I have a problem with the authorization by LDAP and Authentication with AD
I Aaaaaahhhhhh
iaaaaaahhhhhh at gmail.com
Mon Jul 31 12:21:19 CEST 2017
Hello,
the Server ist CentOS7.3 with Radius 3.0.15.
The AD Server is a Windows 2012 R2.
The Radius server is integrated into the Active Directory domain.
I would like that only certain users connect to the AD domain.
When I connect to the radius server via eapol_test, the authorization
by LDAP as well as the AD authentication by AD perfectly.
If I want to log on to the AD domain from a Windows 10 client with the
same user account, this does not work.
C5c5 is prepended to the username.
A realm with the domain name and the content skip was created in the
proxy.conf, as well as the ntdomain entry in the sites-enabeld /
default, but the user name still contains C5C5.
Here I add the debug content.
-----
FreeRADIUS Version 3.0.15
Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/raddb/dictionary
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/mods-enabled/
including configuration file /etc/raddb/mods-enabled/always
including configuration file /etc/raddb/mods-enabled/attr_filter
including configuration file /etc/raddb/mods-enabled/cache_eap
including configuration file /etc/raddb/mods-enabled/chap
including configuration file /etc/raddb/mods-enabled/date
including configuration file /etc/raddb/mods-enabled/detail
including configuration file /etc/raddb/mods-enabled/detail.log
including configuration file /etc/raddb/mods-enabled/dhcp
including configuration file /etc/raddb/mods-enabled/digest
including configuration file /etc/raddb/mods-enabled/dynamic_clients
including configuration file /etc/raddb/mods-enabled/eap
including configuration file /etc/raddb/mods-enabled/echo
including configuration file /etc/raddb/mods-enabled/exec
including configuration file /etc/raddb/mods-enabled/expiration
including configuration file /etc/raddb/mods-enabled/expr
including configuration file /etc/raddb/mods-enabled/files
including configuration file /etc/raddb/mods-enabled/linelog
including configuration file /etc/raddb/mods-enabled/logintime
including configuration file /etc/raddb/mods-enabled/mschap
including configuration file /etc/raddb/mods-enabled/ntlm_auth
including configuration file /etc/raddb/mods-enabled/pap
including configuration file /etc/raddb/mods-enabled/passwd
including configuration file /etc/raddb/mods-enabled/preprocess
including configuration file /etc/raddb/mods-enabled/radutmp
including configuration file /etc/raddb/mods-enabled/realm
including configuration file /etc/raddb/mods-enabled/replicate
including configuration file /etc/raddb/mods-enabled/soh
including configuration file /etc/raddb/mods-enabled/sradutmp
including configuration file /etc/raddb/mods-enabled/unix
including configuration file /etc/raddb/mods-enabled/unpack
including configuration file /etc/raddb/mods-enabled/utf8
including configuration file /etc/raddb/mods-enabled/ldap
including files in directory /etc/raddb/policy.d/
including configuration file /etc/raddb/policy.d/abfab-tr
including configuration file /etc/raddb/policy.d/accounting
including configuration file /etc/raddb/policy.d/canonicalization
including configuration file /etc/raddb/policy.d/control
including configuration file /etc/raddb/policy.d/cui
including configuration file /etc/raddb/policy.d/debug
including configuration file /etc/raddb/policy.d/dhcp
including configuration file /etc/raddb/policy.d/eap
including configuration file /etc/raddb/policy.d/filter
including configuration file /etc/raddb/policy.d/moonshot-targeted-ids
including configuration file /etc/raddb/policy.d/operator-name
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/default
including configuration file /etc/raddb/sites-enabled/inner-tunnel
main {
security {
allow_core_dumps = no
}
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
}
main {
name = "radiusd"
prefix = "/usr"
localstatedir = "/var"
sbindir = "/usr/sbin"
logdir = "/var/log/radius"
run_dir = "/var/run/radiusd"
libdir = "/usr/lib64/freeradius"
radacctdir = "/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 16384
pidfile = "/var/run/radiusd/radiusd.pid"
checkrad = "/usr/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
allow_vulnerable_openssl = "yes"
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 20.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 120
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
realm SEDLMEIER {
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.99.2 {
ipaddr = 192.168.99.2
require_message_authenticator = no
secret = <<< secret >>>
shortname = "A4H124-24"
nas_type = "other"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Debugger not attached
systemd watchdog is disabled.
# Creating Auth-Type = ntlm_auth
# Creating Auth-Type = mschap
# Creating Auth-Type = digest
# Creating Auth-Type = eap
# Creating Auth-Type = PAP
# Creating Auth-Type = CHAP
# Creating Auth-Type = MS-CHAP
radiusd: #### Instantiating modules ####
modules {
# Loaded module rlm_always
# Loading module "reject" from file /etc/raddb/mods-enabled/always
always reject {
rcode = "reject"
simulcount = 0
mpp = no
}
# Loading module "fail" from file /etc/raddb/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Loading module "ok" from file /etc/raddb/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Loading module "handled" from file /etc/raddb/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Loading module "invalid" from file /etc/raddb/mods-enabled/always
always invalid {
rcode = "invalid"
simulcount = 0
mpp = no
}
# Loading module "userlock" from file /etc/raddb/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Loading module "notfound" from file /etc/raddb/mods-enabled/always
always notfound {
rcode = "notfound"
simulcount = 0
mpp = no
}
# Loading module "noop" from file /etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Loading module "updated" from file /etc/raddb/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_attr_filter
# Loading module "attr_filter.post-proxy" from file
/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename = "/etc/raddb/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.pre-proxy" from file
/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "/etc/raddb/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
# Loading module "attr_filter.access_reject" from file
/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "/etc/raddb/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.access_challenge" from file
/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "/etc/raddb/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
# Loading module "attr_filter.accounting_response" from file
/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename = "/etc/raddb/mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
# Loaded module rlm_cache
# Loading module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap
cache cache_eap {
driver = "rlm_cache_rbtree"
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
ttl = 15
max_entries = 0
epoch = 0
add_stats = no
}
# Loaded module rlm_chap
# Loading module "chap" from file /etc/raddb/mods-enabled/chap
# Loaded module rlm_date
# Loading module "date" from file /etc/raddb/mods-enabled/date
date {
format = "%b %e %Y %H:%M:%S %Z"
utc = no
}
# Loaded module rlm_detail
# Loading module "detail" from file /etc/raddb/mods-enabled/detail
detail {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "auth_log" from file /etc/raddb/mods-enabled/detail.log
detail auth_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "reply_log" from file /etc/raddb/mods-enabled/detail.log
detail reply_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled/detail.log
detail pre_proxy_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loading module "post_proxy_log" from file /etc/raddb/mods-enabled/detail.log
detail post_proxy_log {
filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_dhcp
# Loading module "dhcp" from file /etc/raddb/mods-enabled/dhcp
# Loaded module rlm_digest
# Loading module "digest" from file /etc/raddb/mods-enabled/digest
# Loaded module rlm_dynamic_clients
# Loading module "dynamic_clients" from file
/etc/raddb/mods-enabled/dynamic_clients
# Loaded module rlm_eap
# Loading module "eap" from file /etc/raddb/mods-enabled/eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
cisco_accounting_username_bug = no
max_sessions = 16384
}
# Loaded module rlm_exec
# Loading module "echo" from file /etc/raddb/mods-enabled/echo
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loading module "exec" from file /etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loaded module rlm_expiration
# Loading module "expiration" from file /etc/raddb/mods-enabled/expiration
# Loaded module rlm_expr
# Loading module "expr" from file /etc/raddb/mods-enabled/expr
expr {
safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
}
# Loaded module rlm_files
# Loading module "files" from file /etc/raddb/mods-enabled/files
files {
filename = "/etc/raddb/mods-config/files/authorize"
acctusersfile = "/etc/raddb/mods-config/files/accounting"
preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy"
}
# Loaded module rlm_linelog
# Loading module "linelog" from file /etc/raddb/mods-enabled/linelog
linelog {
filename = "/var/log/radius/linelog"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "This is a log message for %{User-Name}"
reference = "messages.%{%{reply:Packet-Type}:-default}"
}
# Loading module "log_accounting" from file /etc/raddb/mods-enabled/linelog
linelog log_accounting {
filename = "/var/log/radius/linelog-accounting"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
}
# Loaded module rlm_logintime
# Loading module "logintime" from file /etc/raddb/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_mschap
# Loading module "mschap" from file /etc/raddb/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name:-None}
--domain=%{%{mschap:NT-Domain}:-SEDLMEIER}
--challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
passchange {
}
allow_retry = yes
winbind_retry_with_normalised_username = no
}
# Loading module "ntlm_auth" from file /etc/raddb/mods-enabled/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name} --domain=SEDLMEIER
--password=%{User-Password}"
shell_escape = yes
}
# Loaded module rlm_pap
# Loading module "pap" from file /etc/raddb/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_passwd
# Loading module "etc_passwd" from file /etc/raddb/mods-enabled/passwd
passwd etc_passwd {
filename = "/etc/passwd"
format = "*User-Name:Crypt-Password:"
delimiter = ":"
ignore_nislike = no
ignore_empty = yes
allow_multiple_keys = no
hash_size = 100
}
# Loaded module rlm_preprocess
# Loading module "preprocess" from file /etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups"
hints = "/etc/raddb/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
# Loaded module rlm_radutmp
# Loading module "radutmp" from file /etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_realm
# Loading module "IPASS" from file /etc/raddb/mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Loading module "suffix" from file /etc/raddb/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Loading module "realmpercent" from file /etc/raddb/mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Loading module "ntdomain" from file /etc/raddb/mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
# Loaded module rlm_replicate
# Loading module "replicate" from file /etc/raddb/mods-enabled/replicate
# Loaded module rlm_soh
# Loading module "soh" from file /etc/raddb/mods-enabled/soh
soh {
dhcp = yes
}
# Loading module "sradutmp" from file /etc/raddb/mods-enabled/sradutmp
radutmp sradutmp {
filename = "/var/log/radius/sradutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 420
caller_id = no
}
# Loaded module rlm_unix
# Loading module "unix" from file /etc/raddb/mods-enabled/unix
unix {
radwtmp = "/var/log/radius/radwtmp"
}
Creating attribute Unix-Group
# Loaded module rlm_unpack
# Loading module "unpack" from file /etc/raddb/mods-enabled/unpack
# Loaded module rlm_utf8
# Loading module "utf8" from file /etc/raddb/mods-enabled/utf8
# Loaded module rlm_ldap
# Loading module "ldap" from file /etc/raddb/mods-enabled/ldap
ldap {
server = "sed-vm-dc-01.sedlmeier.local"
identity = "CN=Anonymous,CN=Users,DC=sedlmeier,DC=local"
password = <<< secret >>>
sasl {
}
user {
scope = "sub"
access_positive = yes
sasl {
}
}
group {
filter = "(objectClass=posixGroup)"
scope = "sub"
name_attribute = "cn"
membership_attribute = "memberOf"
cacheable_name = no
cacheable_dn = no
}
client {
filter = "(objectClass=radiusClient)"
scope = "sub"
base_dn = "OU=Mitarbeiter,DC=sedlmeier,DC=local"
}
profile {
}
options {
ldap_debug = 40
chase_referrals = yes
rebind = yes
net_timeout = 1
res_timeout = 10
srv_timelimit = 3
idle = 60
probes = 3
interval = 3
}
tls {
start_tls = no
}
}
Creating attribute LDAP-Group
instantiate {
}
# Instantiating module "reject" from file /etc/raddb/mods-enabled/always
# Instantiating module "fail" from file /etc/raddb/mods-enabled/always
# Instantiating module "ok" from file /etc/raddb/mods-enabled/always
# Instantiating module "handled" from file /etc/raddb/mods-enabled/always
# Instantiating module "invalid" from file /etc/raddb/mods-enabled/always
# Instantiating module "userlock" from file /etc/raddb/mods-enabled/always
# Instantiating module "notfound" from file /etc/raddb/mods-enabled/always
# Instantiating module "noop" from file /etc/raddb/mods-enabled/always
# Instantiating module "updated" from file /etc/raddb/mods-enabled/always
# Instantiating module "attr_filter.post-proxy" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject
[/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item
"FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT".
