WPA2 enterprise and NAS-Identifier
Lorenzo Milesi
maxxer at ufficyo.com
Wed Sep 23 16:08:59 CEST 2015
hi.
I'm trying to setup WPA2 authentication, and I mostly succeded, I can authenticate users which are in MySQL on FR2.
What I am missing is the ability to restrict some users access using the NAS-Identifier attribute.
>From what I could see the request (made from a DDWRT AP) doesn't include that attribute, so when it comes to radius it rejects the access because of that.
Is it somehow possible to update the request (like it can be done for dynamic clients) and add the attribute there?
thanks
I'm attaching here a sample debug failed login session
freeradius: FreeRADIUS Version 2.2.6, for host x86_64-pc-linux-gnu, built on Feb 12 2015 at 12:10:02
Copyright (C) 1999-2013 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License.
For more information about these matters, see the file named COPYRIGHT.
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/dhcp_sqlippool
including configuration file /etc/freeradius/sql/mysql/ippool-dhcp.conf
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/radrelay
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/opendirectory
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/replicate
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/rediswho
including configuration file /etc/freeradius/modules/dynamic_clients
including configuration file /etc/freeradius/modules/cache
including configuration file /etc/freeradius/modules/raw
including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/redis
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/soh
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/sql.conf
including configuration file /etc/freeradius/sql/mysql/dialup.conf
including configuration file /etc/freeradius/sql/mysql/counter.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/control-socket
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/status
including configuration file /etc/freeradius/sites-enabled/inav-dynclients
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
user = "freerad"
group = "freerad"
allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
name = "freeradius"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/freeradius"
run_dir = "/var/run/freeradius"
libdir = "/usr/lib/freeradius"
radacctdir = "/var/log/freeradius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/var/run/freeradius/freeradius.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
}
security {
max_attributes = 200
reject_delay = 1
status_server = yes
allow_vulnerable_openssl = no
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = "testing123"
response_window = 20
max_outstanding = 65536
require_message_authenticator = yes
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
num_answers_to_alive = 3
num_pings_to_alive = 3
revive_interval = 120
status_check_timeout = 4
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
realm NULL {
authhost = LOCAL
accthost = LOCAL
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "secret"
shortname = "localhost"
nastype = "other"
}
client dymamic {
ipaddr = 0.0.0.0
netmask = 0
require_message_authenticator = no
dynamic_clients = "dynamic_client_server"
lifetime = 12600
}
radiusd: #### Instantiating modules ####
instantiate {
Module: Linked to module rlm_exec
Module: Instantiating module "exec" from file /etc/freeradius/modules/exec
exec {
wait = yes
input_pairs = "request"
shell_escape = yes
timeout = 10
}
Module: Linked to module rlm_expr
Module: Instantiating module "expr" from file /etc/freeradius/modules/expr
Module: Linked to module rlm_expiration
Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration
expiration {
reply-message = "Password Has Expired "
}
Module: Linked to module rlm_logintime
Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime
logintime {
reply-message = "You are calling outside your allowed timespan "
minimum-timeout = 60
}
Module: Linked to module rlm_raw
Module: Instantiating module "raw" from file /etc/freeradius/modules/raw
}
radiusd: #### Loading Virtual Servers ####
server { # from file
modules {
Module: Creating Auth-Type = digest
Module: Creating Post-Auth-Type = REJECT
Module: Checking authenticate {...} for more modules to load
Module: Linked to module rlm_pap
Module: Instantiating module "pap" from file /etc/freeradius/modules/pap
pap {
encryption_scheme = "auto"
auto_header = no
}
Module: Linked to module rlm_chap
Module: Instantiating module "chap" from file /etc/freeradius/modules/chap
Module: Linked to module rlm_mschap
Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = no
allow_retry = yes
}
Module: Linked to module rlm_digest
Module: Instantiating module "digest" from file /etc/freeradius/modules/digest
Module: Linked to module rlm_unix
Module: Instantiating module "unix" from file /etc/freeradius/modules/unix
unix {
radwtmp = "/var/log/freeradius/radwtmp"
}
Module: Linked to module rlm_eap
Module: Instantiating module "eap" from file /etc/freeradius/eap.conf
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 4096
}
Module: Linked to sub-module rlm_eap_md5
Module: Instantiating eap-md5
Module: Linked to sub-module rlm_eap_leap
Module: Instantiating eap-leap
Module: Linked to sub-module rlm_eap_gtc
Module: Instantiating eap-gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
Module: Linked to sub-module rlm_eap_tls
Module: Instantiating eap-tls
tls {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
CA_path = "/etc/freeradius/certs"
pem_file_type = yes
private_key_file = "/etc/freeradius/certs/server.pem"
certificate_file = "/etc/freeradius/certs/server.pem"
CA_file = "/etc/freeradius/certs/ca.pem"
private_key_password = "key_pwd"
dh_file = "/etc/freeradius/certs/dh"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
make_cert_command = "/etc/freeradius/certs/bootstrap"
ecdh_curve = "prime256v1"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work!
