WPA2 enterprise and NAS-Identifier

Lorenzo Milesi maxxer at ufficyo.com
Wed Sep 23 16:08:59 CEST 2015


hi.
I'm trying to setup WPA2 authentication, and I mostly succeded, I can authenticate users which are in MySQL on FR2.
What I am missing is the ability to restrict some users access using the NAS-Identifier attribute.

>From what I could see the request (made from a DDWRT AP) doesn't include that attribute, so when it comes to radius it rejects the access because of that. 

Is it somehow possible to update the request (like it can be done for dynamic clients) and add the attribute there? 

thanks


I'm attaching here a sample debug failed login session
freeradius: FreeRADIUS Version 2.2.6, for host x86_64-pc-linux-gnu, built on Feb 12 2015 at 12:10:02
Copyright (C) 1999-2013 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/dhcp_sqlippool
including configuration file /etc/freeradius/sql/mysql/ippool-dhcp.conf
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/radrelay
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/opendirectory
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/replicate
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/rediswho
including configuration file /etc/freeradius/modules/dynamic_clients
including configuration file /etc/freeradius/modules/cache
including configuration file /etc/freeradius/modules/raw
including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/redis
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/soh
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/sql.conf
including configuration file /etc/freeradius/sql/mysql/dialup.conf
including configuration file /etc/freeradius/sql/mysql/counter.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/control-socket
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/status
including configuration file /etc/freeradius/sites-enabled/inav-dynclients
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
	user = "freerad"
	group = "freerad"
	allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
	name = "freeradius"
	prefix = "/usr"
	localstatedir = "/var"
	sbindir = "/usr/sbin"
	logdir = "/var/log/freeradius"
	run_dir = "/var/run/freeradius"
	libdir = "/usr/lib/freeradius"
	radacctdir = "/var/log/freeradius/radacct"
	hostname_lookups = no
	max_request_time = 30
	cleanup_delay = 5
	max_requests = 1024
	pidfile = "/var/run/freeradius/freeradius.pid"
	checkrad = "/usr/sbin/checkrad"
	debug_level = 0
	proxy_requests = yes
 log {
 	stripped_names = no
 	auth = no
 	auth_badpass = no
 	auth_goodpass = no
 }
 security {
 	max_attributes = 200
 	reject_delay = 1
 	status_server = yes
 	allow_vulnerable_openssl = no
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
 	retry_delay = 5
 	retry_count = 3
 	default_fallback = no
 	dead_time = 120
 	wake_all_if_all_dead = no
 }
 home_server localhost {
 	ipaddr = 127.0.0.1
 	port = 1812
 	type = "auth"
 	secret = "testing123"
 	response_window = 20
 	max_outstanding = 65536
 	require_message_authenticator = yes
 	zombie_period = 40
 	status_check = "status-server"
 	ping_interval = 30
 	check_interval = 30
 	num_answers_to_alive = 3
 	num_pings_to_alive = 3
 	revive_interval = 120
 	status_check_timeout = 4
  coa {
  	irt = 2
  	mrt = 16
  	mrc = 5
  	mrd = 30
  }
 }
 home_server_pool my_auth_failover {
	type = fail-over
	home_server = localhost
 }
 realm example.com {
	auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
 realm NULL {
	authhost = LOCAL
	accthost = LOCAL
 }
radiusd: #### Loading Clients ####
 client localhost {
 	ipaddr = 127.0.0.1
 	require_message_authenticator = no
 	secret = "secret"
 	shortname = "localhost"
 	nastype = "other"
 }
 client dymamic {
 	ipaddr = 0.0.0.0
 	netmask = 0
 	require_message_authenticator = no
 	dynamic_clients = "dynamic_client_server"
 	lifetime = 12600
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /etc/freeradius/modules/exec
  exec {
  	wait = yes
  	input_pairs = "request"
  	shell_escape = yes
  	timeout = 10
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /etc/freeradius/modules/expr
 Module: Linked to module rlm_expiration
 Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration
  expiration {
  	reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime
  logintime {
  	reply-message = "You are calling outside your allowed timespan  "
  	minimum-timeout = 60
  }
 Module: Linked to module rlm_raw
 Module: Instantiating module "raw" from file /etc/freeradius/modules/raw
 }
radiusd: #### Loading Virtual Servers ####
server { # from file 
 modules {
  Module: Creating Auth-Type = digest
  Module: Creating Post-Auth-Type = REJECT
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating module "pap" from file /etc/freeradius/modules/pap
  pap {
  	encryption_scheme = "auto"
  	auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /etc/freeradius/modules/chap
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap
  mschap {
  	use_mppe = yes
  	require_encryption = yes
  	require_strong = yes
  	with_ntdomain_hack = no
  	allow_retry = yes
  }
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /etc/freeradius/modules/digest
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /etc/freeradius/modules/unix
  unix {
  	radwtmp = "/var/log/freeradius/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /etc/freeradius/eap.conf
  eap {
  	default_eap_type = "peap"
  	timer_expire = 60
  	ignore_unknown_eap_types = no
  	cisco_accounting_username_bug = no
  	max_sessions = 4096
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
   	challenge = "Password: "
   	auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
   	rsa_key_exchange = no
   	dh_key_exchange = yes
   	rsa_key_length = 512
   	dh_key_length = 512
   	verify_depth = 0
   	CA_path = "/etc/freeradius/certs"
   	pem_file_type = yes
   	private_key_file = "/etc/freeradius/certs/server.pem"
   	certificate_file = "/etc/freeradius/certs/server.pem"
   	CA_file = "/etc/freeradius/certs/ca.pem"
   	private_key_password = "key_pwd"
   	dh_file = "/etc/freeradius/certs/dh"
   	fragment_size = 1024
   	include_length = yes
   	check_crl = no
   	cipher_list = "DEFAULT"
   	make_cert_command = "/etc/freeradius/certs/bootstrap"
   	ecdh_curve = "prime256v1"
    cache {
    	enable = no
    	lifetime = 24
    	max_entries = 255
    }
    verify {
    }
    ocsp {
    	enable = no
    	override_cert_url = yes
    	url = "http://127.0.0.1/ocsp/"
    	use_nonce = yes
    	timeout = 0
    	softfail = no
    }
   }
WARNING: rlm_eap_tls: Unable to set DH parameters.  DH cipher suites may not work!