[/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item
"FreeRADIUS-Response-Delay-USec" found in filter list for realm
"DEFAULT".
# Instantiating module "attr_filter.access_challenge" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file
/etc/raddb/mods-enabled/attr_filter
reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response
# Instantiating module "cache_eap" from file /etc/raddb/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
rlm_cache_rbtree) loaded and linked
# Instantiating module "detail" from file /etc/raddb/mods-enabled/detail
# Instantiating module "auth_log" from file /etc/raddb/mods-enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
# Instantiating module "reply_log" from file
/etc/raddb/mods-enabled/detail.log
# Instantiating module "pre_proxy_log" from file
/etc/raddb/mods-enabled/detail.log
# Instantiating module "post_proxy_log" from file
/etc/raddb/mods-enabled/detail.log
# Instantiating module "eap" from file /etc/raddb/mods-enabled/eap
# Linked to sub-module rlm_eap_md5
# Linked to sub-module rlm_eap_leap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
}
tls-config tls-common {
verify_depth = 0
ca_path = "/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/etc/raddb/certs/server.pem"
certificate_file = "/etc/raddb/certs/server.pem"
ca_file = "/etc/raddb/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/etc/raddb/certs/dh"
fragment_size = 1024
include_length = yes
auto_chain = yes
check_crl = no
check_all_crl = no
cipher_list = "DEFAULT"
cipher_server_preference = no
ecdh_curve = "prime256v1"
cache {
enable = no
lifetime = 24
max_entries = 255
}
verify {
skip_if_ocsp_ok = no
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = no
use_tunneled_reply = no
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_eap_type = "mschapv2"
copy_request_to_tunnel = no
use_tunneled_reply = no
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
tls: Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Instantiating module "expiration" from file
/etc/raddb/mods-enabled/expiration
# Instantiating module "files" from file /etc/raddb/mods-enabled/files
reading pairlist file /etc/raddb/mods-config/files/authorize
reading pairlist file /etc/raddb/mods-config/files/accounting
reading pairlist file /etc/raddb/mods-config/files/pre-proxy
# Instantiating module "linelog" from file /etc/raddb/mods-enabled/linelog
# Instantiating module "log_accounting" from file
/etc/raddb/mods-enabled/linelog
# Instantiating module "logintime" from file /etc/raddb/mods-enabled/logintime
# Instantiating module "mschap" from file /etc/raddb/mods-enabled/mschap
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
# Instantiating module "pap" from file /etc/raddb/mods-enabled/pap
# Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
# Instantiating module "preprocess" from file
/etc/raddb/mods-enabled/preprocess
reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /etc/raddb/mods-config/preprocess/hints
# Instantiating module "IPASS" from file /etc/raddb/mods-enabled/realm
# Instantiating module "suffix" from file /etc/raddb/mods-enabled/realm
# Instantiating module "realmpercent" from file /etc/raddb/mods-enabled/realm
# Instantiating module "ntdomain" from file /etc/raddb/mods-enabled/realm
# Instantiating module "ldap" from file /etc/raddb/mods-enabled/ldap
rlm_ldap: libldap vendor: OpenLDAP, version: 20440
accounting {
reference = "%{tolower:type.%{Acct-Status-Type}}"
}
post-auth {
reference = "."
}
rlm_ldap (ldap): Initialising connection pool
pool {
start = 5
min = 3
max = 32
spare = 10
uses = 0
lifetime = 0
cleanup_interval = 30
idle_timeout = 60
retry_delay = 30
spread = no
}
rlm_ldap (ldap): Opening additional connection (0), 1 of 32 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (1), 1 of 31 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (2), 1 of 30 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (3), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
rlm_ldap (ldap): Opening additional connection (4), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/raddb/radiusd.conf
} # server
server default { # from file /etc/raddb/sites-enabled/default
# Loading authenticate {...}
# Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
# Loading preacct {...}
# Loading accounting {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server default
server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel
# Loading authenticate {...}
# Loading authorize {...}
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
# Skipping contents of 'if' as it is always 'false' --
/etc/raddb/sites-enabled/inner-tunnel:333
} # server inner-tunnel
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "auth"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on proxy address * port 33834
Listening on proxy address :: port 42671
Ready to process requests
(0) Received Access-Request Id 73 from 192.168.99.2:56759 to
192.168.99.13:1812 length 217
(0) User-Name = "host/rob-nb-3302.sedlmeier.local"
(0) Service-Type = Framed-User
(0) Called-Station-Id = "D8-84-66-1C-A0-C2"
(0) Calling-Station-Id = "74-2B-62-85-F5-5D"
(0) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(0) NAS-Port = 5
(0) NAS-Port-Id = "fe.1.5"
(0) Framed-MTU = 1500
(0) NAS-Port-Type = Ethernet
(0) EAP-Message =
0x0201002501686f73742f726f622d6e622d333330322e7365646c6d656965722e6c6f63616c
(0) NAS-IP-Address = 0.0.0.0
(0) Message-Authenticator = 0x1fb3f6d070bfcc1f115c0c3ef7304279
(0) # Executing section authorize from file /etc/raddb/sites-enabled/default
(0) authorize {
(0) policy filter_username {
(0) if (&User-Name) {
(0) if (&User-Name) -> TRUE
(0) if (&User-Name) {
(0) if (&User-Name =~ / /) {
(0) if (&User-Name =~ / /) -> FALSE
(0) if (&User-Name =~ /@[^@]*@/ ) {
(0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(0) if (&User-Name =~ /\.\./ ) {
(0) if (&User-Name =~ /\.\./ ) -> FALSE
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(0) if (&User-Name =~ /\.$/) {
(0) if (&User-Name =~ /\.$/) -> FALSE
(0) if (&User-Name =~ /@\./) {
(0) if (&User-Name =~ /@\./) -> FALSE
(0) } # if (&User-Name) = notfound
(0) } # policy filter_username = notfound
(0) [preprocess] = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(0) suffix: No such realm "NULL"
(0) [suffix] = noop
(0) ntdomain: Checking for prefix before "\"
(0) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(0) ntdomain: No such realm "NULL"
(0) [ntdomain] = noop
(0) eap: Peer sent EAP Response (code 2) ID 1 length 37
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_peap to process data
(0) eap_peap: Initiating new EAP-TLS session
(0) eap_peap: [eaptls start] = request
(0) eap: Sending EAP Request (code 1) ID 2 length 6
(0) eap: EAP session adding &reply:State = 0xe102a8b5e100b184
(0) [eap] = handled
(0) } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/raddb/sites-enabled/default
(0) Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 73 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(0) EAP-Message = 0x010200061920
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0xe102a8b5e100b184d77738e9a0e9bb1d
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 74 from 192.168.99.2:56759 to
192.168.99.13:1812 length 368
(1) User-Name = "host/rob-nb-3302.sedlmeier.local"
(1) Service-Type = Framed-User
(1) Called-Station-Id = "D8-84-66-1C-A0-C2"
(1) Calling-Station-Id = "74-2B-62-85-F5-5D"
(1) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(1) NAS-Port = 5
(1) NAS-Port-Id = "fe.1.5"
(1) Framed-MTU = 1500
(1) NAS-Port-Type = Ethernet
(1) State = 0xe102a8b5e100b184d77738e9a0e9bb1d
(1) EAP-Message =
0x020200aa1980000000a0160303009b010000970303597ef38f86bc72036aa032d81d72191d9453345ae162c46870df53732eea4aa100002ec02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0005000401000040000500050100000000000a0008
(1) NAS-IP-Address = 0.0.0.0
(1) Message-Authenticator = 0x38b419601ddc1180666d1ddd50c69009
(1) session-state: No cached attributes
(1) # Executing section authorize from file /etc/raddb/sites-enabled/default
(1) authorize {
(1) policy filter_username {
(1) if (&User-Name) {
(1) if (&User-Name) -> TRUE
(1) if (&User-Name) {
(1) if (&User-Name =~ / /) {
(1) if (&User-Name =~ / /) -> FALSE
(1) if (&User-Name =~ /@[^@]*@/ ) {
(1) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(1) if (&User-Name =~ /\.\./ ) {
(1) if (&User-Name =~ /\.\./ ) -> FALSE
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(1) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(1) if (&User-Name =~ /\.$/) {
(1) if (&User-Name =~ /\.$/) -> FALSE
(1) if (&User-Name =~ /@\./) {
(1) if (&User-Name =~ /@\./) -> FALSE
(1) } # if (&User-Name) = notfound
(1) } # policy filter_username = notfound
(1) [preprocess] = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(1) suffix: No such realm "NULL"
(1) [suffix] = noop
(1) ntdomain: Checking for prefix before "\"
(1) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(1) ntdomain: No such realm "NULL"
(1) [ntdomain] = noop
(1) eap: Peer sent EAP Response (code 2) ID 2 length 170
(1) eap: Continuing tunnel setup
(1) [eap] = ok
(1) } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1) authenticate {
(1) eap: Expiring EAP session with state 0xe102a8b5e100b184
(1) eap: Finished EAP session with state 0xe102a8b5e100b184
(1) eap: Previous EAP request found for state 0xe102a8b5e100b184,
released from the list
(1) eap: Peer sent packet with method EAP PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Continuing EAP-TLS
(1) eap_peap: Peer indicated complete TLS record size will be 160 bytes
(1) eap_peap: Got complete TLS record (160 bytes)
(1) eap_peap: [eaptls verify] = length included
(1) eap_peap: (other): before/accept initialization
(1) eap_peap: TLS_accept: before/accept initialization
(1) eap_peap: <<< recv TLS 1.2 [length 009b]
(1) eap_peap: TLS_accept: SSLv3 read client hello A
(1) eap_peap: >>> send TLS 1.2 [length 0039]
(1) eap_peap: TLS_accept: SSLv3 write server hello A
(1) eap_peap: >>> send TLS 1.2 [length 0910]
(1) eap_peap: TLS_accept: SSLv3 write certificate A
(1) eap_peap: >>> send TLS 1.2 [length 014d]
(1) eap_peap: TLS_accept: SSLv3 write key exchange A
(1) eap_peap: >>> send TLS 1.2 [length 0004]
(1) eap_peap: TLS_accept: SSLv3 write server done A
(1) eap_peap: TLS_accept: SSLv3 flush data
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(1) eap_peap: In SSL Handshake Phase
(1) eap_peap: In SSL Accept mode
(1) eap_peap: [eaptls process] = handled
(1) eap: Sending EAP Request (code 1) ID 3 length 1004
(1) eap: EAP session adding &reply:State = 0xe102a8b5e001b184
(1) [eap] = handled
(1) } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/raddb/sites-enabled/default
(1) Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 74 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(1) EAP-Message =
0x010303ec19c000000aae1603030039020000350303597ef38e2e75a527234143cba2f29969447b46ffca5b869584f926f6ee23572200c03000000dff01000100000b00040300010216030309100b00090c0009090003f7308203f3308202dba003020102020101300d06092a864886f70d01010b050030
(1) Message-Authenticator = 0x00000000000000000000000000000000
(1) State = 0xe102a8b5e001b184d77738e9a0e9bb1d
(1) Finished request
Waking up in 3.9 seconds.