WARNING: Fix this by running the OpenSSL command listed in eap.conf
Module: Linked to sub-module rlm_eap_ttls
Module: Instantiating eap-ttls
ttls {
default_eap_type = "peap"
copy_request_to_tunnel = yes
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
}
Module: Linked to sub-module rlm_eap_peap
Module: Instantiating eap-peap
peap {
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
}
Module: Linked to sub-module rlm_eap_mschapv2
Module: Instantiating eap-mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_preprocess
Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess
preprocess {
huntgroups = "/etc/freeradius/huntgroups"
hints = "/etc/freeradius/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
reading pairlist file /etc/freeradius/huntgroups
reading pairlist file /etc/freeradius/hints
Module: Linked to module rlm_realm
Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
Module: Linked to module rlm_files
Module: Instantiating module "files" from file /etc/freeradius/modules/files
files {
usersfile = "/etc/freeradius/users"
acctusersfile = "/etc/freeradius/acct_users"
preproxy_usersfile = "/etc/freeradius/preproxy_users"
compat = "no"
}
reading pairlist file /etc/freeradius/users
reading pairlist file /etc/freeradius/acct_users
reading pairlist file /etc/freeradius/preproxy_users
Module: Linked to module rlm_sql
Module: Instantiating module "sql" from file /etc/freeradius/sql.conf
sql {
driver = "rlm_sql_mysql"
server = "localhost"
port = ""
login = "radius"
password = "radpass"
radius_db = "radius"
read_groups = yes
sqltrace = no
sqltracefile = "/var/log/freeradius/sqltrace.sql"
readclients = no
deletestalesessions = yes
num_sql_socks = 25
lifetime = 0
max_queries = 0
sql_user_name = "%{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}}"
default_user_profile = ""
nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas"
authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id"
authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' OR groupname = '%{NAS-Identifier}' ORDER BY id"
authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' OR groupname = '%{NAS-Identifier}' ORDER BY id"
accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = 'NAS-Reboot', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND calledstationid = '%{Called-Station-Id}' AND acctstarttime <= '%S'"
accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"
accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')"
accounting_start_query = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')"
accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"
accounting_stop_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'"
accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')"
group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority"
connect_failure_retry_delay = 60
simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL"
postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')"
safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /"
}
rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked
rlm_sql (sql): Attempting to connect to radius at localhost:/radius
rlm_sql (sql): starting 0
rlm_sql (sql): Attempting to connect rlm_sql_mysql #0
rlm_sql_mysql: Starting connect to MySQL server for #0
rlm_sql (sql): Connected new DB handle, #0
rlm_sql (sql): starting 1
rlm_sql (sql): Attempting to connect rlm_sql_mysql #1
rlm_sql_mysql: Starting connect to MySQL server for #1
rlm_sql (sql): Connected new DB handle, #1
rlm_sql (sql): starting 2
rlm_sql (sql): Attempting to connect rlm_sql_mysql #2
rlm_sql_mysql: Starting connect to MySQL server for #2
rlm_sql (sql): Connected new DB handle, #2
rlm_sql (sql): starting 3
rlm_sql (sql): Attempting to connect rlm_sql_mysql #3
rlm_sql_mysql: Starting connect to MySQL server for #3
rlm_sql (sql): Connected new DB handle, #3
rlm_sql (sql): starting 4
rlm_sql (sql): Attempting to connect rlm_sql_mysql #4
rlm_sql_mysql: Starting connect to MySQL server for #4
rlm_sql (sql): Connected new DB handle, #4
rlm_sql (sql): starting 5
rlm_sql (sql): Attempting to connect rlm_sql_mysql #5
rlm_sql_mysql: Starting connect to MySQL server for #5
rlm_sql (sql): Connected new DB handle, #5
rlm_sql (sql): starting 6
rlm_sql (sql): Attempting to connect rlm_sql_mysql #6
rlm_sql_mysql: Starting connect to MySQL server for #6
rlm_sql (sql): Connected new DB handle, #6
rlm_sql (sql): starting 7
rlm_sql (sql): Attempting to connect rlm_sql_mysql #7
rlm_sql_mysql: Starting connect to MySQL server for #7
rlm_sql (sql): Connected new DB handle, #7
rlm_sql (sql): starting 8
rlm_sql (sql): Attempting to connect rlm_sql_mysql #8
rlm_sql_mysql: Starting connect to MySQL server for #8
rlm_sql (sql): Connected new DB handle, #8
rlm_sql (sql): starting 9
rlm_sql (sql): Attempting to connect rlm_sql_mysql #9
rlm_sql_mysql: Starting connect to MySQL server for #9
rlm_sql (sql): Connected new DB handle, #9
rlm_sql (sql): starting 10
rlm_sql (sql): Attempting to connect rlm_sql_mysql #10
rlm_sql_mysql: Starting connect to MySQL server for #10
rlm_sql (sql): Connected new DB handle, #10
rlm_sql (sql): starting 11
rlm_sql (sql): Attempting to connect rlm_sql_mysql #11
rlm_sql_mysql: Starting connect to MySQL server for #11
rlm_sql (sql): Connected new DB handle, #11
rlm_sql (sql): starting 12
rlm_sql (sql): Attempting to connect rlm_sql_mysql #12
rlm_sql_mysql: Starting connect to MySQL server for #12
rlm_sql (sql): Connected new DB handle, #12
rlm_sql (sql): starting 13
rlm_sql (sql): Attempting to connect rlm_sql_mysql #13
rlm_sql_mysql: Starting connect to MySQL server for #13
rlm_sql (sql): Connected new DB handle, #13
rlm_sql (sql): starting 14
rlm_sql (sql): Attempting to connect rlm_sql_mysql #14
rlm_sql_mysql: Starting connect to MySQL server for #14
rlm_sql (sql): Connected new DB handle, #14
rlm_sql (sql): starting 15
rlm_sql (sql): Attempting to connect rlm_sql_mysql #15
rlm_sql_mysql: Starting connect to MySQL server for #15
