56979d249f431aaf564b23ebbe6cabcdd70b2d76c5515e96e694824cee61d7d92d980c8b518cecdb91f38ee50400049f3082049b30820383a00302010202090097606b3e1c8bf851300d06092a864886f70d010105050030818f310b3009060355040613
EAP-Message =
0x024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e65742e6465311b30190603550403141266726565726164697573407369656c6e6574301e170d3134303630333231303935375a170d3135303532393231303935375a30818f310b3009060355040613024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f0609
EAP-Message =
0x2a864886f70d0109011612737570706f7274407369656c6e65742e6465311b3019060355040314126672656572
Message-Authenticator = 0x37432280ddfc4e86dfffca14d5579f46
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 253
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 0
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 0
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
TLS Length 2534
[tls] Received EAP-TLS First Fragment of the message
[tls] eaptls_verify returned 9
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 39 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
EAP-Message = 0x010600060d00
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x07b3109203b51d36b09a0ff2df4e9786
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=40, length=1457
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x07b3109203b51d36b09a0ff2df4e9786
EAP-Message =
0x020604d80d006164697573407369656c6e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100a4e297c9714cfe6bda4dd3f3ea9f8f1d21e785bd6132b34a478366072b781909f7ac55f59e8a8d5fd79a9a5976b4e3066155a08e2d4627d8ea52833403ee9381470ae165bdc2e2cdd65405535c9a33d81c15c31a1f116e5a925e419e667dc7ab9edac0fbc3edcc9413c0dd44c20058a463e12483304115a189cef5f4c1a9e39b79b9d4c9bd074be68fd5664d1b781561c30624136f0c1df37e56b976ead0ec00337e7fda306d434dce07c828dcbd4596f6c124764a39516f604aed5f967d452f1968b8c20e8e350241
EAP-Message =
0xfe94f806a708ef08a00d52b966510b67a3ea1f1c86687b35b51eb70920eac263a23bcbdf7e3eabe4b51e7ff10431894e17c25c6b7874d30203010001a381f73081f4301d0603551d0e041604142f967e3138107f1b9738d2539cebe632c35045513081c40603551d230481bc3081b980142f967e3138107f1b9738d2539cebe632c3504551a18195a4819230818f310b3009060355040613024445311630140603550408130d4e69656465727361636873656e3111300f060355040713084272756e7376696731153013060355040a130c5369656c4e657420652e562e3121301f06092a864886f70d0109011612737570706f7274407369656c6e6574
EAP-Message =
0x2e6465311b30190603550403141266726565726164697573407369656c6e657482090097606b3e1c8bf851300c0603551d13040530030101ff300d06092a864886f70d0101050500038201010031f4ac37eb4125a30827d22da0b7def59b77619ac322e4a518525f2292057853442634b46b7cb5f69b7944aa3eec90243ee2de1453bb7a2c7ab8fdd02880a21eb2097a382247ace38b952d89e524a87882e45098e69c84121a48832ada64b740ceef48eb4f332e09d19fb4ac04376640c55242f655e13dc49bab876726a782cff2f8a3798415dbb2a427f070fa74de2cfb40b9b7b471df1301e61f188eae20ee1ba40d7768aead0d5343babad7217ed6
EAP-Message =
0xabee27f1375f8f39651d6c4ff59953e1e1e0f30e705774d614e899e11f31ef7bda6e0a0bf1ae3659419ae9e6ee85024f257f577784e7de07537011f4be32f60559f09634ca3a9b8632a3e73e418d1a2b160301004610000042410458338c8f6ed148bd88111afe2fce8e96c8810dc3853b0725e9c07207bfce9282138d5dd8805b243a0c333d0061f9a15ab8e6b3be248f07cb3438826253079a8e16030101060f000102010006b65fd648dfbf608fb6d55ccb4b5bdf02d7ddc26a2a37d304c0fb1a9a02f31931f3190259a5066bbcabd8c20dc9a63d86a48a9cf5855f24a743070b1eeb1e7a61db43ec3e74a50bf6c06e96119ac524e3e1fe12b10200
EAP-Message =
0xa4323f26bf5088cb5b0bd9fe3ac41737e14c748d81b70f1493f35b59c4227ebae48a9ee9f4d133980dbebb66b454c0d5dbf73b6555e2ef6cb5835b894e8102307c2323176e0382a78bb6bb01c7ea88148b22f8e190f8c1d588c90405af7a9457c777986addd30438de612c9ab2d53cf4043f225f8bec7eb348e46d7ef615540c619d1a208de221f493bdb9ee5600e473d8ef652fed27be896fdbbcde1629a4970b61fce18458a305111403010001011603010030dd6ddbede57e7b1c9abcca921bd85e522c673a43539cc2c782bd7a52dcc4b2559dd21e5af0653b8eb7df85eae00557ad
Message-Authenticator = 0xfe25690b8aebdd6f45be8b812b12775b
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 253