(2) Received Access-Request Id 75 from 192.168.99.2:56759 to
192.168.99.13:1812 length 204
(2) User-Name = "host/rob-nb-3302.sedlmeier.local"
(2) Service-Type = Framed-User
(2) Called-Station-Id = "D8-84-66-1C-A0-C2"
(2) Calling-Station-Id = "74-2B-62-85-F5-5D"
(2) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(2) NAS-Port = 5
(2) NAS-Port-Id = "fe.1.5"
(2) Framed-MTU = 1500
(2) NAS-Port-Type = Ethernet
(2) State = 0xe102a8b5e001b184d77738e9a0e9bb1d
(2) EAP-Message = 0x020300061900
(2) NAS-IP-Address = 0.0.0.0
(2) Message-Authenticator = 0xefc96dba675de7807963c0dfd3423d12
(2) session-state: No cached attributes
(2) # Executing section authorize from file /etc/raddb/sites-enabled/default
(2) authorize {
(2) policy filter_username {
(2) if (&User-Name) {
(2) if (&User-Name) -> TRUE
(2) if (&User-Name) {
(2) if (&User-Name =~ / /) {
(2) if (&User-Name =~ / /) -> FALSE
(2) if (&User-Name =~ /@[^@]*@/ ) {
(2) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(2) if (&User-Name =~ /\.\./ ) {
(2) if (&User-Name =~ /\.\./ ) -> FALSE
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(2) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(2) if (&User-Name =~ /\.$/) {
(2) if (&User-Name =~ /\.$/) -> FALSE
(2) if (&User-Name =~ /@\./) {
(2) if (&User-Name =~ /@\./) -> FALSE
(2) } # if (&User-Name) = notfound
(2) } # policy filter_username = notfound
(2) [preprocess] = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(2) suffix: No such realm "NULL"
(2) [suffix] = noop
(2) ntdomain: Checking for prefix before "\"
(2) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(2) ntdomain: No such realm "NULL"
(2) [ntdomain] = noop
(2) eap: Peer sent EAP Response (code 2) ID 3 length 6
(2) eap: Continuing tunnel setup
(2) [eap] = ok
(2) } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2) authenticate {
(2) eap: Expiring EAP session with state 0xe102a8b5e001b184
(2) eap: Finished EAP session with state 0xe102a8b5e001b184
(2) eap: Previous EAP request found for state 0xe102a8b5e001b184,
released from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: Continuing EAP-TLS
(2) eap_peap: Peer ACKed our handshake fragment
(2) eap_peap: [eaptls verify] = request
(2) eap_peap: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 4 length 1000
(2) eap: EAP session adding &reply:State = 0xe102a8b5e306b184
(2) [eap] = handled
(2) } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /etc/raddb/sites-enabled/default
(2) Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 75 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(2) EAP-Message =
0x010403e8194022518c1dec2cbb2f69d25320c61e68c7f0b7c8b0ae456881bf11f25fb4734527d9e23825158b087c6fd71853cbc94218fa747fbb854f8a6b48583f69cffde05d5cd8c71c2eab8f1cbfd016db9ee4fbfda2bba6b46ea1587e1118771bad825657998f00050c30820508308203f0a0030201
(2) Message-Authenticator = 0x00000000000000000000000000000000
(2) State = 0xe102a8b5e306b184d77738e9a0e9bb1d
(2) Finished request
Waking up in 3.9 seconds.
(3) Received Access-Request Id 76 from 192.168.99.2:56759 to
192.168.99.13:1812 length 204
(3) User-Name = "host/rob-nb-3302.sedlmeier.local"
(3) Service-Type = Framed-User
(3) Called-Station-Id = "D8-84-66-1C-A0-C2"
(3) Calling-Station-Id = "74-2B-62-85-F5-5D"
(3) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(3) NAS-Port = 5
(3) NAS-Port-Id = "fe.1.5"
(3) Framed-MTU = 1500
(3) NAS-Port-Type = Ethernet
(3) State = 0xe102a8b5e306b184d77738e9a0e9bb1d
(3) EAP-Message = 0x020400061900
(3) NAS-IP-Address = 0.0.0.0
(3) Message-Authenticator = 0xc72bebe3d29dc863209b5cd48ee982c0
(3) session-state: No cached attributes
(3) # Executing section authorize from file /etc/raddb/sites-enabled/default
(3) authorize {
(3) policy filter_username {
(3) if (&User-Name) {
(3) if (&User-Name) -> TRUE
(3) if (&User-Name) {
(3) if (&User-Name =~ / /) {
(3) if (&User-Name =~ / /) -> FALSE
(3) if (&User-Name =~ /@[^@]*@/ ) {
(3) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(3) if (&User-Name =~ /\.\./ ) {
(3) if (&User-Name =~ /\.\./ ) -> FALSE
(3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(3) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(3) if (&User-Name =~ /\.$/) {
(3) if (&User-Name =~ /\.$/) -> FALSE
(3) if (&User-Name =~ /@\./) {
(3) if (&User-Name =~ /@\./) -> FALSE
(3) } # if (&User-Name) = notfound
(3) } # policy filter_username = notfound
(3) [preprocess] = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(3) suffix: No such realm "NULL"
(3) [suffix] = noop
(3) ntdomain: Checking for prefix before "\"
(3) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(3) ntdomain: No such realm "NULL"
(3) [ntdomain] = noop
(3) eap: Peer sent EAP Response (code 2) ID 4 length 6
(3) eap: Continuing tunnel setup
(3) [eap] = ok
(3) } # authorize = ok
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3) authenticate {
(3) eap: Expiring EAP session with state 0xe102a8b5e306b184
(3) eap: Finished EAP session with state 0xe102a8b5e306b184
(3) eap: Previous EAP request found for state 0xe102a8b5e306b184,
released from the list
(3) eap: Peer sent packet with method EAP PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: Continuing EAP-TLS
(3) eap_peap: Peer ACKed our handshake fragment
(3) eap_peap: [eaptls verify] = request
(3) eap_peap: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 5 length 752
(3) eap: EAP session adding &reply:State = 0xe102a8b5e207b184
(3) [eap] = handled
(3) } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) # Executing group from file /etc/raddb/sites-enabled/default
(3) Challenge { ... } # empty sub-section is ignored
(3) Sent Access-Challenge Id 76 from 192.168.99.13:1812 to
192.168.99.2:56759 length 0
(3) EAP-Message =
0x010502f01900260603550403131f5365646c6d6569657220436572746966696361746520417574686f72697479820900b2c4cbf303d91155300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d
(3) Message-Authenticator = 0x00000000000000000000000000000000
(3) State = 0xe102a8b5e207b184d77738e9a0e9bb1d
(3) Finished request
Waking up in 3.9 seconds.
(4) Received Access-Request Id 77 from 192.168.99.2:56760 to
192.168.99.13:1812 length 175
(4) User-Name = "74-2B-62-85-F5-5D"
(4) Service-Type = Framed-User
(4) Called-Station-Id = "D8-84-66-1C-A0-C2"
(4) Calling-Station-Id = "74-2B-62-85-F5-5D"
(4) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(4) NAS-Port = 5
(4) NAS-Port-Type = Ethernet
(4) NAS-Port-Id = "fe.1.5"
(4) NAS-IP-Address = 0.0.0.0
(4) User-Password = "NOPASSWORD"
(4) Message-Authenticator = 0x0beb8902a9e8cbc749b20a3d7d013e57
(4) # Executing section authorize from file /etc/raddb/sites-enabled/default
(4) authorize {
(4) policy filter_username {
(4) if (&User-Name) {
(4) if (&User-Name) -> TRUE
(4) if (&User-Name) {
(4) if (&User-Name =~ / /) {
(4) if (&User-Name =~ / /) -> FALSE
(4) if (&User-Name =~ /@[^@]*@/ ) {
(4) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(4) if (&User-Name =~ /\.\./ ) {
(4) if (&User-Name =~ /\.\./ ) -> FALSE
(4) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(4) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(4) if (&User-Name =~ /\.$/) {
(4) if (&User-Name =~ /\.$/) -> FALSE
(4) if (&User-Name =~ /@\./) {
(4) if (&User-Name =~ /@\./) -> FALSE
(4) } # if (&User-Name) = notfound
(4) } # policy filter_username = notfound
(4) [preprocess] = ok
(4) [chap] = noop
(4) [mschap] = noop
(4) [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(4) suffix: No such realm "NULL"
(4) [suffix] = noop
(4) ntdomain: Checking for prefix before "\"
(4) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(4) ntdomain: No such realm "NULL"
(4) [ntdomain] = noop
(4) eap: No EAP-Message, not doing EAP
(4) [eap] = noop
(4) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Reserved connection (0)
(4) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(4) files: --> (samaccountname=74-2B-62-85-F5-5D)
(4) files: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(4) files: Waiting for search result...