rlm_sql (sql): Connected new DB handle, #15
rlm_sql (sql): starting 16
rlm_sql (sql): Attempting to connect rlm_sql_mysql #16
rlm_sql_mysql: Starting connect to MySQL server for #16
rlm_sql (sql): Connected new DB handle, #16
rlm_sql (sql): starting 17
rlm_sql (sql): Attempting to connect rlm_sql_mysql #17
rlm_sql_mysql: Starting connect to MySQL server for #17
rlm_sql (sql): Connected new DB handle, #17
rlm_sql (sql): starting 18
rlm_sql (sql): Attempting to connect rlm_sql_mysql #18
rlm_sql_mysql: Starting connect to MySQL server for #18
rlm_sql (sql): Connected new DB handle, #18
rlm_sql (sql): starting 19
rlm_sql (sql): Attempting to connect rlm_sql_mysql #19
rlm_sql_mysql: Starting connect to MySQL server for #19
rlm_sql (sql): Connected new DB handle, #19
rlm_sql (sql): starting 20
rlm_sql (sql): Attempting to connect rlm_sql_mysql #20
rlm_sql_mysql: Starting connect to MySQL server for #20
rlm_sql (sql): Connected new DB handle, #20
rlm_sql (sql): starting 21
rlm_sql (sql): Attempting to connect rlm_sql_mysql #21
rlm_sql_mysql: Starting connect to MySQL server for #21
rlm_sql (sql): Connected new DB handle, #21
rlm_sql (sql): starting 22
rlm_sql (sql): Attempting to connect rlm_sql_mysql #22
rlm_sql_mysql: Starting connect to MySQL server for #22
rlm_sql (sql): Connected new DB handle, #22
rlm_sql (sql): starting 23
rlm_sql (sql): Attempting to connect rlm_sql_mysql #23
rlm_sql_mysql: Starting connect to MySQL server for #23
rlm_sql (sql): Connected new DB handle, #23
rlm_sql (sql): starting 24
rlm_sql (sql): Attempting to connect rlm_sql_mysql #24
rlm_sql_mysql: Starting connect to MySQL server for #24
rlm_sql (sql): Connected new DB handle, #24
Module: Checking preacct {...} for more modules to load
Module: Linked to module rlm_acct_unique
Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique
acct_unique {
key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port"
}
Module: Checking accounting {...} for more modules to load
Module: Linked to module rlm_detail
Module: Instantiating module "detail" from file /etc/freeradius/modules/detail
detail {
detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
detailperm = 384
dirperm = 493
locking = no
log_packet_header = no
}
Module: Linked to module rlm_radutmp
Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp
radutmp {
filename = "/var/log/freeradius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
perm = 384
callerid = yes
}
Module: Linked to module rlm_attr_filter
Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter
attr_filter attr_filter.accounting_response {
attrsfile = "/etc/freeradius/attrs.accounting_response"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /etc/freeradius/attrs.accounting_response
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter
attr_filter attr_filter.access_reject {
attrsfile = "/etc/freeradius/attrs.access_reject"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /etc/freeradius/attrs.access_reject
} # modules
} # server
server status { # from file /etc/freeradius/sites-enabled/status
modules {
Module: Creating Autz-Type = Status-Server
Module: Checking authorize {...} for more modules to load
Module: Linked to module rlm_always
Module: Instantiating module "ok" from file /etc/freeradius/modules/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
} # modules
} # server
server dynamic_client_server { # from file /etc/freeradius/sites-enabled/inav-dynclients
modules {
Module: Checking authorize {...} for more modules to load
} # modules
} # server
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
modules {
Module: Checking authenticate {...} for more modules to load
Module: Checking authorize {...} for more modules to load
Module: Checking session {...} for more modules to load
Module: Checking post-proxy {...} for more modules to load
Module: Checking post-auth {...} for more modules to load
} # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
}
listen {
type = "acct"
ipaddr = *
port = 0
}
listen {
type = "control"
listen {
socket = "/var/run/freeradius/freeradius.sock"
}
}
listen {
type = "status"
ipaddr = 127.0.0.1
port = 18121
client admin {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = "secret"
}
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
... adding new socket proxy address * port 44008
... adding new socket proxy address * port 44894
... adding new socket proxy address * port 40436
... adding new socket proxy address * port 35552
... adding new socket proxy address * port 59182
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/freeradius/freeradius.sock
Listening on status address 127.0.0.1 port 18121 as server status
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=21, length=162
server dynamic_client_server {
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_sql (sql): Reserving sql socket id: 24
rlm_sql (sql): Released sql socket id: 24
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_sql (sql): Reserving sql socket id: 23
rlm_sql (sql): Released sql socket id: 23
rlm_raw: Called-Station-Id = 14-CC-20-5A-81-60:Test802.1x
rlm_sql (sql): Reserving sql socket id: 22
rlm_sql (sql): Released sql socket id: 22
} # server dynamic_client_server
- Added client 18.15.2.96 with shared secret wpa01
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=21, length=162
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x0267000e01575041544553543031
Message-Authenticator = 0x23e19f9af7e17d88f9a44dc2a43a30f8
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 103 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] expand: %{Stripped-User-Name} -> WPATEST01
[sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 21
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority
rlm_sql (sql): Released sql socket id: 21
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 21 to 18.15.2.96 port 39821
EAP-Message = 0x016800061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa8b8feaec49bb7390043eac56