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 4
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 4
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] eaptls_verify returned 7
[tls] Done initial handshake
[tls] <<< TLS 1.0 Handshake [length 0850], Certificate
[tls] chain-depth=1,
[tls] error=0
[tls] --> User-Name = laptop
[tls] --> BUF-Name = freeradius at sielnet
[tls] --> subject = /C=DE/ST=Niedersachsen/L=Brunsvig/O=SielNet
e.V./emailAddress=support at sielnet.de/CN=freeradius at sielnet
[tls] --> issuer = /C=DE/ST=Niedersachsen/L=Brunsvig/O=SielNet
e.V./emailAddress=support at sielnet.de/CN=freeradius at sielnet
[tls] --> verify return:1
[tls] chain-depth=0,
[tls] error=0
[tls] --> User-Name = laptop
[tls] --> BUF-Name = laptop
[tls] --> subject = /C=DE/ST=Niedersachsen/O=SielNet
e.V./CN=laptop/emailAddress=laptop at example.com
[tls] --> issuer = /C=DE/ST=Niedersachsen/L=Brunsvig/O=SielNet
e.V./emailAddress=support at sielnet.de/CN=freeradius at sielnet
[tls] --> verify return:1
[tls] TLS_accept: SSLv3 read client certificate A
[tls] <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange
[tls] TLS_accept: SSLv3 read client key exchange A
[tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify
[tls] TLS_accept: SSLv3 read certificate verify A
[tls] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[tls] <<< TLS 1.0 Handshake [length 0010], Finished
[tls] TLS_accept: SSLv3 read finished A
[tls] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[tls] TLS_accept: SSLv3 write change cipher spec A
[tls] >>> TLS 1.0 Handshake [length 0010], Finished
[tls] TLS_accept: SSLv3 write finished A
[tls] TLS_accept: SSLv3 flush data
[tls] (other): SSL negotiation finished successfully
SSL Connection Established
[tls] eaptls_process returned 13
++[eap] returns handled
Sending Access-Challenge of id 40 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
EAP-Message =
0x010700450d800000003b1403010001011603010030df5e27c36aacfb68feb2beb793bf67e6e9e2fd751c9d56352aa0b4ff37cde26aa321a29631f1791ec6885f516199fe2d
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x07b3109202b41d36b09a0ff2df4e9786
Finished request 5.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 192.168.0.201 port 1024,
id=41, length=215
Framed-MTU = 1480
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
User-Name = "laptop"
Service-Type = Framed-User
Framed-Protocol = PPP
NAS-Port = 2
NAS-Port-Type = Ethernet
NAS-Port-Id = "2"
Called-Station-Id = "00-1b-3f-33-26-40"
Calling-Station-Id = "00-1c-25-9e-33-05"
Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"
Tunnel-Type:0 = VLAN
Tunnel-Medium-Type:0 = IEEE-802
Tunnel-Private-Group-Id:0 = "1"
State = 0x07b3109202b41d36b09a0ff2df4e9786
EAP-Message = 0x020700060d00
Message-Authenticator = 0xa8ca96dceba238a2bc333ced9c87b158
# Executing section authorize from file
/etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
rlm_sql (sql): Reserving sql socket id: 3
[sql] expand: SELECT id, UserName, Attribute, Value, Op FROM
radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT
id, UserName, Attribute, Value, Op FROM radcheck WHERE Username =
'laptop' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 2 , fields = 5
[sql] expand: SELECT GroupName FROM radusergroup WHERE
UserName='%{SQL-User-Name}' ORDER BY priority -> SELECT GroupName FROM
radusergroup WHERE UserName='laptop' ORDER BY priority
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 1 , fields = 1
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupcheck WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 0 , fields = 5
[sql] User found in group test
[sql] expand: SELECT id, GroupName, Attribute, Value, op FROM
radgroupreply WHERE GroupName = '%{Sql-Group}' ORDER BY id ->
SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE
GroupName = 'test' ORDER BY id
rlm_sql_postgresql: Status: PGRES_TUPLES_OK
rlm_sql_postgresql: query affected rows = 3 , fields = 5
rlm_sql (sql): Released sql socket id: 3
++[sql] returns ok
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/tls