(4) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (5), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(4) files: users: Matched entry DEFAULT at line 48
(4) [files] = ok
rlm_ldap (ldap): Reserved connection (1)
(4) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(4) ldap: --> (samaccountname=74-2B-62-85-F5-5D)
(4) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(4) ldap: Waiting for search result...
(4) ldap: Search returned no results
rlm_ldap (ldap): Released connection (1)
(4) [ldap] = notfound
(4) [expiration] = noop
(4) [logintime] = noop
(4) pap: WARNING: Auth-Type already set. Not setting to PAP
(4) [pap] = noop
(4) } # authorize = ok
(4) Found Auth-Type = Reject
(4) Auth-Type = Reject, rejecting user
(4) Failed to authenticate the user
(4) Using Post-Auth-Type Reject
(4) # Executing group from file /etc/raddb/sites-enabled/default
(4) Post-Auth-Type REJECT {
(4) attr_filter.access_reject: EXPAND %{User-Name}
(4) attr_filter.access_reject: --> 74-2B-62-85-F5-5D
(4) attr_filter.access_reject: Matched entry DEFAULT at line 11
(4) [attr_filter.access_reject] = updated
(4) [eap] = noop
(4) policy remove_reply_message_if_eap {
(4) if (&reply:EAP-Message && &reply:Reply-Message) {
(4) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(4) else {
(4) [noop] = noop
(4) } # else = noop
(4) } # policy remove_reply_message_if_eap = noop
(4) } # Post-Auth-Type REJECT = updated
(4) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(4) Sending delayed response
(4) Sent Access-Reject Id 77 from 192.168.99.13:1812 to
192.168.99.2:56760 length 20
Waking up in 1.0 seconds.
(0) Cleaning up request packet ID 73 with timestamp +28
Waking up in 1.0 seconds.
(1) Cleaning up request packet ID 74 with timestamp +29
(2) Cleaning up request packet ID 75 with timestamp +29
(3) Cleaning up request packet ID 76 with timestamp +29
Waking up in 1.9 seconds.
(4) Cleaning up request packet ID 77 with timestamp +31
Ready to process requests
(5) Received Access-Request Id 78 from 192.168.99.2:56761 to
192.168.99.13:1812 length 334
(5) User-Name = "host/rob-nb-3302.sedlmeier.local"
(5) Service-Type = Framed-User
(5) Called-Station-Id = "D8-84-66-1C-A0-C2"
(5) Calling-Station-Id = "74-2B-62-85-F5-5D"
(5) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(5) NAS-Port = 5
(5) NAS-Port-Id = "fe.1.5"
(5) Framed-MTU = 1500
(5) NAS-Port-Type = Ethernet
(5) State = 0xe102a8b5e207b184d77738e9a0e9bb1d
(5) EAP-Message =
0x0205008819800000007e160303004610000042410459577e7f63893e12439d89ef7762dad67749be48f7e06e4798b09f06a920a47cf785564d5fd7220bb11a3f2f7395c2c8c698f67528e9750d194e81d0046fa3211403030001011603030028000000000000000044f35649eebe0522c431f1c3773c53
(5) NAS-IP-Address = 0.0.0.0
(5) Message-Authenticator = 0x4a79037a8376770b58ea48e0122addc7
(5) session-state: No cached attributes
(5) # Executing section authorize from file /etc/raddb/sites-enabled/default
(5) authorize {
(5) policy filter_username {
(5) if (&User-Name) {
(5) if (&User-Name) -> TRUE
(5) if (&User-Name) {
(5) if (&User-Name =~ / /) {
(5) if (&User-Name =~ / /) -> FALSE
(5) if (&User-Name =~ /@[^@]*@/ ) {
(5) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(5) if (&User-Name =~ /\.\./ ) {
(5) if (&User-Name =~ /\.\./ ) -> FALSE
(5) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(5) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(5) if (&User-Name =~ /\.$/) {
(5) if (&User-Name =~ /\.$/) -> FALSE
(5) if (&User-Name =~ /@\./) {
(5) if (&User-Name =~ /@\./) -> FALSE
(5) } # if (&User-Name) = notfound
(5) } # policy filter_username = notfound
(5) [preprocess] = ok
(5) [chap] = noop
(5) [mschap] = noop
(5) [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: No '@' in User-Name = "host/rob-nb-3302.sedlmeier.local",
looking up realm NULL
(5) suffix: No such realm "NULL"
(5) [suffix] = noop
(5) ntdomain: Checking for prefix before "\"
(5) ntdomain: No '\' in User-Name =
"host/rob-nb-3302.sedlmeier.local", looking up realm NULL
(5) ntdomain: No such realm "NULL"
(5) [ntdomain] = noop
(5) eap: Peer sent EAP Response (code 2) ID 5 length 136
(5) eap: Continuing tunnel setup
(5) [eap] = ok
(5) } # authorize = ok
(5) Found Auth-Type = eap
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) authenticate {
(5) eap: Expiring EAP session with state 0xe102a8b5e207b184
(5) eap: Finished EAP session with state 0xe102a8b5e207b184
(5) eap: Previous EAP request found for state 0xe102a8b5e207b184,
released from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: Continuing EAP-TLS
(5) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(5) eap_peap: Got complete TLS record (126 bytes)
(5) eap_peap: [eaptls verify] = length included
(5) eap_peap: <<< recv TLS 1.2 [length 0046]
(5) eap_peap: TLS_accept: SSLv3 read client key exchange A
(5) eap_peap: <<< recv TLS 1.2 [length 0001]
(5) eap_peap: <<< recv TLS 1.2 [length 0010]
(5) eap_peap: TLS_accept: SSLv3 read finished A
(5) eap_peap: >>> send TLS 1.2 [length 0001]
(5) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(5) eap_peap: >>> send TLS 1.2 [length 0010]
(5) eap_peap: TLS_accept: SSLv3 write finished A
(5) eap_peap: TLS_accept: SSLv3 flush data
(5) eap_peap: (other): SSL negotiation finished successfully
(5) eap_peap: SSL Connection Established
(5) eap_peap: [eaptls process] = handled
(5) eap: Sending EAP Request (code 1) ID 6 length 57
(5) eap: EAP session adding &reply:State = 0xe102a8b5e504b184
(5) [eap] = handled
(5) } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) # Executing group from file /etc/raddb/sites-enabled/default
(5) Challenge { ... } # empty sub-section is ignored
(5) Sent Access-Challenge Id 78 from 192.168.99.13:1812 to
192.168.99.2:56761 length 0
(5) EAP-Message =
0x01060039190014030300010116030300284cc3e20a68955d07f6d14e1174f4d7e3213ca011d95b07b99cdabfdaee2088c3000f9d130635ebac
(5) Message-Authenticator = 0x00000000000000000000000000000000
(5) State = 0xe102a8b5e504b184d77738e9a0e9bb1d
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 79 from 192.168.99.2:56762 to
192.168.99.13:1812 length 179
(6) User-Name = "SEDLMEIER\\iah"
(6) Service-Type = Framed-User
(6) Called-Station-Id = "D8-84-66-1C-A0-C2"
(6) Calling-Station-Id = "74-2B-62-85-F5-5D"
(6) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(6) NAS-Port = 5
(6) NAS-Port-Id = "fe.1.5"
(6) Framed-MTU = 1500
(6) NAS-Port-Type = Ethernet
(6) EAP-Message = 0x02020012015345444c4d454945525c696168
(6) NAS-IP-Address = 0.0.0.0
(6) Message-Authenticator = 0x818fa39dfffe9c77183d6e2de38d755b
(6) # Executing section authorize from file /etc/raddb/sites-enabled/default
(6) authorize {
(6) policy filter_username {
(6) if (&User-Name) {
(6) if (&User-Name) -> TRUE
(6) if (&User-Name) {
(6) if (&User-Name =~ / /) {
(6) if (&User-Name =~ / /) -> FALSE
(6) if (&User-Name =~ /@[^@]*@/ ) {
(6) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(6) if (&User-Name =~ /\.\./ ) {
(6) if (&User-Name =~ /\.\./ ) -> FALSE
(6) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(6) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(6) if (&User-Name =~ /\.$/) {
(6) if (&User-Name =~ /\.$/) -> FALSE
(6) if (&User-Name =~ /@\./) {
(6) if (&User-Name =~ /@\./) -> FALSE
(6) } # if (&User-Name) = notfound
(6) } # policy filter_username = notfound
(6) [preprocess] = ok
(6) [chap] = noop
(6) [mschap] = noop
(6) [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(6) suffix: No such realm "NULL"
(6) [suffix] = noop
(6) ntdomain: Checking for prefix before "\"
(6) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(6) ntdomain: Found realm "SEDLMEIER"
(6) ntdomain: Adding Stripped-User-Name = "iah"
(6) ntdomain: Adding Realm = "SEDLMEIER"
(6) ntdomain: Authentication realm is LOCAL
(6) [ntdomain] = ok
(6) eap: Peer sent EAP Response (code 2) ID 2 length 18
(6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(6) [eap] = ok
(6) } # authorize = ok
(6) Found Auth-Type = eap
(6) # Executing group from file /etc/raddb/sites-enabled/default
(6) authenticate {
(6) eap: Peer sent packet with method EAP Identity (1)
(6) eap: Calling submodule eap_peap to process data
(6) eap_peap: Initiating new EAP-TLS session
(6) eap_peap: [eaptls start] = request
(6) eap: Sending EAP Request (code 1) ID 3 length 6
(6) eap: EAP session adding &reply:State = 0x5c12086c5c1111e3
(6) [eap] = handled
(6) } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) # Executing group from file /etc/raddb/sites-enabled/default
(6) Challenge { ... } # empty sub-section is ignored
(6) Sent Access-Challenge Id 79 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(6) EAP-Message = 0x010300061920
(6) Message-Authenticator = 0x00000000000000000000000000000000
(6) State = 0x5c12086c5c1111e339ba0cfb20b713d6
(6) Finished request
Waking up in 1.1 seconds.