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=22, length=374
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026800d01980000000c616030100c1010000bd0301c710875ecf8c341d7c1945550fbc4239200d59aaaff94bf25a57da64ae6f6db5000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011
State = 0x8be7f3fa8b8feaec49bb7390043eac56
Message-Authenticator = 0x6f447c173ae2e57d28738de915aa2076
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 104 length 208
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0a44], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 22 to 18.15.2.96 port 39821
EAP-Message = 0x0169040019c000000a8816030100310200002d03015602b0867fde8c9987d87d8b8f834e9f2d369fc1ea7b1ab97c09196b5f116ab6000035000005ff010001001603010a440b000a40000a3d0004fb308204f7308203dfa003020102020101300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a060355040313
EAP-Message = 0x23496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323031335a170d3235303930363133323031335a307c310b300906035504061302495431123010060355040813094c6f6d626172646961311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3110300e06035504031307465220636572743128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100a4afeca0af0c867558f514da8309f7cf1a2a772738c3c0e0fd9e
EAP-Message = 0x4b83717de37e6fc95c6a00afc83ccd3d5a980c6ae732fccd004aea22afa08826f1419e012553054eafa018dd201f6591a5c5a78da76010fe30d1dd1d28956bb7f393b2ca66373f34cf3a2eebd81854ef8173eb801b149c209808a871a16ad279ef8f08b849eafb80f129a4010e1a4f7617168edfcec40dd4a1a928a06205fe85f7f25234b8f1947beaf29be481dc8719d38294c81ef9f6e42cc223286a3edeb4b5fe9eb064e9cce2e7d79eb9a0c95534553c89b7567e311602900011fb6a9227b85b191ebcd3fa152f7bd504f4bc862b551b7661f07b0de5c543c6e3d2c24f086b3c96e92c56970250840eff1d261e29ec8109f75c4d198a5115612101
EAP-Message = 0x884de35e51d349512874a73ff8ea1fcf390035ac5d044dfa2fce3f77979b61f634cf228ab9fa28680adad86952c50bf05730bc9b73c9cbdec210659b3e6bfc738797f810c6c0203159805b0e0f3d87a86c62ba7800fa3a30e7c2d2c506a47a88b13970f2fbf2cf5a0b64a601a8f5ffb640a6368f95fe21e793c5ce64b48130365cdbd3c190c21829ee4823667e607f18d251bc214251bf1b16f290644f14b590757500b694266a81ee784bd55472eb6e9a052daf4328f30b973adabcd8913fedd1140e7b8fdd7f81f4ea429393cd685cd9d50fa9f6028493c7b0cf2b4ce8fc87801ffa2becde0be62d0203010001a34f304d30130603551d25040c300a
EAP-Message = 0x06082b060105050703013036
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa8a8eeaec49bb7390043eac56
Finished request 1.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=23, length=172
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026900061900
State = 0x8be7f3fa8a8eeaec49bb7390043eac56
Message-Authenticator = 0xdf899447a17ff487fd72c74230d2b448
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 105 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 23 to 18.15.2.96 port 39821
EAP-Message = 0x016a03fc19400603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010063fd16c3ec75c7e00d8e15c07929d20f75430b2ae796be3bea47ee94075f94c69ab384cd359b73f0e9f70040e5fddf7075c62cefd4f9ec416ea544105b9ee1b179a2c66c99adfeea1dc55b8f7a50c2619bfb22b8ef5a081c8a9c821bf7d609b3aea8c7dce6e8a936a98c29ebb1e9e8e3ec8ff98e62429c0a536d56f1829229c9f1cc73a9420a8babc7e090472b91b7899c898df93e1f180ed2d4e10c07e7ae2b15d56f86c425928e929c1df694
EAP-Message = 0x8481a70cfeee2a035fa1dd513cab51319b11cdcae1e0947348a89905694c65c9d81cc8372ba4ad15f78e6f05c7eee90a9b4c47542f401ccc646d97460f6fd51ae316718406630f8999c30f80f01dc3c7f3130300053c3082053830820420a003020102020900f36684f36b9057e7300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172
EAP-Message = 0x652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323030385a170d3235303930363133323030385a3081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520
EAP-Message = 0x417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d2da114e3c65d1a6d5af105f21e12a6e10f8f563bef1dcc697bdb47d41e2382bcbc78e661170ca75c488a79f17bf9b3917b41779c6f7c5c76bbb34d8c00bbfc4cdcac10131216d120495fbd475275adfcb950c447f0e70852120760b6fc3979fb810fdd0af3d6b611317c3f2582abb6bad7c320fac36317c011027908fdb8ae803abaed0ac8b2d03c5fe313ccec14845a7818a1c13b83646b8f4a5ae2cd0d745b7d65dbd9bb81dc3a861caa48bd67e5a02aa0445e01c5c19667b466077d9fb4100f58f78b149288459cc16ae484cebed6891ba
EAP-Message = 0x3b5d949a7f258f97
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa898deaec49bb7390043eac56
Finished request 2.
Going to the next request
Waking up in 4.7 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=24, length=172
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026a00061900
State = 0x8be7f3fa898deaec49bb7390043eac56
Message-Authenticator = 0xa440bf143ec9e6c26c28d8391d02a978
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 106 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 24 to 18.15.2.96 port 39821
EAP-Message = 0x016b02a21900f2a1fd1b024e31eda43d00c39a8957a21d16c384ba6f1c63be668c3abc95085b6bb71ec2690203010001a38201513082014d301d0603551d0e04160414279a85d9f9cf9f8457de3c73852d320e2db97dcf3081e50603551d230481dd3081da8014279a85d9f9cf9f8457de3c73852d320e2db97dcfa181b6a481b33081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e6176
EAP-Message = 0x69676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479820900f36684f36b9057e7300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010042885b349b6b9cd176de3c166109cac40e03a3e01a0b4c6dada2fdea3d768ec6d05499cceeb5c12840ec273d6294187f5951580755b89f4373e0b8cdea5c03709356e7e3f452faaca711084daa283d4a4fca87a13fa6c956eac1a34a1e2e22e0dc
EAP-Message = 0x67c494914cca1cf6973b176665a630e5488c37707f1cdfe6ee4e43dfac65c13556df847fdc301f2ae0d71740ec3ad962f623e53865c510ab3f67f4c9d3fce9051610882c4244ec103dbd379e8e5dfc7a53dd4d839a6ee2d248e70ed1e69d1bfc77e1f2efd78b016f30ac2d6da9c9ac01366b69f6248f737463b9634ecb9b512dcd9e13cfe4683a57f5fedc49b98ce2d0dbb37b4e6627dd804f7a543a6680e416030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa888ceaec49bb7390043eac56
Finished request 3.