[eap] processing type tls
[tls] Authenticate
[tls] processing EAP-TLS
[tls] Received TLS ACK
[tls] ACK handshake is finished
[tls] eaptls_verify returned 3
[tls] eaptls_process returned 3
[tls] Adding user data to cached session
[eap] Freeing handler
++[eap] returns ok
# Executing section post-auth from file
/etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 41 to 192.168.0.201 port 1024
Framed-Protocol := PPP
Service-Type := Framed-User
Framed-Compression := Van-Jacobson-TCP-IP
MS-MPPE-Recv-Key =
0x95cb3bc08bbc313b973d2ff15bc144a70044889a430a974d04c3fc86b45f87e0
MS-MPPE-Send-Key =
0x155a60ec14c5bc8b6761a39b0edc9c029f95d039179095e2aa695dd8615fd345
EAP-Message = 0x03070004
Message-Authenticator = 0x00000000000000000000000000000000
User-Name = "laptop"
Finished request 6.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 0 ID 35 with timestamp +7
Cleaning up request 1 ID 36 with timestamp +7
Cleaning up request 2 ID 37 with timestamp +7
Cleaning up request 3 ID 38 with timestamp +7
Cleaning up request 4 ID 39 with timestamp +7
Cleaning up request 5 ID 40 with timestamp +7
Cleaning up request 6 ID 41 with timestamp +7
Ready to process requests.
rad_recv: Accounting-Request packet from host 192.168.0.201 port 1025,
id=42, length=115
Acct-Session-Id = "006A00000004"
Acct-Status-Type = Start
Service-Type = Framed-User
Acct-Authentic = RADIUS
NAS-Port = 2
Calling-Station-Id = "00-1C-25-9E-33-05"
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
Framed-IP-Address = 192.168.0.12
User-Name = "laptop"
Acct-Delay-Time = 0
# Executing section preacct from file
/etc/freeradius/sites-enabled/default
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address =
192.168.0.201,NAS-IP-Address = 192.168.0.201,Acct-Session-Id =
"006A00000004",User-Name = "laptop"'
[acct_unique] Acct-Unique-Session-ID = "0cae66a72b0dac43".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
# Executing section accounting from file
/etc/freeradius/sites-enabled/default
+- entering group accounting {...}
[detail] expand: %{Packet-Src-IP-Address} -> 192.168.0.201
[detail] expand:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
-> /var/log/freeradius/radacct/192.168.0.201/detail-20140925
[detail]
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.0.201/detail-20140925
[detail] expand: %t -> Thu Sep 25 13:50:10 2014
++[detail] returns ok
++[unix] returns ok
[radutmp] expand: /var/log/freeradius/radutmp ->
/var/log/freeradius/radutmp
[radutmp] expand: %{User-Name} -> laptop
++[radutmp] returns ok
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
[sql] expand: %{NAS-Port} -> 2
[sql] expand: %{Acct-Delay-Time} -> 0
[sql] expand: INSERT INTO radacct (AcctSessionId, AcctUniqueId,
UserName, Realm, NASIPAddress, NASPortId, NASPortType,
AcctStartTime, AcctAuthentic, ConnectInfo_start, CalledStationId,
CallingStationId, ServiceType, FramedProtocol, FramedIPAddress,
AcctStartDelay, XAscendSessionSvrKey) VALUES('%{Acct-Session-Id}',
'%{Acct-Unique-Session-Id}', '%{SQL-User-Name}',
NULLIF('%{Realm}', ''), '%{NAS-IP-Address}', %{%{NAS-Port}:-NULL},
'%{NAS-Port-Type}', ('%S'::timestamp -
'%{%{Acct-Delay-Time}:-0}'::interval), '%{Acct-Authentic}',
'%{Connect-Info}', '%{Called-Station-Id}',
'%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}',
NULLIF('%{Framed-IP-Address}', '')::inet, 0,
'%{X-Ascend-Session-Svr-Key}') -> INSERT INTO radacct
(AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress,
NASPortId, NASPortType, AcctStartTime, AcctAuthentic,
ConnectInfo_start, CalledStationId, CallingStationId, ServiceType,
FramedProtocol, FramedIPAddress, AcctStartDelay,
rlm_sql (sql): Reserving sql socket id: 2
rlm_sql_postgresql: Status: PGRES_COMMAND_OK
rlm_sql_postgresql: query affected rows = 1
rlm_sql (sql): Released sql socket id: 2
++[sql] returns ok
++[exec] returns noop
[attr_filter.accounting_response] expand: %{User-Name} -> laptop
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated
Sending Accounting-Response of id 42 to 192.168.0.201 port 1025
Finished request 7.