(7) Received Access-Request Id 80 from 192.168.99.2:56762 to
192.168.99.13:1812 length 349
(7) User-Name = "SEDLMEIER\\iah"
(7) Service-Type = Framed-User
(7) Called-Station-Id = "D8-84-66-1C-A0-C2"
(7) Calling-Station-Id = "74-2B-62-85-F5-5D"
(7) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(7) NAS-Port = 5
(7) NAS-Port-Id = "fe.1.5"
(7) Framed-MTU = 1500
(7) NAS-Port-Type = Ethernet
(7) State = 0x5c12086c5c1111e339ba0cfb20b713d6
(7) EAP-Message =
0x020300aa1980000000a0160303009b010000970303597ef3af9297418508522f64df28c68dac427ff745468f6dfd57682f35d5132700002ec02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0005000401000040000500050100000000000a0008
(7) NAS-IP-Address = 0.0.0.0
(7) Message-Authenticator = 0x97a8f22303c5ea6c0e824b9e8a1b0aed
(7) session-state: No cached attributes
(7) # Executing section authorize from file /etc/raddb/sites-enabled/default
(7) authorize {
(7) policy filter_username {
(7) if (&User-Name) {
(7) if (&User-Name) -> TRUE
(7) if (&User-Name) {
(7) if (&User-Name =~ / /) {
(7) if (&User-Name =~ / /) -> FALSE
(7) if (&User-Name =~ /@[^@]*@/ ) {
(7) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(7) if (&User-Name =~ /\.\./ ) {
(7) if (&User-Name =~ /\.\./ ) -> FALSE
(7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(7) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(7) if (&User-Name =~ /\.$/) {
(7) if (&User-Name =~ /\.$/) -> FALSE
(7) if (&User-Name =~ /@\./) {
(7) if (&User-Name =~ /@\./) -> FALSE
(7) } # if (&User-Name) = notfound
(7) } # policy filter_username = notfound
(7) [preprocess] = ok
(7) [chap] = noop
(7) [mschap] = noop
(7) [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(7) suffix: No such realm "NULL"
(7) [suffix] = noop
(7) ntdomain: Checking for prefix before "\"
(7) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(7) ntdomain: Found realm "SEDLMEIER"
(7) ntdomain: Adding Stripped-User-Name = "iah"
(7) ntdomain: Adding Realm = "SEDLMEIER"
(7) ntdomain: Authentication realm is LOCAL
(7) [ntdomain] = ok
(7) eap: Peer sent EAP Response (code 2) ID 3 length 170
(7) eap: Continuing tunnel setup
(7) [eap] = ok
(7) } # authorize = ok
(7) Found Auth-Type = eap
(7) # Executing group from file /etc/raddb/sites-enabled/default
(7) authenticate {
(7) eap: Expiring EAP session with state 0xe102a8b5e504b184
(7) eap: Finished EAP session with state 0x5c12086c5c1111e3
(7) eap: Previous EAP request found for state 0x5c12086c5c1111e3,
released from the list
(7) eap: Peer sent packet with method EAP PEAP (25)
(7) eap: Calling submodule eap_peap to process data
(7) eap_peap: Continuing EAP-TLS
(7) eap_peap: Peer indicated complete TLS record size will be 160 bytes
(7) eap_peap: Got complete TLS record (160 bytes)
(7) eap_peap: [eaptls verify] = length included
(7) eap_peap: (other): before/accept initialization
(7) eap_peap: TLS_accept: before/accept initialization
(7) eap_peap: <<< recv TLS 1.2 [length 009b]
(7) eap_peap: TLS_accept: SSLv3 read client hello A
(7) eap_peap: >>> send TLS 1.2 [length 0039]
(7) eap_peap: TLS_accept: SSLv3 write server hello A
(7) eap_peap: >>> send TLS 1.2 [length 0910]
(7) eap_peap: TLS_accept: SSLv3 write certificate A
(7) eap_peap: >>> send TLS 1.2 [length 014d]
(7) eap_peap: TLS_accept: SSLv3 write key exchange A
(7) eap_peap: >>> send TLS 1.2 [length 0004]
(7) eap_peap: TLS_accept: SSLv3 write server done A
(7) eap_peap: TLS_accept: SSLv3 flush data
(7) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(7) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(7) eap_peap: In SSL Handshake Phase
(7) eap_peap: In SSL Accept mode
(7) eap_peap: [eaptls process] = handled
(7) eap: Sending EAP Request (code 1) ID 4 length 1004
(7) eap: EAP session adding &reply:State = 0x5c12086c5d1611e3
(7) [eap] = handled
(7) } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) # Executing group from file /etc/raddb/sites-enabled/default
(7) Challenge { ... } # empty sub-section is ignored
(7) Sent Access-Challenge Id 80 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(7) EAP-Message =
0x010403ec19c000000aae1603030039020000350303597ef3aea467f059676c2603a5b2dc766323afffc5e40ce4949e372f640afdc500c03000000dff01000100000b00040300010216030309100b00090c0009090003f7308203f3308202dba003020102020101300d06092a864886f70d01010b050030
(7) Message-Authenticator = 0x00000000000000000000000000000000
(7) State = 0x5c12086c5d1611e339ba0cfb20b713d6
(7) Finished request
Waking up in 0.2 seconds.
(8) Received Access-Request Id 81 from 192.168.99.2:56762 to
192.168.99.13:1812 length 185
(8) User-Name = "SEDLMEIER\\iah"
(8) Service-Type = Framed-User
(8) Called-Station-Id = "D8-84-66-1C-A0-C2"
(8) Calling-Station-Id = "74-2B-62-85-F5-5D"
(8) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(8) NAS-Port = 5
(8) NAS-Port-Id = "fe.1.5"
(8) Framed-MTU = 1500
(8) NAS-Port-Type = Ethernet
(8) State = 0x5c12086c5d1611e339ba0cfb20b713d6
(8) EAP-Message = 0x020400061900
(8) NAS-IP-Address = 0.0.0.0
(8) Message-Authenticator = 0x2fa5145d6891b5151d53b6b1094c19c5
(8) session-state: No cached attributes
(8) # Executing section authorize from file /etc/raddb/sites-enabled/default
(8) authorize {
(8) policy filter_username {
(8) if (&User-Name) {
(8) if (&User-Name) -> TRUE
(8) if (&User-Name) {
(8) if (&User-Name =~ / /) {
(8) if (&User-Name =~ / /) -> FALSE
(8) if (&User-Name =~ /@[^@]*@/ ) {
(8) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(8) if (&User-Name =~ /\.\./ ) {
(8) if (&User-Name =~ /\.\./ ) -> FALSE
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(8) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(8) if (&User-Name =~ /\.$/) {
(8) if (&User-Name =~ /\.$/) -> FALSE
(8) if (&User-Name =~ /@\./) {
(8) if (&User-Name =~ /@\./) -> FALSE
(8) } # if (&User-Name) = notfound
(8) } # policy filter_username = notfound
(8) [preprocess] = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(8) suffix: No such realm "NULL"
(8) [suffix] = noop
(8) ntdomain: Checking for prefix before "\"
(8) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(8) ntdomain: Found realm "SEDLMEIER"
(8) ntdomain: Adding Stripped-User-Name = "iah"
(8) ntdomain: Adding Realm = "SEDLMEIER"
(8) ntdomain: Authentication realm is LOCAL
(8) [ntdomain] = ok
(8) eap: Peer sent EAP Response (code 2) ID 4 length 6
(8) eap: Continuing tunnel setup
(8) [eap] = ok
(8) } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8) authenticate {
(8) eap: Expiring EAP session with state 0xe102a8b5e504b184
(8) eap: Finished EAP session with state 0x5c12086c5d1611e3
(8) eap: Previous EAP request found for state 0x5c12086c5d1611e3,
released from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: Continuing EAP-TLS
(8) eap_peap: Peer ACKed our handshake fragment
(8) eap_peap: [eaptls verify] = request
(8) eap_peap: [eaptls process] = handled
(8) eap: Sending EAP Request (code 1) ID 5 length 1000
(8) eap: EAP session adding &reply:State = 0x5c12086c5e1711e3
(8) [eap] = handled
(8) } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) # Executing group from file /etc/raddb/sites-enabled/default
(8) Challenge { ... } # empty sub-section is ignored
(8) Sent Access-Challenge Id 81 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(8) EAP-Message =
0x010503e8194022518c1dec2cbb2f69d25320c61e68c7f0b7c8b0ae456881bf11f25fb4734527d9e23825158b087c6fd71853cbc94218fa747fbb854f8a6b48583f69cffde05d5cd8c71c2eab8f1cbfd016db9ee4fbfda2bba6b46ea1587e1118771bad825657998f00050c30820508308203f0a0030201
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0x5c12086c5e1711e339ba0cfb20b713d6
(8) Finished request
Waking up in 0.1 seconds.
(9) Received Access-Request Id 82 from 192.168.99.2:56762 to
192.168.99.13:1812 length 185
(9) User-Name = "SEDLMEIER\\iah"
(9) Service-Type = Framed-User
(9) Called-Station-Id = "D8-84-66-1C-A0-C2"
(9) Calling-Station-Id = "74-2B-62-85-F5-5D"
(9) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(9) NAS-Port = 5
(9) NAS-Port-Id = "fe.1.5"
(9) Framed-MTU = 1500
(9) NAS-Port-Type = Ethernet
(9) State = 0x5c12086c5e1711e339ba0cfb20b713d6
(9) EAP-Message = 0x020500061900
(9) NAS-IP-Address = 0.0.0.0
(9) Message-Authenticator = 0x2232c98584da081f74bfd46238c649a6
(9) session-state: No cached attributes
(9) # Executing section authorize from file /etc/raddb/sites-enabled/default
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]*@/ ) {
(9) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(9) if (&User-Name =~ /\.\./ ) {
(9) if (&User-Name =~ /\.\./ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))
-> FALSE
(9) if (&User-Name =~ /\.$/) {
(9) if (&User-Name =~ /\.$/) -> FALSE
(9) if (&User-Name =~ /@\./) {
(9) if (&User-Name =~ /@\./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(9) suffix: No such realm "NULL"
(9) [suffix] = noop
(9) ntdomain: Checking for prefix before "\"
(9) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(9) ntdomain: Found realm "SEDLMEIER"
(9) ntdomain: Adding Stripped-User-Name = "iah"
(9) ntdomain: Adding Realm = "SEDLMEIER"
(9) ntdomain: Authentication realm is LOCAL
(9) [ntdomain] = ok
(9) eap: Peer sent EAP Response (code 2) ID 5 length 6
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0xe102a8b5e504b184
(9) eap: Finished EAP session with state 0x5c12086c5e1711e3
(9) eap: Previous EAP request found for state 0x5c12086c5e1711e3,
released from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: Peer ACKed our handshake fragment
(9) eap_peap: [eaptls verify] = request
(9) eap_peap: [eaptls process] = handled
(9) eap: Sending EAP Request (code 1) ID 6 length 752
(9) eap: EAP session adding &reply:State = 0x5c12086c5f1411e3
(9) [eap] = handled
(9) } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) Challenge { ... } # empty sub-section is ignored
(9) Sent Access-Challenge Id 82 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(9) EAP-Message =
0x010602f01900260603550403131f5365646c6d6569657220436572746966696361746520417574686f72697479820900b2c4cbf303d91155300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d
(9) Message-Authenticator = 0x00000000000000000000000000000000
(9) State = 0x5c12086c5f1411e339ba0cfb20b713d6
(9) Finished request
Waking up in 0.1 seconds.