WARNING: Fix this by running the OpenSSL command listed in eap.conf
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
   	default_eap_type = "peap"
   	copy_request_to_tunnel = yes
   	use_tunneled_reply = no
   	virtual_server = "inner-tunnel"
   	include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
   	default_eap_type = "mschapv2"
   	copy_request_to_tunnel = no
   	use_tunneled_reply = no
   	proxy_tunneled_request_as_eap = yes
   	virtual_server = "inner-tunnel"
   	soh = no
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
   	with_ntdomain_hack = no
   	send_error = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess
  preprocess {
  	huntgroups = "/etc/freeradius/huntgroups"
  	hints = "/etc/freeradius/hints"
  	with_ascend_hack = no
  	ascend_channels_per_line = 23
  	with_ntdomain_hack = no
  	with_specialix_jetstream_hack = no
  	with_cisco_vsa_hack = no
  	with_alvarion_vsa_hack = no
  }
reading pairlist file /etc/freeradius/huntgroups
reading pairlist file /etc/freeradius/hints
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm
  realm suffix {
  	format = "suffix"
  	delimiter = "@"
  	ignore_default = no
  	ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /etc/freeradius/modules/files
  files {
  	usersfile = "/etc/freeradius/users"
  	acctusersfile = "/etc/freeradius/acct_users"
  	preproxy_usersfile = "/etc/freeradius/preproxy_users"
  	compat = "no"
  }
reading pairlist file /etc/freeradius/users
reading pairlist file /etc/freeradius/acct_users
reading pairlist file /etc/freeradius/preproxy_users
 Module: Linked to module rlm_sql
 Module: Instantiating module "sql" from file /etc/freeradius/sql.conf
  sql {
  	driver = "rlm_sql_mysql"
  	server = "localhost"
  	port = ""
  	login = "radius"
  	password = "radpass"
  	radius_db = "radius"
  	read_groups = yes
  	sqltrace = no
  	sqltracefile = "/var/log/freeradius/sqltrace.sql"
  	readclients = no
  	deletestalesessions = yes
  	num_sql_socks = 25
  	lifetime = 0
  	max_queries = 0
  	sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}"
  	default_user_profile = ""
  	nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
  	authorize_check_query = "SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id"
  	authorize_reply_query = "SELECT id, username, attribute, value, op           FROM radreply           WHERE username = '%{SQL-User-Name}'           ORDER BY id"
  	authorize_group_check_query = "SELECT id, groupname, attribute,           Value, op           FROM radgroupcheck           WHERE groupname = '%{Sql-Group}'             OR groupname = '%{NAS-Identifier}'           ORDER BY id"
  	authorize_group_reply_query = "SELECT id, groupname, attribute,           value, op           FROM radgroupreply           WHERE groupname = '%{Sql-Group}'             OR groupname = '%{NAS-Identifier}'           ORDER BY id"
  	accounting_onoff_query = "          UPDATE radacct           SET              acctstoptime       =  '%S',              acctsessiontime    =  unix_timestamp('%S') -                                    unix_timestamp(acctstarttime),              acctterminatecause =  'NAS-Reboot',              acctstopdelay      =  %{%{Acct-Delay-Time}:-0}           WHERE acctstoptime IS NULL           AND calledstationid      =  '%{Called-Station-Id}'           AND acctstarttime     <= '%S'"
  	accounting_update_query = "           UPDATE radacct           SET              framedipaddress = '%{Framed-IP-Address}',              acctsessiontime     = '%{Acct-Session-Time}',              acctinputoctets     = '%{%{Acct-Input-Gigawords}:-0}'  << 32 |                                    '%{%{Acct-Input-Octets}:-0}',              acctoutputoctets    = '%{%{Acct-Output-Gigawords}:-0}' << 32 |                                    '%{%{Acct-Output-Octets}:-0}'           WHERE acctsessionid = '%{Acct-Session-Id}'           AND username        = '%{SQL-User-Name}'           AND nasipaddress    = '%{NAS-IP-Address}'"
  	accounting_update_query_alt = "           INSERT INTO radacct             (acctsessionid,    acctuniqueid,      username,              realm,            nasipaddress,      nasportid,              nasporttype,      acctstarttime,     acctsessiontime,              acctauthentic,    connectinfo_start, acctinputoctets,              acctoutputoctets, calledstationid,   callingstationid,              servicetype,      framedprotocol,    framedipaddress,              acctstartdelay,   xascendsessionsvrkey)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}',              DATE_SUB('%S',                       INTERVAL (%{%{Acct-Session-Time}:-0} +                                 %{%{Acct-Delay-Time}:-0}) SECOND),                       '%{Acct-Session-Time}',              '%{Acct-Authentic}', '',              '%{%{Acct-Input-Gigawords}:-0}' << 32 |              '%{%{Acct-Input-Octets}:-0}',              '%{%{Acct-Output-Gigawords}:-0}' << 32 |              '%{%{Acct-Output-Octets}:-0}',              '%{Called-Station-Id}', '%{Calling-Station-Id}',              '%{Service-Type}', '%{Framed-Protocol}',              '%{Framed-IP-Address}',              '0', '%{X-Ascend-Session-Svr-Key}')"
  	accounting_start_query = "           INSERT INTO radacct             (acctsessionid,    acctuniqueid,     username,              realm,            nasipaddress,     nasportid,              nasporttype,      acctstarttime,    acctstoptime,              acctsessiontime,  acctauthentic,    connectinfo_start,              connectinfo_stop, acctinputoctets,  acctoutputoctets,              calledstationid,  callingstationid, acctterminatecause,              servicetype,      framedprotocol,   framedipaddress,              acctstartdelay,   acctstopdelay,    xascendsessionsvrkey)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}', '%S', NULL,              '0', '%{Acct-Authentic}', '%{Connect-Info}',              '', '0', '0',              '%{Called-Station-Id}', '%{Calling-Station-Id}', '',              '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',              '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"
  	accounting_start_query_alt = "           UPDATE radacct SET              acctstarttime     = '%S',              acctstartdelay    = '%{%{Acct-Delay-Time}:-0}',              connectinfo_start = '%{Connect-Info}'           WHERE acctsessionid  = '%{Acct-Session-Id}'           AND username         = '%{SQL-User-Name}'           AND nasipaddress     = '%{NAS-IP-Address}'"