Going to the next request
Waking up in 4.6 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=25, length=762
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026b02501980000002461603010206100002020200044154ee5dd5a7a703e9a12246cfaf05f8f9073178356fc1089cab52609e78c805911540cd4cdc68c9761b6d41af05104b84b2f38bda64b0e52bc0d10ed64ad35fe3920fa5c6030cfa66d7dc25a24e324417dea12829de39425719faa49e2c5927a1db68e3e99198c03b93943afdcd0654371c7e8aa886ea996d00fa2d9ae830c01dee85cd42f979cb6af349a59deff53c74808fced7d6864691b43fb1a6eacded1baacb6d31837839c192276f32c8cf9fbabcd78d502d8310064daeb9a8d59406b192bc8608e49212b18a633f0da2ed355bb0b3e305ea6251dc200c7ec9dd88303e9fefca7822f5
EAP-Message = 0xc7dde6ae460a4e8697cee9d1a918f0b3498c8255373ab7cc8231f412a3a0665ffed1b065e0e76d5b4d118f7c8a2e17c7d9d5b0e800fe23332c993fdc6345cd79946f5f857569b6720e4c7a0cd36844f3a5e234c520cdb806d73530b724fafc3a0eda613689082a82e57b07e8504fb3c1a14b184a45ffd9adc5f471ab23e20192e8859fcdc99ca43e552f55876f6abc4cee8ce181cfcd576f36dc83a2bf5a8a33dfec51b746b8ea8ede9696a9502d236ed7fd98de7a2cdccf401ea51749874c1ad692dc9ef19400fa2857d7ba35c1dd0a1acdab294c7a80aa049e4bd1721fb1df2bae7d0026b89c1fe69e895f6ac2d04911a15be0014da0ed395f8bda60
EAP-Message = 0xea725490158670bfbcb30938a730dce3245c941ebb75ac8c6f8f331403010001011603010030deca47943704a7bbbb320eaba31d4658446217d4e3b2dea8c317d20463d241a76a5e5fe208b72b2bab182ce6d49c128f
State = 0x8be7f3fa888ceaec49bb7390043eac56
Message-Authenticator = 0x4c10f7b2c345b19e8e590332a99b4dcf
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 107 length 253
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 582
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 25 to 18.15.2.96 port 39821
EAP-Message = 0x016c004119001403010001011603010030b756af8e04ec1177da7cdba3a8e46ce9c9a03753f3ed6de7041c7851249ba593ad8e4ca087a8a12e0c0837eef32ef7e2
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa8f8beaec49bb7390043eac56
Finished request 4.
Going to the next request
Waking up in 4.5 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=26, length=172
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026c00061900
State = 0x8be7f3fa8f8beaec49bb7390043eac56
Message-Authenticator = 0x7f95d93bb8a3e3680d805e01ef24c433
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 108 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 26 to 18.15.2.96 port 39821
EAP-Message = 0x016d002b19001703010020e0a71dcaf1dd947689d81035169b60f8edc2f23a6d623dc0b5bf36882e084778
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa8e8aeaec49bb7390043eac56
Finished request 5.
Going to the next request
Waking up in 4.4 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=27, length=209
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026d002b19001703010020e6c9ea37a34dcf8b44c72525c4da21e5ed75a845d5936b83fef1f2be29ae9a5f
State = 0x8be7f3fa8e8aeaec49bb7390043eac56
Message-Authenticator = 0x9de3d03912efbbc6f557c3db393fdee9
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 109 length 43
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - WPATEST01
[peap] Got inner identity 'WPATEST01'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
EAP-Message = 0x026d000e01575041544553543031
server {
[peap] Setting User-Name to WPATEST01
Sending tunneled request
EAP-Message = 0x026d000e01575041544553543031
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "WPATEST01"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+group authorize {
++[chap] = noop
++[mschap] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
++update control {
++} # update control = noop
[eap] EAP packet type response id 109 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] expand: %{Stripped-User-Name} -> WPATEST01
[sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 20
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority
rlm_sql (sql): Released sql socket id: 20
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+group authenticate {
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] = handled
+} # group authenticate = handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
EAP-Message = 0x016e00231a016e001e101e157a2b3c0548f7806819a21b8d5ada575041544553543031
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x82d2aee482bcb4d70ca1911950ec56f8
[peap] Got tunneled reply RADIUS code Access-Challenge
EAP-Message = 0x016e00231a016e001e101e157a2b3c0548f7806819a21b8d5ada575041544553543031
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x82d2aee482bcb4d70ca1911950ec56f8
[peap] Got tunneled Access-Challenge
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 27 to 18.15.2.96 port 39821
EAP-Message = 0x016e004b19001703010040935a24ed0f4bae1413743c3c1b8465b26dce8b4e54d8733277feea035324317e2359d7b7a04e62922331707504ccc06ecb0e5a117f1db024426116e552088fa7
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa8d89eaec49bb7390043eac56
Finished request 6.