Cleaning up request 7 ID 42 with timestamp +52
Going to the next request
Ready to process requests.
rad_recv: Accounting-Request packet from host 192.168.0.201 port 1025,
id=43, length=145
Acct-Session-Id = "006A00000004"
Acct-Status-Type = Interim-Update
Service-Type = Framed-User
Acct-Authentic = RADIUS
NAS-Port = 2
Calling-Station-Id = "00-1C-25-9E-33-05"
NAS-IP-Address = 192.168.0.201
NAS-Identifier = "sw2"
Framed-IP-Address = 192.168.0.12
User-Name = "laptop"
Acct-Session-Time = 105
Acct-Input-Octets = 12900
Acct-Output-Octets = 4756
Acct-Input-Packets = 60
Acct-Output-Packets = 18
Acct-Delay-Time = 0
# Executing section preacct from file
/etc/freeradius/sites-enabled/default
+- entering group preacct {...}
++[preprocess] returns ok
[acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address =
192.168.0.201,NAS-IP-Address = 192.168.0.201,Acct-Session-Id =
"006A00000004",User-Name = "laptop"'
[acct_unique] Acct-Unique-Session-ID = "0cae66a72b0dac43".
++[acct_unique] returns ok
[suffix] No '@' in User-Name = "laptop", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[files] returns noop
# Executing section accounting from file
/etc/freeradius/sites-enabled/default
+- entering group accounting {...}
[detail] expand: %{Packet-Src-IP-Address} -> 192.168.0.201
[detail] expand:
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
-> /var/log/freeradius/radacct/192.168.0.201/detail-20140925
[detail]
/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
expands to /var/log/freeradius/radacct/192.168.0.201/detail-20140925
[detail] expand: %t -> Thu Sep 25 13:51:10 2014
++[detail] returns ok
++[unix] returns noop
[radutmp] expand: /var/log/freeradius/radutmp ->
/var/log/freeradius/radutmp
[radutmp] expand: %{User-Name} -> laptop
++[radutmp] returns ok
[sql] expand: %{User-Name} -> laptop
[sql] sql_set_user escaped user --> 'laptop'
[sql] expand: %{Acct-Input-Gigawords} ->
[sql] ... expanding second conditional
[sql] expand: %{Acct-Input-Octets} -> 12900
[sql] expand: %{Acct-Output-Gigawords} ->
[sql] ... expanding second conditional
[sql] expand: %{Acct-Output-Octets} -> 4756
[sql] expand: UPDATE radacct SET FramedIPAddress =
NULLIF('%{Framed-IP-Address}', '')::inet, AcctSessionTime =
'%{Acct-Session-Time}', AcctInputOctets =
(('%{%{Acct-Input-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Input-Octets}:-0}'::bigint), AcctOutputOctets =
(('%{%{Acct-Output-Gigawords}:-0}'::bigint << 32) +
'%{%{Acct-Output-Octets}:-0}'::bigint) WHERE AcctSessionId =
'%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND
NASIPAddress= '%{NAS-IP-Address}' AND AcctStopTime IS NULL -> UPDATE
radacct SET FramedIPAddress = NULLIF('192.168.0.12', '')::inet,
AcctSessionTime = '105', AcctInputOctets = (('0'::bigint << 32) +
'12900'::bigint), AcctOutputOctets = (('0'::bigint << 32) +
'4756'::bigint) WHERE AcctSessionId = '006A00000004' AND UserName =
'laptop' AND NASIPAddress= '192.168.0.201' AND AcctStopTime IS NULL
rlm_sql (sql): Reserving sql socket id: 1
rlm_sql_postgresql: Status: PGRES_COMMAND_OK
rlm_sql_postgresql: query affected rows = 1
rlm_sql (sql): Released sql socket id: 1
++[sql] returns ok
++[exec] returns noop
[attr_filter.accounting_response] expand: %{User-Name} -> laptop
attr_filter: Matched entry DEFAULT at line 12
++[attr_filter.accounting_response] returns updated
Sending Accounting-Response of id 43 to 192.168.0.201 port 1025
Finished request 8.
Cleaning up request 8 ID 43 with timestamp +112
Going to the next request
Ready to process requests.
More information about the Freeradius-Users
mailing list