  	accounting_stop_query = "           UPDATE radacct SET              acctstoptime       = '%S',              acctsessiontime    = '%{Acct-Session-Time}',              acctinputoctets    = '%{%{Acct-Input-Gigawords}:-0}' << 32 |                                   '%{%{Acct-Input-Octets}:-0}',              acctoutputoctets   = '%{%{Acct-Output-Gigawords}:-0}' << 32 |                                   '%{%{Acct-Output-Octets}:-0}',              acctterminatecause = '%{Acct-Terminate-Cause}',              acctstopdelay      = '%{%{Acct-Delay-Time}:-0}',              connectinfo_stop   = '%{Connect-Info}'           WHERE acctsessionid   = '%{Acct-Session-Id}'           AND username          = '%{SQL-User-Name}'           AND nasipaddress      = '%{NAS-IP-Address}'"
  	accounting_stop_query_alt = "           INSERT INTO radacct             (acctsessionid, acctuniqueid, username,              realm, nasipaddress, nasportid,              nasporttype, acctstarttime, acctstoptime,              acctsessiontime, acctauthentic, connectinfo_start,              connectinfo_stop, acctinputoctets, acctoutputoctets,              calledstationid, callingstationid, acctterminatecause,              servicetype, framedprotocol, framedipaddress,              acctstartdelay, acctstopdelay)           VALUES             ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}',              '%{SQL-User-Name}',              '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}',              '%{NAS-Port-Type}',              DATE_SUB('%S',                  INTERVAL (%{%{Acct-Session-Time}:-0} +                  %{%{Acct-Delay-Time}:-0}) SECOND),              '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '',              '%{Connect-Info}',              '%{%{Acct-Input-Gigawords}:-0}' << 32 |              '%{%{Acct-Input-Octets}:-0}',              '%{%{Acct-Output-Gigawords}:-0}' << 32 |              '%{%{Acct-Output-Octets}:-0}',              '%{Called-Station-Id}', '%{Calling-Station-Id}',              '%{Acct-Terminate-Cause}',              '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}',              '0', '%{%{Acct-Delay-Time}:-0}')"
  	group_membership_query = "SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority"
  	connect_failure_retry_delay = 60
  	simul_count_query = "SELECT COUNT(*)                              FROM radacct                              WHERE username = '%{SQL-User-Name}'                              AND acctstoptime IS NULL"
  	simul_verify_query = "SELECT radacctid, acctsessionid, username,                                nasipaddress, nasportid, framedipaddress,                                callingstationid, framedprotocol                                FROM radacct                                WHERE username = '%{SQL-User-Name}'                                AND acctstoptime IS NULL"
  	postauth_query = "INSERT INTO radpostauth                           (username, pass, reply, authdate)                           VALUES (                           '%{User-Name}',                           '%{%{User-Password}:-%{Chap-Password}}',                           '%{reply:Packet-Type}', '%S')"
  	safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
  }
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to radius at localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
rlm_sql (sql): starting 5
rlm_sql (sql): Attempting to connect rlm_sql_mysql #5
rlm_sql_mysql: Starting connect to MySQL server for #5
rlm_sql (sql): Connected new DB handle, #5
rlm_sql (sql): starting 6
rlm_sql (sql): Attempting to connect rlm_sql_mysql #6
rlm_sql_mysql: Starting connect to MySQL server for #6
rlm_sql (sql): Connected new DB handle, #6
rlm_sql (sql): starting 7
rlm_sql (sql): Attempting to connect rlm_sql_mysql #7
rlm_sql_mysql: Starting connect to MySQL server for #7
rlm_sql (sql): Connected new DB handle, #7
rlm_sql (sql): starting 8
rlm_sql (sql): Attempting to connect rlm_sql_mysql #8
rlm_sql_mysql: Starting connect to MySQL server for #8
rlm_sql (sql): Connected new DB handle, #8
rlm_sql (sql): starting 9
rlm_sql (sql): Attempting to connect rlm_sql_mysql #9
rlm_sql_mysql: Starting connect to MySQL server for #9
rlm_sql (sql): Connected new DB handle, #9
rlm_sql (sql): starting 10
rlm_sql (sql): Attempting to connect rlm_sql_mysql #10
rlm_sql_mysql: Starting connect to MySQL server for #10
rlm_sql (sql): Connected new DB handle, #10
rlm_sql (sql): starting 11
rlm_sql (sql): Attempting to connect rlm_sql_mysql #11
rlm_sql_mysql: Starting connect to MySQL server for #11
rlm_sql (sql): Connected new DB handle, #11
rlm_sql (sql): starting 12
rlm_sql (sql): Attempting to connect rlm_sql_mysql #12
rlm_sql_mysql: Starting connect to MySQL server for #12
rlm_sql (sql): Connected new DB handle, #12
rlm_sql (sql): starting 13
rlm_sql (sql): Attempting to connect rlm_sql_mysql #13
rlm_sql_mysql: Starting connect to MySQL server for #13
rlm_sql (sql): Connected new DB handle, #13
rlm_sql (sql): starting 14
rlm_sql (sql): Attempting to connect rlm_sql_mysql #14
rlm_sql_mysql: Starting connect to MySQL server for #14
rlm_sql (sql): Connected new DB handle, #14
rlm_sql (sql): starting 15
rlm_sql (sql): Attempting to connect rlm_sql_mysql #15
rlm_sql_mysql: Starting connect to MySQL server for #15
rlm_sql (sql): Connected new DB handle, #15
rlm_sql (sql): starting 16
rlm_sql (sql): Attempting to connect rlm_sql_mysql #16
rlm_sql_mysql: Starting connect to MySQL server for #16
rlm_sql (sql): Connected new DB handle, #16
rlm_sql (sql): starting 17
rlm_sql (sql): Attempting to connect rlm_sql_mysql #17
rlm_sql_mysql: Starting connect to MySQL server for #17
rlm_sql (sql): Connected new DB handle, #17
rlm_sql (sql): starting 18
rlm_sql (sql): Attempting to connect rlm_sql_mysql #18
rlm_sql_mysql: Starting connect to MySQL server for #18
rlm_sql (sql): Connected new DB handle, #18
rlm_sql (sql): starting 19
rlm_sql (sql): Attempting to connect rlm_sql_mysql #19
rlm_sql_mysql: Starting connect to MySQL server for #19
rlm_sql (sql): Connected new DB handle, #19
rlm_sql (sql): starting 20
rlm_sql (sql): Attempting to connect rlm_sql_mysql #20
rlm_sql_mysql: Starting connect to MySQL server for #20
rlm_sql (sql): Connected new DB handle, #20
rlm_sql (sql): starting 21
rlm_sql (sql): Attempting to connect rlm_sql_mysql #21