Going to the next request
Waking up in 4.3 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=28, length=273
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026e006b190017030100601e1924cddad42e5f82e6baceca61075e4f50cbdfcc6f32c3e34a99e966a2d6b85f427bf719dd9586019ab5eead1ad7daf21012855f3143d8d8bc338271dec31828a34ce5924e2b0a8c9668c9d67f719f7466cbfd25edb67b411f2c76e6384501
State = 0x8be7f3fa8d89eaec49bb7390043eac56
Message-Authenticator = 0x7a4043ef634f9bdb61136f3fd92a28af
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 110 length 107
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
EAP-Message = 0x026e00441a026e003f31c1fb03eebb1e5a69819119a42d8d19e90000000000000000d8dc46e58ebd8bd1bf2ddce64ed8debcdb8284b445e8e24900575041544553543031
server {
[peap] Setting User-Name to WPATEST01
Sending tunneled request
EAP-Message = 0x026e00441a026e003f31c1fb03eebb1e5a69819119a42d8d19e90000000000000000d8dc46e58ebd8bd1bf2ddce64ed8debcdb8284b445e8e24900575041544553543031
FreeRADIUS-Proxied-To = 127.0.0.1
User-Name = "WPATEST01"
State = 0x82d2aee482bcb4d70ca1911950ec56f8
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+group authorize {
++[chap] = noop
++[mschap] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
++update control {
++} # update control = noop
[eap] EAP packet type response id 110 length 68
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] expand: %{Stripped-User-Name} -> WPATEST01
[sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 19
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority
rlm_sql (sql): Released sql socket id: 19
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +group MS-CHAP {
[mschap] No Cleartext-Password configured. Cannot create LM-Password.
[mschap] No Cleartext-Password configured. Cannot create NT-Password.
[mschap] Creating challenge hash with username: WPATEST01
[mschap] Client is using MS-CHAPv2 for WPATEST01, we need NT-Password
[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.
[mschap] FAILED: MS-CHAP2-Response is incorrect
++[mschap] = reject
+} # group MS-CHAP = reject
[eap] Freeing handler
++[eap] = reject
+} # group authenticate = reject
Failed to authenticate the user.
Using Post-Auth-Type REJECT
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+group REJECT {
[attr_filter.access_reject] expand: %{User-Name} -> WPATEST01
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
} # server inner-tunnel
[peap] Got tunneled reply code 3
MS-CHAP-Error = "nE=691 R=1"
EAP-Message = 0x046e0004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code Access-Reject
MS-CHAP-Error = "nE=691 R=1"
EAP-Message = 0x046e0004
Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 28 to 18.15.2.96 port 39821
EAP-Message = 0x016f002b19001703010020657b2b2cba09fec9c74376a57473e880bfa77238cbbeff27c1343c2263eca983
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x8be7f3fa8c88eaec49bb7390043eac56
Finished request 7.
Going to the next request
Waking up in 4.2 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=29, length=209
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x026f002b19001703010020ec79e2545ad2b1cfe636917063ef7b711f0fa14c6d8457b069aa058c5906bb8a
State = 0x8be7f3fa8c88eaec49bb7390043eac56
Message-Authenticator = 0x3fb015ef305a7eac9cb158c63a9b3d9d
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 111 length 43
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established. Decoding tunneled attributes.
[peap] Peap state send tlv failure
[peap] Received EAP-TLV response.
[peap] The users session was previously rejected: returning reject (again.)
[peap] *** This means you need to read the PREVIOUS messages in the debug output
[peap] *** to find out the reason why the user was rejected.
[peap] *** Look for "reject" or "fail". Those earlier messages will tell you.
[peap] *** what went wrong, and how to fix the problem.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] = invalid
+} # group authenticate = invalid
Failed to authenticate the user.
Using Post-Auth-Type REJECT
# Executing group from file /etc/freeradius/sites-enabled/default
+group REJECT {
[attr_filter.access_reject] expand: %{User-Name} -> WPATEST01
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] = updated
+} # group REJECT = updated
Delaying reject of request 8 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 8
Sending Access-Reject of id 29 to 18.15.2.96 port 39821
EAP-Message = 0x046f0004
Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.2 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=30, length=162
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x0223000e01575041544553543031
Message-Authenticator = 0x87cd6a9e4c9564d7e3ed4521d116b50b
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 35 length 14
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] = updated
++[files] = noop
[sql] expand: %{Stripped-User-Name} -> WPATEST01
[sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> WPATEST01
[sql] sql_set_user escaped user --> 'WPATEST01'
rlm_sql (sql): Reserving sql socket id: 18
[sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'WPATEST01' ORDER BY id
[sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'WPATEST01' ORDER BY priority
rlm_sql (sql): Released sql socket id: 18
[sql] User WPATEST01 not found
++[sql] = notfound
++[expiration] = noop
++[logintime] = noop
[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
++[pap] = noop
+} # group authorize = updated
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 30 to 18.15.2.96 port 39821
EAP-Message = 0x012400061920
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9aa5a94f9a81b08af2138422daf6c105
Finished request 9.