(10) Received Access-Request Id 83 from 192.168.99.2:56762 to
192.168.99.13:1812 length 315
(10) User-Name = "SEDLMEIER\\iah"
(10) Service-Type = Framed-User
(10) Called-Station-Id = "D8-84-66-1C-A0-C2"
(10) Calling-Station-Id = "74-2B-62-85-F5-5D"
(10) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(10) NAS-Port = 5
(10) NAS-Port-Id = "fe.1.5"
(10) Framed-MTU = 1500
(10) NAS-Port-Type = Ethernet
(10) State = 0x5c12086c5f1411e339ba0cfb20b713d6
(10) EAP-Message =
0x0206008819800000007e16030300461000004241049c2e77d6fcc8cdca527b6a1ec38a7f6f2051615194c3105208b13f10613e8e52ff33d0b56a501b57117d9b5e1741b10d41ccd01e9b01944566873455ca522b911403030001011603030028000000000000000075256bb4eee5e1fbb9e017d492512f
(10) NAS-IP-Address = 0.0.0.0
(10) Message-Authenticator = 0x08422fb47023c883ae6834405b9141b8
(10) session-state: No cached attributes
(10) # Executing section authorize from file /etc/raddb/sites-enabled/default
(10) authorize {
(10) policy filter_username {
(10) if (&User-Name) {
(10) if (&User-Name) -> TRUE
(10) if (&User-Name) {
(10) if (&User-Name =~ / /) {
(10) if (&User-Name =~ / /) -> FALSE
(10) if (&User-Name =~ /@[^@]*@/ ) {
(10) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(10) if (&User-Name =~ /\.\./ ) {
(10) if (&User-Name =~ /\.\./ ) -> FALSE
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(10) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(10) if (&User-Name =~ /\.$/) {
(10) if (&User-Name =~ /\.$/) -> FALSE
(10) if (&User-Name =~ /@\./) {
(10) if (&User-Name =~ /@\./) -> FALSE
(10) } # if (&User-Name) = notfound
(10) } # policy filter_username = notfound
(10) [preprocess] = ok
(10) [chap] = noop
(10) [mschap] = noop
(10) [digest] = noop
(10) suffix: Checking for suffix after "@"
(10) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(10) suffix: No such realm "NULL"
(10) [suffix] = noop
(10) ntdomain: Checking for prefix before "\"
(10) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(10) ntdomain: Found realm "SEDLMEIER"
(10) ntdomain: Adding Stripped-User-Name = "iah"
(10) ntdomain: Adding Realm = "SEDLMEIER"
(10) ntdomain: Authentication realm is LOCAL
(10) [ntdomain] = ok
(10) eap: Peer sent EAP Response (code 2) ID 6 length 136
(10) eap: Continuing tunnel setup
(10) [eap] = ok
(10) } # authorize = ok
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10) authenticate {
(10) eap: Expiring EAP session with state 0xe102a8b5e504b184
(10) eap: Finished EAP session with state 0x5c12086c5f1411e3
(10) eap: Previous EAP request found for state 0x5c12086c5f1411e3,
released from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: Continuing EAP-TLS
(10) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(10) eap_peap: Got complete TLS record (126 bytes)
(10) eap_peap: [eaptls verify] = length included
(10) eap_peap: <<< recv TLS 1.2 [length 0046]
(10) eap_peap: TLS_accept: SSLv3 read client key exchange A
(10) eap_peap: <<< recv TLS 1.2 [length 0001]
(10) eap_peap: <<< recv TLS 1.2 [length 0010]
(10) eap_peap: TLS_accept: SSLv3 read finished A
(10) eap_peap: >>> send TLS 1.2 [length 0001]
(10) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(10) eap_peap: >>> send TLS 1.2 [length 0010]
(10) eap_peap: TLS_accept: SSLv3 write finished A
(10) eap_peap: TLS_accept: SSLv3 flush data
(10) eap_peap: (other): SSL negotiation finished successfully
(10) eap_peap: SSL Connection Established
(10) eap_peap: [eaptls process] = handled
(10) eap: Sending EAP Request (code 1) ID 7 length 57
(10) eap: EAP session adding &reply:State = 0x5c12086c581511e3
(10) [eap] = handled
(10) } # authenticate = handled
(10) Using Post-Auth-Type Challenge
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10) Challenge { ... } # empty sub-section is ignored
(10) Sent Access-Challenge Id 83 from 192.168.99.13:1812 to
192.168.99.2:56762 length 0
(10) EAP-Message =
0x010700391900140303000101160303002851bcfc40abac086065a05953d280fd982896b0423fcc9ea154fe46ffb652a382e869902394c3d1f3
(10) Message-Authenticator = 0x00000000000000000000000000000000
(10) State = 0x5c12086c581511e339ba0cfb20b713d6
(10) Finished request
Waking up in 0.1 seconds.
(5) Cleaning up request packet ID 78 with timestamp +56
Waking up in 3.8 seconds.
(11) Received Access-Request Id 84 from 192.168.99.2:56763 to
192.168.99.13:1812 length 175
(11) User-Name = "74-2B-62-85-F5-5D"
(11) Service-Type = Framed-User
(11) Called-Station-Id = "D8-84-66-1C-A0-C2"
(11) Calling-Station-Id = "74-2B-62-85-F5-5D"
(11) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(11) NAS-Port = 5
(11) NAS-Port-Type = Ethernet
(11) NAS-Port-Id = "fe.1.5"
(11) NAS-IP-Address = 0.0.0.0
(11) User-Password = "NOPASSWORD"
(11) Message-Authenticator = 0x6f080d4ccbf6f5ca720db06ca1ded019
(11) # Executing section authorize from file /etc/raddb/sites-enabled/default
(11) authorize {
(11) policy filter_username {
(11) if (&User-Name) {
(11) if (&User-Name) -> TRUE
(11) if (&User-Name) {
(11) if (&User-Name =~ / /) {
(11) if (&User-Name =~ / /) -> FALSE
(11) if (&User-Name =~ /@[^@]*@/ ) {
(11) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(11) if (&User-Name =~ /\.\./ ) {
(11) if (&User-Name =~ /\.\./ ) -> FALSE
(11) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(11) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(11) if (&User-Name =~ /\.$/) {
(11) if (&User-Name =~ /\.$/) -> FALSE
(11) if (&User-Name =~ /@\./) {
(11) if (&User-Name =~ /@\./) -> FALSE
(11) } # if (&User-Name) = notfound
(11) } # policy filter_username = notfound
(11) [preprocess] = ok
(11) [chap] = noop
(11) [mschap] = noop
(11) [digest] = noop
(11) suffix: Checking for suffix after "@"
(11) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(11) suffix: No such realm "NULL"
(11) [suffix] = noop
(11) ntdomain: Checking for prefix before "\"
(11) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(11) ntdomain: No such realm "NULL"
(11) [ntdomain] = noop
(11) eap: No EAP-Message, not doing EAP
(11) [eap] = noop
(11) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (2): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (3): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (4): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Reserved connection (0)
(11) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(11) files: --> (samaccountname=74-2B-62-85-F5-5D)
(11) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(11) files: Waiting for search result...
(11) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (6), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(11) files: users: Matched entry DEFAULT at line 48
(11) [files] = ok
rlm_ldap (ldap): Reserved connection (5)
(11) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(11) ldap: --> (samaccountname=74-2B-62-85-F5-5D)
(11) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(11) ldap: Waiting for search result...
(11) ldap: Search returned no results
rlm_ldap (ldap): Released connection (5)
(11) [ldap] = notfound
(11) [expiration] = noop
(11) [logintime] = noop
(11) pap: WARNING: Auth-Type already set. Not setting to PAP
(11) [pap] = noop
(11) } # authorize = ok
(11) Found Auth-Type = Reject
(11) Auth-Type = Reject, rejecting user
(11) Failed to authenticate the user
(11) Using Post-Auth-Type Reject
(11) # Executing group from file /etc/raddb/sites-enabled/default
(11) Post-Auth-Type REJECT {
(11) attr_filter.access_reject: EXPAND %{User-Name}
(11) attr_filter.access_reject: --> 74-2B-62-85-F5-5D
(11) attr_filter.access_reject: Matched entry DEFAULT at line 11
(11) [attr_filter.access_reject] = updated
(11) [eap] = noop
(11) policy remove_reply_message_if_eap {
(11) if (&reply:EAP-Message && &reply:Reply-Message) {
(11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(11) else {
(11) [noop] = noop
(11) } # else = noop
(11) } # policy remove_reply_message_if_eap = noop
(11) } # Post-Auth-Type REJECT = updated
(11) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(11) Sending delayed response
(11) Sent Access-Reject Id 84 from 192.168.99.13:1812 to
192.168.99.2:56763 length 20
Waking up in 1.1 seconds.
(6) Cleaning up request packet ID 79 with timestamp +60
Waking up in 0.9 seconds.
(7) Cleaning up request packet ID 80 with timestamp +61
(8) Cleaning up request packet ID 81 with timestamp +61
(9) Cleaning up request packet ID 82 with timestamp +61
(10) Cleaning up request packet ID 83 with timestamp +61
Waking up in 1.8 seconds.
(11) Cleaning up request packet ID 84 with timestamp +63
Ready to process requests
(12) Received Access-Request Id 85 from 192.168.99.2:56764 to
192.168.99.13:1812 length 175
(12) User-Name = "74-2B-62-85-F5-5D"
(12) Service-Type = Framed-User
(12) Called-Station-Id = "D8-84-66-1C-A0-C2"
(12) Calling-Station-Id = "74-2B-62-85-F5-5D"
(12) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(12) NAS-Port = 5
(12) NAS-Port-Type = Ethernet
(12) NAS-Port-Id = "fe.1.5"
(12) NAS-IP-Address = 0.0.0.0
(12) User-Password = "NOPASSWORD"
(12) Message-Authenticator = 0xeec36b77f7b50adfba1207e2034ef1a1
(12) # Executing section authorize from file /etc/raddb/sites-enabled/default
(12) authorize {
(12) policy filter_username {
(12) if (&User-Name) {
(12) if (&User-Name) -> TRUE
(12) if (&User-Name) {
(12) if (&User-Name =~ / /) {
(12) if (&User-Name =~ / /) -> FALSE
(12) if (&User-Name =~ /@[^@]*@/ ) {
(12) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(12) if (&User-Name =~ /\.\./ ) {
(12) if (&User-Name =~ /\.\./ ) -> FALSE
(12) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(12) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(12) if (&User-Name =~ /\.$/) {
(12) if (&User-Name =~ /\.$/) -> FALSE
(12) if (&User-Name =~ /@\./) {
(12) if (&User-Name =~ /@\./) -> FALSE
(12) } # if (&User-Name) = notfound
(12) } # policy filter_username = notfound
(12) [preprocess] = ok
(12) [chap] = noop
(12) [mschap] = noop
(12) [digest] = noop
(12) suffix: Checking for suffix after "@"
(12) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(12) suffix: No such realm "NULL"
(12) [suffix] = noop
(12) ntdomain: Checking for prefix before "\"
(12) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(12) ntdomain: No such realm "NULL"
(12) [ntdomain] = noop
(12) eap: No EAP-Message, not doing EAP
(12) [eap] = noop
(12) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (1): Hit idle_timeout, was idle
for 64 seconds
rlm_ldap (ldap): Reserved connection (0)
(12) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(12) files: --> (samaccountname=74-2B-62-85-F5-5D)
(12) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(12) files: Waiting for search result...