rlm_sql_mysql: Starting connect to MySQL server for #21
rlm_sql (sql): Connected new DB handle, #21
rlm_sql (sql): starting 22
rlm_sql (sql): Attempting to connect rlm_sql_mysql #22
rlm_sql_mysql: Starting connect to MySQL server for #22
rlm_sql (sql): Connected new DB handle, #22
rlm_sql (sql): starting 23
rlm_sql (sql): Attempting to connect rlm_sql_mysql #23
rlm_sql_mysql: Starting connect to MySQL server for #23
rlm_sql (sql): Connected new DB handle, #23
rlm_sql (sql): starting 24
rlm_sql (sql): Attempting to connect rlm_sql_mysql #24
rlm_sql_mysql: Starting connect to MySQL server for #24
rlm_sql (sql): Connected new DB handle, #24
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique
  acct_unique {
  	key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating module "detail" from file /etc/freeradius/modules/detail
  detail {
  	detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
  	header = "%t"
  	detailperm = 384
  	dirperm = 493
  	locking = no
  	log_packet_header = no
  }
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp
  radutmp {
  	filename = "/var/log/freeradius/radutmp"
  	username = "%{User-Name}"
  	case_sensitive = yes
  	check_with_nas = yes
  	perm = 384
  	callerid = yes
  }
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter
  attr_filter attr_filter.accounting_response {
  	attrsfile = "/etc/freeradius/attrs.accounting_response"
  	key = "%{User-Name}"
  	relaxed = no
  }
reading pairlist file /etc/freeradius/attrs.accounting_response
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter
  attr_filter attr_filter.access_reject {
  	attrsfile = "/etc/freeradius/attrs.access_reject"
  	key = "%{User-Name}"
  	relaxed = no
  }
reading pairlist file /etc/freeradius/attrs.access_reject
 } # modules
} # server
server status { # from file /etc/freeradius/sites-enabled/status
 modules {
  Module: Creating Autz-Type = Status-Server
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_always
 Module: Instantiating module "ok" from file /etc/freeradius/modules/always
  always ok {
  	rcode = "ok"
  	simulcount = 0
  	mpp = no
  }
 } # modules
} # server
server dynamic_client_server { # from file /etc/freeradius/sites-enabled/inav-dynclients
 modules {
 Module: Checking authorize {...} for more modules to load
 } # modules
} # server
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Checking authorize {...} for more modules to load
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
 	type = "auth"
 	ipaddr = *
 	port = 0
}
listen {
 	type = "acct"
 	ipaddr = *
 	port = 0
}
listen {
 	type = "control"
 listen {
 	socket = "/var/run/freeradius/freeradius.sock"
 }
}
listen {
  	type = "status"
  	ipaddr = 127.0.0.1
  	port = 18121
  client admin {
  	ipaddr = 127.0.0.1
  	require_message_authenticator = no
  	secret = "secret"
  }
}
listen {
  	type = "auth"
  	ipaddr = 127.0.0.1
  	port = 18120
}
 ... adding new socket proxy address * port 44008
 ... adding new socket proxy address * port 44894
 ... adding new socket proxy address * port 40436
 ... adding new socket proxy address * port 35552
 ... adding new socket proxy address * port 59182
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/freeradius/freeradius.sock
Listening on status address 127.0.0.1 port 18121 as server status
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=21, length=162
server dynamic_client_server {
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_sql (sql): Reserving sql socket id: 24
rlm_sql (sql): Released sql socket id: 24
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_sql (sql): Reserving sql socket id: 23
rlm_sql (sql): Released sql socket id: 23
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_sql (sql): Reserving sql socket id: 22
rlm_sql (sql): Released sql socket id: 22
} # server dynamic_client_server
- Added client 18.15.2.96 with shared secret wpa01
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=21, length=162
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x0267000e01575041544553543031
	Message-Authenticator = 0x23e19f9af7e17d88f9a44dc2a43a30f8
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 103 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] 	expand: %{Stripped-User-Name} -> WPATEST01
[sql] 	expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 21
[sql] 	expand: SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = 'WPATEST01'           ORDER BY id
[sql] 	expand: SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority -> SELECT groupname           FROM radusergroup           WHERE username = 'WPATEST01'           ORDER BY priority
rlm_sql (sql): Released sql socket id: 21
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 21 to 18.15.2.96 port 39821
	EAP-Message = 0x016800061920
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa8b8feaec49bb7390043eac56
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=22, length=374
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026800d01980000000c616030100c1010000bd0301c710875ecf8c341d7c1945550fbc4239200d59aaaff94bf25a57da64ae6f6db5000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011
	State = 0x8be7f3fa8b8feaec49bb7390043eac56
	Message-Authenticator = 0x6f447c173ae2e57d28738de915aa2076
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 104 length 208
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0a44], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 22 to 18.15.2.96 port 39821
	EAP-Message = 0x0169040019c000000a8816030100310200002d03015602b0867fde8c9987d87d8b8f834e9f2d369fc1ea7b1ab97c09196b5f116ab6000035000005ff010001001603010a440b000a40000a3d0004fb308204f7308203dfa003020102020101300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a060355040313
	EAP-Message = 0x23496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323031335a170d3235303930363133323031335a307c310b300906035504061302495431123010060355040813094c6f6d626172646961311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3110300e06035504031307465220636572743128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100a4afeca0af0c867558f514da8309f7cf1a2a772738c3c0e0fd9e
	EAP-Message = 0x4b83717de37e6fc95c6a00afc83ccd3d5a980c6ae732fccd004aea22afa08826f1419e012553054eafa018dd201f6591a5c5a78da76010fe30d1dd1d28956bb7f393b2ca66373f34cf3a2eebd81854ef8173eb801b149c209808a871a16ad279ef8f08b849eafb80f129a4010e1a4f7617168edfcec40dd4a1a928a06205fe85f7f25234b8f1947beaf29be481dc8719d38294c81ef9f6e42cc223286a3edeb4b5fe9eb064e9cce2e7d79eb9a0c95534553c89b7567e311602900011fb6a9227b85b191ebcd3fa152f7bd504f4bc862b551b7661f07b0de5c543c6e3d2c24f086b3c96e92c56970250840eff1d261e29ec8109f75c4d198a5115612101