Going to the next request
Waking up in 0.5 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=31, length=374
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x022400d01980000000c616030100c1010000bd0301f3bda01eda9f2d175e6217aa9d9da118a9134dfc2ce3144cf19c790fb65f7de0000054c014c00ac022c02100390038c00fc0050035c012c008c01cc01b00160013c00dc003000ac013c009c01fc01e00330032c00ec004002fc011c007c00cc002000500040015001200090014001100080006000300ff01000040000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f00100011
State = 0x9aa5a94f9a81b08af2138422daf6c105
Message-Authenticator = 0x2154e0dfbfe0c524d846bbbe4d9f8c3e
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 36 length 208
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] (other): before/accept initialization
[peap] TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 00c1], ClientHello
[peap] TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello
[peap] TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 0a44], Certificate
[peap] TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap] TLS_accept: SSLv3 write server done A
[peap] TLS_accept: SSLv3 flush data
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
[peap] TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 31 to 18.15.2.96 port 39821
EAP-Message = 0x0125040019c000000a8816030100310200002d03015602b08a76325520a8c3e5889521fef23ce8edf0c8f14f225469b1157c6b6aae000035000005ff010001001603010a440b000a40000a3d0004fb308204f7308203dfa003020102020101300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a060355040313
EAP-Message = 0x23496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323031335a170d3235303930363133323031335a307c310b300906035504061302495431123010060355040813094c6f6d626172646961311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3110300e06035504031307465220636572743128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d30820222300d06092a864886f70d01010105000382020f003082020a0282020100a4afeca0af0c867558f514da8309f7cf1a2a772738c3c0e0fd9e
EAP-Message = 0x4b83717de37e6fc95c6a00afc83ccd3d5a980c6ae732fccd004aea22afa08826f1419e012553054eafa018dd201f6591a5c5a78da76010fe30d1dd1d28956bb7f393b2ca66373f34cf3a2eebd81854ef8173eb801b149c209808a871a16ad279ef8f08b849eafb80f129a4010e1a4f7617168edfcec40dd4a1a928a06205fe85f7f25234b8f1947beaf29be481dc8719d38294c81ef9f6e42cc223286a3edeb4b5fe9eb064e9cce2e7d79eb9a0c95534553c89b7567e311602900011fb6a9227b85b191ebcd3fa152f7bd504f4bc862b551b7661f07b0de5c543c6e3d2c24f086b3c96e92c56970250840eff1d261e29ec8109f75c4d198a5115612101
EAP-Message = 0x884de35e51d349512874a73ff8ea1fcf390035ac5d044dfa2fce3f77979b61f634cf228ab9fa28680adad86952c50bf05730bc9b73c9cbdec210659b3e6bfc738797f810c6c0203159805b0e0f3d87a86c62ba7800fa3a30e7c2d2c506a47a88b13970f2fbf2cf5a0b64a601a8f5ffb640a6368f95fe21e793c5ce64b48130365cdbd3c190c21829ee4823667e607f18d251bc214251bf1b16f290644f14b590757500b694266a81ee784bd55472eb6e9a052daf4328f30b973adabcd8913fedd1140e7b8fdd7f81f4ea429393cd685cd9d50fa9f6028493c7b0cf2b4ce8fc87801ffa2becde0be62d0203010001a34f304d30130603551d25040c300a
EAP-Message = 0x06082b060105050703013036
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9aa5a94f9b80b08af2138422daf6c105
Finished request 10.
Going to the next request
Waking up in 0.4 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=32, length=172
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x022500061900
State = 0x9aa5a94f9b80b08af2138422daf6c105
Message-Authenticator = 0xc30fd4d1c8fbe3b53ad945b481066afc
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 37 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 32 to 18.15.2.96 port 39821
EAP-Message = 0x012603fc19400603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010063fd16c3ec75c7e00d8e15c07929d20f75430b2ae796be3bea47ee94075f94c69ab384cd359b73f0e9f70040e5fddf7075c62cefd4f9ec416ea544105b9ee1b179a2c66c99adfeea1dc55b8f7a50c2619bfb22b8ef5a081c8a9c821bf7d609b3aea8c7dce6e8a936a98c29ebb1e9e8e3ec8ff98e62429c0a536d56f1829229c9f1cc73a9420a8babc7e090472b91b7899c898df93e1f180ed2d4e10c07e7ae2b15d56f86c425928e929c1df694
EAP-Message = 0x8481a70cfeee2a035fa1dd513cab51319b11cdcae1e0947348a89905694c65c9d81cc8372ba4ad15f78e6f05c7eee90a9b4c47542f401ccc646d97460f6fd51ae316718406630f8999c30f80f01dc3c7f3130300053c3082053830820420a003020102020900f36684f36b9057e7300d06092a864886f70d01010505003081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172
EAP-Message = 0x652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479301e170d3135303930393133323030385a170d3235303930363133323030385a3081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e617669676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520
EAP-Message = 0x417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100d2da114e3c65d1a6d5af105f21e12a6e10f8f563bef1dcc697bdb47d41e2382bcbc78e661170ca75c488a79f17bf9b3917b41779c6f7c5c76bbb34d8c00bbfc4cdcac10131216d120495fbd475275adfcb950c447f0e70852120760b6fc3979fb810fdd0af3d6b611317c3f2582abb6bad7c320fac36317c011027908fdb8ae803abaed0ac8b2d03c5fe313ccec14845a7818a1c13b83646b8f4a5ae2cd0d745b7d65dbd9bb81dc3a861caa48bd67e5a02aa0445e01c5c19667b466077d9fb4100f58f78b149288459cc16ae484cebed6891ba
EAP-Message = 0x3b5d949a7f258f97
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9aa5a94f9883b08af2138422daf6c105
Finished request 11.