(12) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (7), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(12) files: users: Matched entry DEFAULT at line 48
(12) [files] = ok
rlm_ldap (ldap): Reserved connection (6)
(12) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(12) ldap: --> (samaccountname=74-2B-62-85-F5-5D)
(12) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(12) ldap: Waiting for search result...
(12) ldap: Search returned no results
rlm_ldap (ldap): Released connection (6)
(12) [ldap] = notfound
(12) [expiration] = noop
(12) [logintime] = noop
(12) pap: WARNING: Auth-Type already set. Not setting to PAP
(12) [pap] = noop
(12) } # authorize = ok
(12) Found Auth-Type = Reject
(12) Auth-Type = Reject, rejecting user
(12) Failed to authenticate the user
(12) Using Post-Auth-Type Reject
(12) # Executing group from file /etc/raddb/sites-enabled/default
(12) Post-Auth-Type REJECT {
(12) attr_filter.access_reject: EXPAND %{User-Name}
(12) attr_filter.access_reject: --> 74-2B-62-85-F5-5D
(12) attr_filter.access_reject: Matched entry DEFAULT at line 11
(12) [attr_filter.access_reject] = updated
(12) [eap] = noop
(12) policy remove_reply_message_if_eap {
(12) if (&reply:EAP-Message && &reply:Reply-Message) {
(12) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(12) else {
(12) [noop] = noop
(12) } # else = noop
(12) } # policy remove_reply_message_if_eap = noop
(12) } # Post-Auth-Type REJECT = updated
(12) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(12) Sending delayed response
(12) Sent Access-Reject Id 85 from 192.168.99.13:1812 to
192.168.99.2:56764 length 20
Waking up in 3.9 seconds.
(12) Cleaning up request packet ID 85 with timestamp +95
Ready to process requests
(13) Received Access-Request Id 86 from 192.168.99.2:56765 to
192.168.99.13:1812 length 179
(13) User-Name = "SEDLMEIER\\iah"
(13) Service-Type = Framed-User
(13) Called-Station-Id = "D8-84-66-1C-A0-C2"
(13) Calling-Station-Id = "74-2B-62-85-F5-5D"
(13) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(13) NAS-Port = 5
(13) NAS-Port-Id = "fe.1.5"
(13) Framed-MTU = 1500
(13) NAS-Port-Type = Ethernet
(13) EAP-Message = 0x02080012015345444c4d454945525c696168
(13) NAS-IP-Address = 0.0.0.0
(13) Message-Authenticator = 0x1b1d08e528d4d368c7099e9a07b3ecf5
(13) # Executing section authorize from file /etc/raddb/sites-enabled/default
(13) authorize {
(13) policy filter_username {
(13) if (&User-Name) {
(13) if (&User-Name) -> TRUE
(13) if (&User-Name) {
(13) if (&User-Name =~ / /) {
(13) if (&User-Name =~ / /) -> FALSE
(13) if (&User-Name =~ /@[^@]*@/ ) {
(13) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(13) if (&User-Name =~ /\.\./ ) {
(13) if (&User-Name =~ /\.\./ ) -> FALSE
(13) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(13) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(13) if (&User-Name =~ /\.$/) {
(13) if (&User-Name =~ /\.$/) -> FALSE
(13) if (&User-Name =~ /@\./) {
(13) if (&User-Name =~ /@\./) -> FALSE
(13) } # if (&User-Name) = notfound
(13) } # policy filter_username = notfound
(13) [preprocess] = ok
(13) [chap] = noop
(13) [mschap] = noop
(13) [digest] = noop
(13) suffix: Checking for suffix after "@"
(13) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(13) suffix: No such realm "NULL"
(13) [suffix] = noop
(13) ntdomain: Checking for prefix before "\"
(13) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(13) ntdomain: Found realm "SEDLMEIER"
(13) ntdomain: Adding Stripped-User-Name = "iah"
(13) ntdomain: Adding Realm = "SEDLMEIER"
(13) ntdomain: Authentication realm is LOCAL
(13) [ntdomain] = ok
(13) eap: Peer sent EAP Response (code 2) ID 8 length 18
(13) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(13) [eap] = ok
(13) } # authorize = ok
(13) Found Auth-Type = eap
(13) # Executing group from file /etc/raddb/sites-enabled/default
(13) authenticate {
(13) eap: Peer sent packet with method EAP Identity (1)
(13) eap: Calling submodule eap_peap to process data
(13) eap_peap: Initiating new EAP-TLS session
(13) eap_peap: [eaptls start] = request
(13) eap: Sending EAP Request (code 1) ID 9 length 6
(13) eap: EAP session adding &reply:State = 0xd24e2fefd247361e
(13) [eap] = handled
(13) } # authenticate = handled
(13) Using Post-Auth-Type Challenge
(13) # Executing group from file /etc/raddb/sites-enabled/default
(13) Challenge { ... } # empty sub-section is ignored
(13) Sent Access-Challenge Id 86 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(13) EAP-Message = 0x010900061920
(13) Message-Authenticator = 0x00000000000000000000000000000000
(13) State = 0xd24e2fefd247361eca7551413078c7bf
(13) Finished request
Waking up in 4.9 seconds.
(14) Received Access-Request Id 87 from 192.168.99.2:56765 to
192.168.99.13:1812 length 349
(14) User-Name = "SEDLMEIER\\iah"
(14) Service-Type = Framed-User
(14) Called-Station-Id = "D8-84-66-1C-A0-C2"
(14) Calling-Station-Id = "74-2B-62-85-F5-5D"
(14) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(14) NAS-Port = 5
(14) NAS-Port-Id = "fe.1.5"
(14) Framed-MTU = 1500
(14) NAS-Port-Type = Ethernet
(14) State = 0xd24e2fefd247361eca7551413078c7bf
(14) EAP-Message =
0x020900aa1980000000a0160303009b010000970303597ef3eb3f5f0cdf9d002c82661bdd703d5d6924c837b49643e04172f2686dd900002ec02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a0005000401000040000500050100000000000a0008
(14) NAS-IP-Address = 0.0.0.0
(14) Message-Authenticator = 0x3948db8556c9c85fddb72a5b0c0de12d
(14) session-state: No cached attributes
(14) # Executing section authorize from file /etc/raddb/sites-enabled/default
(14) authorize {
(14) policy filter_username {
(14) if (&User-Name) {
(14) if (&User-Name) -> TRUE
(14) if (&User-Name) {
(14) if (&User-Name =~ / /) {
(14) if (&User-Name =~ / /) -> FALSE
(14) if (&User-Name =~ /@[^@]*@/ ) {
(14) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(14) if (&User-Name =~ /\.\./ ) {
(14) if (&User-Name =~ /\.\./ ) -> FALSE
(14) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(14) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(14) if (&User-Name =~ /\.$/) {
(14) if (&User-Name =~ /\.$/) -> FALSE
(14) if (&User-Name =~ /@\./) {
(14) if (&User-Name =~ /@\./) -> FALSE
(14) } # if (&User-Name) = notfound
(14) } # policy filter_username = notfound
(14) [preprocess] = ok
(14) [chap] = noop
(14) [mschap] = noop
(14) [digest] = noop
(14) suffix: Checking for suffix after "@"
(14) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(14) suffix: No such realm "NULL"
(14) [suffix] = noop
(14) ntdomain: Checking for prefix before "\"
(14) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(14) ntdomain: Found realm "SEDLMEIER"
(14) ntdomain: Adding Stripped-User-Name = "iah"
(14) ntdomain: Adding Realm = "SEDLMEIER"
(14) ntdomain: Authentication realm is LOCAL
(14) [ntdomain] = ok
(14) eap: Peer sent EAP Response (code 2) ID 9 length 170
(14) eap: Continuing tunnel setup
(14) [eap] = ok
(14) } # authorize = ok
(14) Found Auth-Type = eap
(14) # Executing group from file /etc/raddb/sites-enabled/default
(14) authenticate {
(14) eap: Expiring EAP session with state 0xe102a8b5e504b184
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! EAP session with state 0xe102a8b5e504b184 did not finish! !!
!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(14) eap: Expiring EAP session with state 0x5c12086c581511e3
(14) eap: Finished EAP session with state 0xd24e2fefd247361e
(14) eap: Previous EAP request found for state 0xd24e2fefd247361e,
released from the list
(14) eap: Peer sent packet with method EAP PEAP (25)
(14) eap: Calling submodule eap_peap to process data
(14) eap_peap: Continuing EAP-TLS
(14) eap_peap: Peer indicated complete TLS record size will be 160 bytes
(14) eap_peap: Got complete TLS record (160 bytes)
(14) eap_peap: [eaptls verify] = length included
(14) eap_peap: (other): before/accept initialization
(14) eap_peap: TLS_accept: before/accept initialization
(14) eap_peap: <<< recv TLS 1.2 [length 009b]
(14) eap_peap: TLS_accept: SSLv3 read client hello A
(14) eap_peap: >>> send TLS 1.2 [length 0039]
(14) eap_peap: TLS_accept: SSLv3 write server hello A
(14) eap_peap: >>> send TLS 1.2 [length 0910]
(14) eap_peap: TLS_accept: SSLv3 write certificate A
(14) eap_peap: >>> send TLS 1.2 [length 014d]
(14) eap_peap: TLS_accept: SSLv3 write key exchange A
(14) eap_peap: >>> send TLS 1.2 [length 0004]
(14) eap_peap: TLS_accept: SSLv3 write server done A
(14) eap_peap: TLS_accept: SSLv3 flush data
(14) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(14) eap_peap: TLS_accept: Need to read more data: SSLv3 read client
certificate A
(14) eap_peap: In SSL Handshake Phase
(14) eap_peap: In SSL Accept mode
(14) eap_peap: [eaptls process] = handled
(14) eap: Sending EAP Request (code 1) ID 10 length 1004
(14) eap: EAP session adding &reply:State = 0xd24e2fefd344361e
(14) [eap] = handled
(14) } # authenticate = handled
(14) Using Post-Auth-Type Challenge
(14) # Executing group from file /etc/raddb/sites-enabled/default
(14) Challenge { ... } # empty sub-section is ignored
(14) Sent Access-Challenge Id 87 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(14) EAP-Message =
0x010a03ec19c000000aae1603030039020000350303597ef3e99badfb8693744cdcd7601bd3e974444747f08040cff0d223da1f0c8a00c03000000dff01000100000b00040300010216030309100b00090c0009090003f7308203f3308202dba003020102020101300d06092a864886f70d01010b050030
(14) Message-Authenticator = 0x00000000000000000000000000000000
(14) State = 0xd24e2fefd344361eca7551413078c7bf
(14) Finished request
Waking up in 4.9 seconds.