	EAP-Message = 0x884de35e51d349512874a73ff8ea1fcf390035ac5d044dfa2fce3f77979b61f634cf228ab9fa28680adad86952c50bf05730bc9b73c9cbdec210659b3e6bfc738797f810c6c0203159805b0e0f3d87a86c62ba7800fa3a30e7c2d2c506a47a88b13970f2fbf2cf5a0b64a601a8f5ffb640a6368f95fe21e793c5ce64b48130365cdbd3c190c21829ee4823667e607f18d251bc214251bf1b16f290644f14b590757500b694266a81ee784bd55472eb6e9a052daf4328f30b973adabcd8913fedd1140e7b8fdd7f81f4ea429393cd685cd9d50fa9f6028493c7b0cf2b4ce8fc87801ffa2becde0be62d0203010001a34f304d30130603551d25040c300a
	EAP-Message = 0x06082b060105050703013036
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa8a8eeaec49bb7390043eac56
Finished request 1.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=23, length=172
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026900061900
	State = 0x8be7f3fa8a8eeaec49bb7390043eac56
	Message-Authenticator = 0xdf899447a17ff487fd72c74230d2b448
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 105 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 23 to 18.15.2.96 port 39821
	EAP-Message = 0x016a03fc19400603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010063fd16c3ec75c7e00d8e15c07929d20f75430b2ae796be3bea47ee94075f94c69ab384cd359b73f0e9f70040e5fddf7075c62cefd4f9ec416ea544105b9ee1b179a2c66c99adfeea1dc55b8f7a50c2619bfb22b8ef5a081c8a9c821bf7d609b3aea8c7dce6e8a936a98c29ebb1e9e8e3ec8ff98e62429c0a536d56f1829229c9f1cc73a9420a8babc7e090472b91b7899c898df93e1f180ed2d4e10c07e7ae2b15d56f86c425928e929c1df694
	EAP-Message = 0x8481a70cfeee2a035fa1dd513cab51319b11cdcae1e0947348a89905694c65c9d81cc8372ba4ad15f78e6f05c7eee90a9b4c47542f401ccc646d97460f6fd51ae316718406630f8999c30f80f01dc3c7f3130300053c3082053830820420a003020102020900f36684f36b9057e7300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172
	EAP-Message = 0x652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323030385a170d3235303930363133323030385a3081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520
	EAP-Message = 0x417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d2da114e3c65d1a6d5af105f21e12a6e10f8f563bef1dcc697bdb47d41e2382bcbc78e661170ca75c488a79f17bf9b3917b41779c6f7c5c76bbb34d8c00bbfc4cdcac10131216d120495fbd475275adfcb950c447f0e70852120760b6fc3979fb810fdd0af3d6b611317c3f2582abb6bad7c320fac36317c011027908fdb8ae803abaed0ac8b2d03c5fe313ccec14845a7818a1c13b83646b8f4a5ae2cd0d745b7d65dbd9bb81dc3a861caa48bd67e5a02aa0445e01c5c19667b466077d9fb4100f58f78b149288459cc16ae484cebed6891ba
	EAP-Message = 0x3b5d949a7f258f97
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa898deaec49bb7390043eac56
Finished request 2.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=24, length=172
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026a00061900
	State = 0x8be7f3fa898deaec49bb7390043eac56
	Message-Authenticator = 0xa440bf143ec9e6c26c28d8391d02a978
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 106 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 24 to 18.15.2.96 port 39821
	EAP-Message = 0x016b02a21900f2a1fd1b024e31eda43d00c39a8957a21d16c384ba6f1c63be668c3abc95085b6bb71ec2690203010001a38201513082014d301d0603551d0e04160414279a85d9f9cf9f8457de3c73852d320e2db97dcf3081e50603551d230481dd3081da8014279a85d9f9cf9f8457de3c73852d320e2db97dcfa181b6a481b33081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e6176
	EAP-Message = 0x69676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479820900f36684f36b9057e7300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010042885b349b6b9cd176de3c166109cac40e03a3e01a0b4c6dada2fdea3d768ec6d05499cceeb5c12840ec273d6294187f5951580755b89f4373e0b8cdea5c03709356e7e3f452faaca711084daa283d4a4fca87a13fa6c956eac1a34a1e2e22e0dc
	EAP-Message = 0x67c494914cca1cf6973b176665a630e5488c37707f1cdfe6ee4e43dfac65c13556df847fdc301f2ae0d71740ec3ad962f623e53865c510ab3f67f4c9d3fce9051610882c4244ec103dbd379e8e5dfc7a53dd4d839a6ee2d248e70ed1e69d1bfc77e1f2efd78b016f30ac2d6da9c9ac01366b69f6248f737463b9634ecb9b512dcd9e13cfe4683a57f5fedc49b98ce2d0dbb37b4e6627dd804f7a543a6680e416030100040e000000
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa888ceaec49bb7390043eac56
Finished request 3.
Going to the next request
Waking up in 4.6 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=25, length=762
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026b02501980000002461603010206100002020200044154ee5dd5a7a703e9a12246cfaf05f8f9073178356fc1089cab52609e78c805911540cd4cdc68c9761b6d41af05104b84b2f38bda64b0e52bc0d10ed64ad35fe3920fa5c6030cfa66d7dc25a24e324417dea12829de39425719faa49e2c5927a1db68e3e99198c03b93943afdcd0654371c7e8aa886ea996d00fa2d9ae830c01dee85cd42f979cb6af349a59deff53c74808fced7d6864691b43fb1a6eacded1baacb6d31837839c192276f32c8cf9fbabcd78d502d8310064daeb9a8d59406b192bc8608e49212b18a633f0da2ed355bb0b3e305ea6251dc200c7ec9dd88303e9fefca7822f5
	EAP-Message = 0xc7dde6ae460a4e8697cee9d1a918f0b3498c8255373ab7cc8231f412a3a0665ffed1b065e0e76d5b4d118f7c8a2e17c7d9d5b0e800fe23332c993fdc6345cd79946f5f857569b6720e4c7a0cd36844f3a5e234c520cdb806d73530b724fafc3a0eda613689082a82e57b07e8504fb3c1a14b184a45ffd9adc5f471ab23e20192e8859fcdc99ca43e552f55876f6abc4cee8ce181cfcd576f36dc83a2bf5a8a33dfec51b746b8ea8ede9696a9502d236ed7fd98de7a2cdccf401ea51749874c1ad692dc9ef19400fa2857d7ba35c1dd0a1acdab294c7a80aa049e4bd1721fb1df2bae7d0026b89c1fe69e895f6ac2d04911a15be0014da0ed395f8bda60
	EAP-Message = 0xea725490158670bfbcb30938a730dce3245c941ebb75ac8c6f8f331403010001011603010030deca47943704a7bbbb320eaba31d4658446217d4e3b2dea8c317d20463d241a76a5e5fe208b72b2bab182ce6d49c128f
	State = 0x8be7f3fa888ceaec49bb7390043eac56
	Message-Authenticator = 0x4c10f7b2c345b19e8e590332a99b4dcf
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 107 length 253
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 582
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange  
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]  
[peap] <<< TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]  
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 25 to 18.15.2.96 port 39821
	EAP-Message = 0x016c004119001403010001011603010030b756af8e04ec1177da7cdba3a8e46ce9c9a03753f3ed6de7041c7851249ba593ad8e4ca087a8a12e0c0837eef32ef7e2
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa8f8beaec49bb7390043eac56
Finished request 4.