Going to the next request
Waking up in 0.3 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=33, length=172
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x022600061900
State = 0x9aa5a94f9883b08af2138422daf6c105
Message-Authenticator = 0xec9b1d5c4dc6e45d991d320069e814e2
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 38 length 6
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 33 to 18.15.2.96 port 39821
EAP-Message = 0x012702a21900f2a1fd1b024e31eda43d00c39a8957a21d16c384ba6f1c63be668c3abc95085b6bb71ec2690203010001a38201513082014d301d0603551d0e04160414279a85d9f9cf9f8457de3c73852d320e2db97dcf3081e50603551d230481dd3081da8014279a85d9f9cf9f8457de3c73852d320e2db97dcfa181b6a481b33081b0310b300906035504061302495431123010060355040813094c6f6d626172646961311630140603550407130d42756c6761726f67726173736f311d301b060355040a1314496e7465726e6176696761726520532e722e6c2e3128302606092a864886f70d0109011619686f7473706f7440696e7465726e6176
EAP-Message = 0x69676172652e636f6d312c302a06035504031323496e7465726e6176696761726520436572746966696361746520417574686f72697479820900f36684f36b9057e7300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d0101050500038201010042885b349b6b9cd176de3c166109cac40e03a3e01a0b4c6dada2fdea3d768ec6d05499cceeb5c12840ec273d6294187f5951580755b89f4373e0b8cdea5c03709356e7e3f452faaca711084daa283d4a4fca87a13fa6c956eac1a34a1e2e22e0dc
EAP-Message = 0x67c494914cca1cf6973b176665a630e5488c37707f1cdfe6ee4e43dfac65c13556df847fdc301f2ae0d71740ec3ad962f623e53865c510ab3f67f4c9d3fce9051610882c4244ec103dbd379e8e5dfc7a53dd4d839a6ee2d248e70ed1e69d1bfc77e1f2efd78b016f30ac2d6da9c9ac01366b69f6248f737463b9634ecb9b512dcd9e13cfe4683a57f5fedc49b98ce2d0dbb37b4e6627dd804f7a543a6680e416030100040e000000
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9aa5a94f9982b08af2138422daf6c105
Finished request 12.
Going to the next request
Waking up in 0.2 seconds.
rad_recv: Access-Request packet from host 18.15.2.96 port 39821, id=34, length=762
User-Name = "WPATEST01"
NAS-IP-Address = 192.168.1.29
Called-Station-Id = "14-CC-20-5A-81-60:Test802.1x"
NAS-Port-Type = Wireless-802.11
NAS-Port = 1
Calling-Station-Id = "C4-9A-02-0F-0C-36"
Connect-Info = "CONNECT 54Mbps 802.11g"
Framed-MTU = 1400
EAP-Message = 0x0227025019800000024616030102061000020202005b95bea6ad27a5e0714d0a929aa0614eb79efdbf330b5dc7b4e576245920e7e7788b1e49c90b470df73b080522f3e87a092989bb4cb1b08141242e5553956d9ce7bae1edd6caa72d38e1e71fc0c31537d34416e61896f526bb6f3e54806c82be09b677c195e0370d457508cd4645da3d36aa49694bd823d558bd2147791952a3591d94e237ea064c239aca10491bb42aac6189fee8ca802e0696dc6a449b6aaa05c05743c44b04b9001f0e44afec187c5ced8b874348b049f59d66e60df7677a2ded62f36b79c3402b992e26db94af11d24838af81cc8f0909288de9f422640715f986aebb733c00
EAP-Message = 0x61407139a59d56bd2b6ff25184b217953d5d9f09a30bb08b36b1c916efd50b5eac799aee9f2219340c8e6742b188fee88dfe45c6cc99ad8e6cd76b7d0aaf6479ffff78b34600b30707c548b73d317366a646bd2a5949a70029f78fe114b2743fb87858eec21eaa1ddfa7e5ce24c7142d1f792e0a34c9429259638bcd82624f9a714a7a08458b09e15f8ebb526c2801ad411f4e0698d8ee5420b4189d69869ded275996a499f3e83fed4d10f99de7c901b83642e301ae1abba4be4496579ca775779b6e47ee2bf32c5886048304b939a857547e02363ce1acd662832bba56a8eae2dcbe0c56d4bf7209599240699b678fefdc0b1b8dab4c7e2febaae634
EAP-Message = 0x139d2a88fef4f660cc7ff33c613d0ff82945ee2a1c0b3fefdb070714030100010116030100305fb335cd650dee58c3d0e72bcd2cebaf2ad9be9771711d8f711b5dd5e3af7deb8ac4ce2d6525a06abd5a50e3b7233291
State = 0x9aa5a94f9982b08af2138422daf6c105
Message-Authenticator = 0x2a906c40a10f593908e3b85e32b9f718
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+group authorize {
++[preprocess] = ok
++[chap] = noop
++[mschap] = noop
++[digest] = noop
[suffix] No '@' in User-Name = "WPATEST01", looking up realm NULL
[suffix] Found realm "NULL"
[suffix] Adding Stripped-User-Name = "WPATEST01"
[suffix] Adding Realm = "NULL"
[suffix] Authentication realm is LOCAL.
++[suffix] = ok
[eap] EAP packet type response id 39 length 253
[eap] Continuing tunnel setup.
++[eap] = ok
+} # group authorize = ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+group authenticate {
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
TLS Length 582
[peap] Length Included
[peap] eaptls_verify returned 11
[peap] <<< TLS 1.0 Handshake [length 0206], ClientKeyExchange
[peap] TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap] TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap] TLS_accept: SSLv3 write finished A
[peap] TLS_accept: SSLv3 flush data
[peap] (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] = handled
+} # group authenticate = handled
Sending Access-Challenge of id 34 to 18.15.2.96 port 39821
EAP-Message = 0x012800411900140301000101160301003070615ca22fe998758237eba6df7204ae366aa0d4d0be6576fe3c8766df683cc749120cdbd7d5c965ed280783bc692e52
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x9aa5a94f9e8db08af2138422daf6c105
Finished request 13.
Going to the next request
Waking up in 0.1 seconds.
--
Lorenzo Milesi - lorenzo.milesi at yetopen.it
YetOpen S.r.l. - http://www.yetopen.it/
More information about the Freeradius-Users
mailing list