Going to the next request
Waking up in 4.5 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=26, length=172
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026c00061900
	State = 0x8be7f3fa8f8beaec49bb7390043eac56
	Message-Authenticator = 0x7f95d93bb8a3e3680d805e01ef24c433
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 108 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3 
[peap] eaptls_process returned 3 
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 26 to 18.15.2.96 port 39821
	EAP-Message = 0x016d002b19001703010020e0a71dcaf1dd947689d81035169b60f8edc2f23a6d623dc0b5bf36882e084778
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa8e8aeaec49bb7390043eac56
Finished request 5.
Going to the next request
Waking up in 4.4 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=27, length=209
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026d002b19001703010020e6c9ea37a34dcf8b44c72525c4da21e5ed75a845d5936b83fef1f2be29ae9a5f
	State = 0x8be7f3fa8e8aeaec49bb7390043eac56
	Message-Authenticator = 0x9de3d03912efbbc6f557c3db393fdee9
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 109 length 43
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - WPATEST01
[peap] Got inner identity 'WPATEST01'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
	EAP-Message = 0x026d000e01575041544553543031
server  {
[peap] Setting User-Name to WPATEST01
Sending tunneled request
	EAP-Message = 0x026d000e01575041544553543031
	FreeRADIUS-Proxied-To = 127.0.0.1
	User-Name = "WPATEST01"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+group authorize {
++[chap] = noop
++[mschap] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
++update control {
++} # update control = noop
[eap] EAP packet type response id 109 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] 	expand: %{Stripped-User-Name} -> WPATEST01
[sql] 	expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 20
[sql] 	expand: SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = 'WPATEST01'           ORDER BY id
[sql] 	expand: SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority -> SELECT groupname           FROM radusergroup           WHERE username = 'WPATEST01'           ORDER BY priority
rlm_sql (sql): Released sql socket id: 20
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+group authenticate {
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] = handled
+} # group authenticate = handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
	EAP-Message = 0x016e00231a016e001e101e157a2b3c0548f7806819a21b8d5ada575041544553543031
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x82d2aee482bcb4d70ca1911950ec56f8
[peap] Got tunneled reply RADIUS code Access-Challenge
	EAP-Message = 0x016e00231a016e001e101e157a2b3c0548f7806819a21b8d5ada575041544553543031
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x82d2aee482bcb4d70ca1911950ec56f8
[peap] Got tunneled Access-Challenge
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 27 to 18.15.2.96 port 39821
	EAP-Message = 0x016e004b19001703010040935a24ed0f4bae1413743c3c1b8465b26dce8b4e54d8733277feea035324317e2359d7b7a04e62922331707504ccc06ecb0e5a117f1db024426116e552088fa7
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa8d89eaec49bb7390043eac56
Finished request 6.
Going to the next request
Waking up in 4.3 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=28, length=273
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026e006b190017030100601e1924cddad42e5f82e6baceca61075e4f50cbdfcc6f32c3e34a99e966a2d6b85f427bf719dd9586019ab5eead1ad7daf21012855f3143d8d8bc338271dec31828a34ce5924e2b0a8c9668c9d67f719f7466cbfd25edb67b411f2c76e6384501
	State = 0x8be7f3fa8d89eaec49bb7390043eac56
	Message-Authenticator = 0x7a4043ef634f9bdb61136f3fd92a28af
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 110 length 107
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
	EAP-Message = 0x026e00441a026e003f31c1fb03eebb1e5a69819119a42d8d19e90000000000000000d8dc46e58ebd8bd1bf2ddce64ed8debcdb8284b445e8e24900575041544553543031
server  {
[peap] Setting User-Name to WPATEST01
Sending tunneled request
	EAP-Message = 0x026e00441a026e003f31c1fb03eebb1e5a69819119a42d8d19e90000000000000000d8dc46e58ebd8bd1bf2ddce64ed8debcdb8284b445e8e24900575041544553543031
	FreeRADIUS-Proxied-To = 127.0.0.1
	User-Name = "WPATEST01"
	State = 0x82d2aee482bcb4d70ca1911950ec56f8
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+group authorize {
++[chap] = noop
++[mschap] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
++update control {
++} # update control = noop
[eap] EAP packet type response id 110 length 68
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] 	expand: %{Stripped-User-Name} -> WPATEST01
[sql] 	expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 19
[sql] 	expand: SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = 'WPATEST01'           ORDER BY id
[sql] 	expand: SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority -> SELECT groupname           FROM radusergroup           WHERE username = 'WPATEST01'           ORDER BY priority
rlm_sql (sql): Released sql socket id: 19
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +group MS-CHAP {
[mschap] No Cleartext-Password configured.  Cannot create LM-Password.
[mschap] No Cleartext-Password configured.  Cannot create NT-Password.
[mschap] Creating challenge hash with username: WPATEST01
[mschap] Client is using MS-CHAPv2 for WPATEST01, we need NT-Password
[mschap] FAILED: No NT/LM-Password.  Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] = reject
+} # group MS-CHAP = reject
[eap] Freeing handler
++[eap] = reject
+} # group authenticate = reject
Failed to authenticate the user.
Using Post-Auth-Type REJECT
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+group REJECT {
[attr_filter.access_reject] 	expand: %{User-Name} -> WPATEST01
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
} # server inner-tunnel
[peap] Got tunneled reply code 3
	MS-CHAP-Error = "nE=691 R=1"
	EAP-Message = 0x046e0004
	Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code Access-Reject
	MS-CHAP-Error = "nE=691 R=1"
	EAP-Message = 0x046e0004
	Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 28 to 18.15.2.96 port 39821
	EAP-Message = 0x016f002b19001703010020657b2b2cba09fec9c74376a57473e880bfa77238cbbeff27c1343c2263eca983
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x8be7f3fa8c88eaec49bb7390043eac56
Finished request 7.
Going to the next request
Waking up in 4.2 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=29, length=209
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x026f002b19001703010020ec79e2545ad2b1cfe636917063ef7b711f0fa14c6d8457b069aa058c5906bb8a
	State = 0x8be7f3fa8c88eaec49bb7390043eac56
	Message-Authenticator = 0x3fb015ef305a7eac9cb158c63a9b3d9d
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 111 length 43
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap]  The users session was previously rejected: returning reject (again.)
[peap]  *** This means you need to read the PREVIOUS messages in the debug output
[peap]  *** to find out the reason why the user was rejected.
[peap]  *** Look for "reject" or "fail".  Those earlier messages will tell you.
[peap]  *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] = invalid
+} # group authenticate = invalid
Failed to authenticate the user.
Using Post-Auth-Type REJECT
# Executing group from file /etc/freeradius/sites-enabled/default
+group REJECT {
[attr_filter.access_reject] 	expand: %{User-Name} -> WPATEST01
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
Delaying reject of request 8 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 8
Sending Access-Reject of id 29 to 18.15.2.96 port 39821
	EAP-Message = 0x046f0004
	Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.2 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=30, length=162
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x0223000e01575041544553543031
	Message-Authenticator = 0x87cd6a9e4c9564d7e3ed4521d116b50b
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 35 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] 	expand: %{Stripped-User-Name} -> WPATEST01
[sql] 	expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 18
[sql] 	expand: SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = '%{SQL-User-Name}'           ORDER BY id -> SELECT id, username, attribute, value, op           FROM radcheck           WHERE username = 'WPATEST01'           ORDER BY id
[sql] 	expand: SELECT groupname           FROM radusergroup           WHERE username = '%{SQL-User-Name}'           ORDER BY priority -> SELECT groupname           FROM radusergroup           WHERE username = 'WPATEST01'           ORDER BY priority
rlm_sql (sql): Released sql socket id: 18
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 30 to 18.15.2.96 port 39821
	EAP-Message = 0x012400061920
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x9aa5a94f9a81b08af2138422daf6c105
Finished request 9.
Going to the next request
Waking up in 0.5 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=31, length=374
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x022400d01980000000c616030100c1010000bd0301f3bda01eda9f2d175e6217aa9d9da118a9134dfc2ce3144cf19c790fb65f7de0000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011
	State = 0x9aa5a94f9a81b08af2138422daf6c105
	Message-Authenticator = 0x2154e0dfbfe0c524d846bbbe4d9f8c3e
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 36 length 208
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0a44], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 31 to 18.15.2.96 port 39821
	EAP-Message = 0x0125040019c000000a8816030100310200002d03015602b08a76325520a8c3e5889521fef23ce8edf0c8f14f225469b1157c6b6aae000035000005ff010001001603010a440b000a40000a3d0004fb308204f7308203dfa003020102020101300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a060355040313
	EAP-Message = 0x23496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323031335a170d3235303930363133323031335a307c310b300906035504061302495431123010060355040813094c6f6d626172646961311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3110300e06035504031307465220636572743128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100a4afeca0af0c867558f514da8309f7cf1a2a772738c3c0e0fd9e
	EAP-Message = 0x4b83717de37e6fc95c6a00afc83ccd3d5a980c6ae732fccd004aea22afa08826f1419e012553054eafa018dd201f6591a5c5a78da76010fe30d1dd1d28956bb7f393b2ca66373f34cf3a2eebd81854ef8173eb801b149c209808a871a16ad279ef8f08b849eafb80f129a4010e1a4f7617168edfcec40dd4a1a928a06205fe85f7f25234b8f1947beaf29be481dc8719d38294c81ef9f6e42cc223286a3edeb4b5fe9eb064e9cce2e7d79eb9a0c95534553c89b7567e311602900011fb6a9227b85b191ebcd3fa152f7bd504f4bc862b551b7661f07b0de5c543c6e3d2c24f086b3c96e92c56970250840eff1d261e29ec8109f75c4d198a5115612101
	EAP-Message = 0x884de35e51d349512874a73ff8ea1fcf390035ac5d044dfa2fce3f77979b61f634cf228ab9fa28680adad86952c50bf05730bc9b73c9cbdec210659b3e6bfc738797f810c6c0203159805b0e0f3d87a86c62ba7800fa3a30e7c2d2c506a47a88b13970f2fbf2cf5a0b64a601a8f5ffb640a6368f95fe21e793c5ce64b48130365cdbd3c190c21829ee4823667e607f18d251bc214251bf1b16f290644f14b590757500b694266a81ee784bd55472eb6e9a052daf4328f30b973adabcd8913fedd1140e7b8fdd7f81f4ea429393cd685cd9d50fa9f6028493c7b0cf2b4ce8fc87801ffa2becde0be62d0203010001a34f304d30130603551d25040c300a
	EAP-Message = 0x06082b060105050703013036
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x9aa5a94f9b80b08af2138422daf6c105
Finished request 10.
Going to the next request
Waking up in 0.4 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=32, length=172
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x022500061900
	State = 0x9aa5a94f9b80b08af2138422daf6c105
	Message-Authenticator = 0xc30fd4d1c8fbe3b53ad945b481066afc
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 37 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 32 to 18.15.2.96 port 39821
	EAP-Message = 0x012603fc19400603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010063fd16c3ec75c7e00d8e15c07929d20f75430b2ae796be3bea47ee94075f94c69ab384cd359b73f0e9f70040e5fddf7075c62cefd4f9ec416ea544105b9ee1b179a2c66c99adfeea1dc55b8f7a50c2619bfb22b8ef5a081c8a9c821bf7d609b3aea8c7dce6e8a936a98c29ebb1e9e8e3ec8ff98e62429c0a536d56f1829229c9f1cc73a9420a8babc7e090472b91b7899c898df93e1f180ed2d4e10c07e7ae2b15d56f86c425928e929c1df694
	EAP-Message = 0x8481a70cfeee2a035fa1dd513cab51319b11cdcae1e0947348a89905694c65c9d81cc8372ba4ad15f78e6f05c7eee90a9b4c47542f401ccc646d97460f6fd51ae316718406630f8999c30f80f01dc3c7f3130300053c3082053830820420a003020102020900f36684f36b9057e7300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172
	EAP-Message = 0x652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323030385a170d3235303930363133323030385a3081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520
	EAP-Message = 0x417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d2da114e3c65d1a6d5af105f21e12a6e10f8f563bef1dcc697bdb47d41e2382bcbc78e661170ca75c488a79f17bf9b3917b41779c6f7c5c76bbb34d8c00bbfc4cdcac10131216d120495fbd475275adfcb950c447f0e70852120760b6fc3979fb810fdd0af3d6b611317c3f2582abb6bad7c320fac36317c011027908fdb8ae803abaed0ac8b2d03c5fe313ccec14845a7818a1c13b83646b8f4a5ae2cd0d745b7d65dbd9bb81dc3a861caa48bd67e5a02aa0445e01c5c19667b466077d9fb4100f58f78b149288459cc16ae484cebed6891ba
	EAP-Message = 0x3b5d949a7f258f97
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x9aa5a94f9883b08af2138422daf6c105
Finished request 11.
Going to the next request
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=33, length=172
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x022600061900
	State = 0x9aa5a94f9883b08af2138422daf6c105
	Message-Authenticator = 0xec9b1d5c4dc6e45d991d320069e814e2
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 38 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 33 to 18.15.2.96 port 39821
	EAP-Message = 0x012702a21900f2a1fd1b024e31eda43d00c39a8957a21d16c384ba6f1c63be668c3abc95085b6bb71ec2690203010001a38201513082014d301d0603551d0e04160414279a85d9f9cf9f8457de3c73852d320e2db97dcf3081e50603551d230481dd3081da8014279a85d9f9cf9f8457de3c73852d320e2db97dcfa181b6a481b33081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e6176
	EAP-Message = 0x69676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479820900f36684f36b9057e7300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010042885b349b6b9cd176de3c166109cac40e03a3e01a0b4c6dada2fdea3d768ec6d05499cceeb5c12840ec273d6294187f5951580755b89f4373e0b8cdea5c03709356e7e3f452faaca711084daa283d4a4fca87a13fa6c956eac1a34a1e2e22e0dc
	EAP-Message = 0x67c494914cca1cf6973b176665a630e5488c37707f1cdfe6ee4e43dfac65c13556df847fdc301f2ae0d71740ec3ad962f623e53865c510ab3f67f4c9d3fce9051610882c4244ec103dbd379e8e5dfc7a53dd4d839a6ee2d248e70ed1e69d1bfc77e1f2efd78b016f30ac2d6da9c9ac01366b69f6248f737463b9634ecb9b512dcd9e13cfe4683a57f5fedc49b98ce2d0dbb37b4e6627dd804f7a543a6680e416030100040e000000
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x9aa5a94f9982b08af2138422daf6c105
Finished request 12.
Going to the next request
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=34, length=762
	User-Name = "WPATEST01"
	NAS-IP-Address = 192.168.1.29
	Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
	NAS-Port-Type = Wireless-802.11
	NAS-Port = 1
	Calling-Station-Id = "C4-9A-02-0F-0C-36"
	Connect-Info = "CONNECT 54Mbps 802.11g"
	Framed-MTU = 1400
	EAP-Message = 0x0227025019800000024616030102061000020202005b95bea6ad27a5e0714d0a929aa0614eb79efdbf330b5dc7b4e576245920e7e7788b1e49c90b470df73b080522f3e87a092989bb4cb1b08141242e5553956d9ce7bae1edd6caa72d38e1e71fc0c31537d34416e61896f526bb6f3e54806c82be09b677c195e0370d457508cd4645da3d36aa49694bd823d558bd2147791952a3591d94e237ea064c239aca10491bb42aac6189fee8ca802e0696dc6a449b6aaa05c05743c44b04b9001f0e44afec187c5ced8b874348b049f59d66e60df7677a2ded62f36b79c3402b992e26db94af11d24838af81cc8f0909288de9f422640715f986aebb733c00
	EAP-Message = 0x61407139a59d56bd2b6ff25184b217953d5d9f09a30bb08b36b1c916efd50b5eac799aee9f2219340c8e6742b188fee88dfe45c6cc99ad8e6cd76b7d0aaf6479ffff78b34600b30707c548b73d317366a646bd2a5949a70029f78fe114b2743fb87858eec21eaa1ddfa7e5ce24c7142d1f792e0a34c9429259638bcd82624f9a714a7a08458b09e15f8ebb526c2801ad411f4e0698d8ee5420b4189d69869ded275996a499f3e83fed4d10f99de7c901b83642e301ae1abba4be4496579ca775779b6e47ee2bf32c5886048304b939a857547e02363ce1acd662832bba56a8eae2dcbe0c56d4bf7209599240699b678fefdc0b1b8dab4c7e2febaae634
	EAP-Message = 0x139d2a88fef4f660cc7ff33c613d0ff82945ee2a1c0b3fefdb070714030100010116030100305fb335cd650dee58c3d0e72bcd2cebaf2ad9be9771711d8f711b5dd5e3af7deb8ac4ce2d6525a06abd5a50e3b7233291
	State = 0x9aa5a94f9982b08af2138422daf6c105
	Message-Authenticator = 0x2a906c40a10f593908e3b85e32b9f718
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 39 length 253
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 582
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange  
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]  
[peap] <<< TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]  
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 34 to 18.15.2.96 port 39821
	EAP-Message = 0x012800411900140301000101160301003070615ca22fe998758237eba6df7204ae366aa0d4d0be6576fe3c8766df683cc749120cdbd7d5c965ed280783bc692e52
	Message-Authenticator = 0x00000000000000000000000000000000
	State = 0x9aa5a94f9e8db08af2138422daf6c105
Finished request 13.
Going to the next request
Waking up in 0.1 seconds.

-- 
Lorenzo Milesi - lorenzo.milesi at yetopen.it

YetOpen S.r.l. - http://www.yetopen.it/



More information about the Freeradius-Users mailing list