(15) Received Access-Request Id 88 from 192.168.99.2:56765 to
192.168.99.13:1812 length 185
(15) User-Name = "SEDLMEIER\\iah"
(15) Service-Type = Framed-User
(15) Called-Station-Id = "D8-84-66-1C-A0-C2"
(15) Calling-Station-Id = "74-2B-62-85-F5-5D"
(15) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(15) NAS-Port = 5
(15) NAS-Port-Id = "fe.1.5"
(15) Framed-MTU = 1500
(15) NAS-Port-Type = Ethernet
(15) State = 0xd24e2fefd344361eca7551413078c7bf
(15) EAP-Message = 0x020a00061900
(15) NAS-IP-Address = 0.0.0.0
(15) Message-Authenticator = 0xf862a5636affc708d17664f7967df861
(15) session-state: No cached attributes
(15) # Executing section authorize from file /etc/raddb/sites-enabled/default
(15) authorize {
(15) policy filter_username {
(15) if (&User-Name) {
(15) if (&User-Name) -> TRUE
(15) if (&User-Name) {
(15) if (&User-Name =~ / /) {
(15) if (&User-Name =~ / /) -> FALSE
(15) if (&User-Name =~ /@[^@]*@/ ) {
(15) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(15) if (&User-Name =~ /\.\./ ) {
(15) if (&User-Name =~ /\.\./ ) -> FALSE
(15) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(15) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(15) if (&User-Name =~ /\.$/) {
(15) if (&User-Name =~ /\.$/) -> FALSE
(15) if (&User-Name =~ /@\./) {
(15) if (&User-Name =~ /@\./) -> FALSE
(15) } # if (&User-Name) = notfound
(15) } # policy filter_username = notfound
(15) [preprocess] = ok
(15) [chap] = noop
(15) [mschap] = noop
(15) [digest] = noop
(15) suffix: Checking for suffix after "@"
(15) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(15) suffix: No such realm "NULL"
(15) [suffix] = noop
(15) ntdomain: Checking for prefix before "\"
(15) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(15) ntdomain: Found realm "SEDLMEIER"
(15) ntdomain: Adding Stripped-User-Name = "iah"
(15) ntdomain: Adding Realm = "SEDLMEIER"
(15) ntdomain: Authentication realm is LOCAL
(15) [ntdomain] = ok
(15) eap: Peer sent EAP Response (code 2) ID 10 length 6
(15) eap: Continuing tunnel setup
(15) [eap] = ok
(15) } # authorize = ok
(15) Found Auth-Type = eap
(15) # Executing group from file /etc/raddb/sites-enabled/default
(15) authenticate {
(15) eap: Expiring EAP session with state 0x5c12086c581511e3
(15) eap: Finished EAP session with state 0xd24e2fefd344361e
(15) eap: Previous EAP request found for state 0xd24e2fefd344361e,
released from the list
(15) eap: Peer sent packet with method EAP PEAP (25)
(15) eap: Calling submodule eap_peap to process data
(15) eap_peap: Continuing EAP-TLS
(15) eap_peap: Peer ACKed our handshake fragment
(15) eap_peap: [eaptls verify] = request
(15) eap_peap: [eaptls process] = handled
(15) eap: Sending EAP Request (code 1) ID 11 length 1000
(15) eap: EAP session adding &reply:State = 0xd24e2fefd045361e
(15) [eap] = handled
(15) } # authenticate = handled
(15) Using Post-Auth-Type Challenge
(15) # Executing group from file /etc/raddb/sites-enabled/default
(15) Challenge { ... } # empty sub-section is ignored
(15) Sent Access-Challenge Id 88 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(15) EAP-Message =
0x010b03e8194022518c1dec2cbb2f69d25320c61e68c7f0b7c8b0ae456881bf11f25fb4734527d9e23825158b087c6fd71853cbc94218fa747fbb854f8a6b48583f69cffde05d5cd8c71c2eab8f1cbfd016db9ee4fbfda2bba6b46ea1587e1118771bad825657998f00050c30820508308203f0a0030201
(15) Message-Authenticator = 0x00000000000000000000000000000000
(15) State = 0xd24e2fefd045361eca7551413078c7bf
(15) Finished request
Waking up in 4.9 seconds.
(16) Received Access-Request Id 89 from 192.168.99.2:56765 to
192.168.99.13:1812 length 185
(16) User-Name = "SEDLMEIER\\iah"
(16) Service-Type = Framed-User
(16) Called-Station-Id = "D8-84-66-1C-A0-C2"
(16) Calling-Station-Id = "74-2B-62-85-F5-5D"
(16) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(16) NAS-Port = 5
(16) NAS-Port-Id = "fe.1.5"
(16) Framed-MTU = 1500
(16) NAS-Port-Type = Ethernet
(16) State = 0xd24e2fefd045361eca7551413078c7bf
(16) EAP-Message = 0x020b00061900
(16) NAS-IP-Address = 0.0.0.0
(16) Message-Authenticator = 0xb50b422e3023158679ac2bb2da0882ef
(16) session-state: No cached attributes
(16) # Executing section authorize from file /etc/raddb/sites-enabled/default
(16) authorize {
(16) policy filter_username {
(16) if (&User-Name) {
(16) if (&User-Name) -> TRUE
(16) if (&User-Name) {
(16) if (&User-Name =~ / /) {
(16) if (&User-Name =~ / /) -> FALSE
(16) if (&User-Name =~ /@[^@]*@/ ) {
(16) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(16) if (&User-Name =~ /\.\./ ) {
(16) if (&User-Name =~ /\.\./ ) -> FALSE
(16) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(16) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(16) if (&User-Name =~ /\.$/) {
(16) if (&User-Name =~ /\.$/) -> FALSE
(16) if (&User-Name =~ /@\./) {
(16) if (&User-Name =~ /@\./) -> FALSE
(16) } # if (&User-Name) = notfound
(16) } # policy filter_username = notfound
(16) [preprocess] = ok
(16) [chap] = noop
(16) [mschap] = noop
(16) [digest] = noop
(16) suffix: Checking for suffix after "@"
(16) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(16) suffix: No such realm "NULL"
(16) [suffix] = noop
(16) ntdomain: Checking for prefix before "\"
(16) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(16) ntdomain: Found realm "SEDLMEIER"
(16) ntdomain: Adding Stripped-User-Name = "iah"
(16) ntdomain: Adding Realm = "SEDLMEIER"
(16) ntdomain: Authentication realm is LOCAL
(16) [ntdomain] = ok
(16) eap: Peer sent EAP Response (code 2) ID 11 length 6
(16) eap: Continuing tunnel setup
(16) [eap] = ok
(16) } # authorize = ok
(16) Found Auth-Type = eap
(16) # Executing group from file /etc/raddb/sites-enabled/default
(16) authenticate {
(16) eap: Expiring EAP session with state 0x5c12086c581511e3
(16) eap: Finished EAP session with state 0xd24e2fefd045361e
(16) eap: Previous EAP request found for state 0xd24e2fefd045361e,
released from the list
(16) eap: Peer sent packet with method EAP PEAP (25)
(16) eap: Calling submodule eap_peap to process data
(16) eap_peap: Continuing EAP-TLS
(16) eap_peap: Peer ACKed our handshake fragment
(16) eap_peap: [eaptls verify] = request
(16) eap_peap: [eaptls process] = handled
(16) eap: Sending EAP Request (code 1) ID 12 length 752
(16) eap: EAP session adding &reply:State = 0xd24e2fefd142361e
(16) [eap] = handled
(16) } # authenticate = handled
(16) Using Post-Auth-Type Challenge
(16) # Executing group from file /etc/raddb/sites-enabled/default
(16) Challenge { ... } # empty sub-section is ignored
(16) Sent Access-Challenge Id 89 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(16) EAP-Message =
0x010c02f01900260603550403131f5365646c6d6569657220436572746966696361746520417574686f72697479820900b2c4cbf303d91155300f0603551d130101ff040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6f72672f6578616d
(16) Message-Authenticator = 0x00000000000000000000000000000000
(16) State = 0xd24e2fefd142361eca7551413078c7bf
(16) Finished request
Waking up in 4.9 seconds.
(17) Received Access-Request Id 90 from 192.168.99.2:56765 to
192.168.99.13:1812 length 315
(17) User-Name = "SEDLMEIER\\iah"
(17) Service-Type = Framed-User
(17) Called-Station-Id = "D8-84-66-1C-A0-C2"
(17) Calling-Station-Id = "74-2B-62-85-F5-5D"
(17) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(17) NAS-Port = 5
(17) NAS-Port-Id = "fe.1.5"
(17) Framed-MTU = 1500
(17) NAS-Port-Type = Ethernet
(17) State = 0xd24e2fefd142361eca7551413078c7bf
(17) EAP-Message =
0x020c008819800000007e1603030046100000424104448b22ede4a0e77a739219e3c41aebb4661afdbe06012588afd6bdd0178ea8be11cb65e55b389fce98c8a05ab3468908468bd9531fb1316271bba8f904a6eeb5140303000101160303002800000000000000002b081693acf8713f55f691ee064a87
(17) NAS-IP-Address = 0.0.0.0
(17) Message-Authenticator = 0x9929cea011801053b9263e9451e5cb5a
(17) session-state: No cached attributes
(17) # Executing section authorize from file /etc/raddb/sites-enabled/default
(17) authorize {
(17) policy filter_username {
(17) if (&User-Name) {
(17) if (&User-Name) -> TRUE
(17) if (&User-Name) {
(17) if (&User-Name =~ / /) {
(17) if (&User-Name =~ / /) -> FALSE
(17) if (&User-Name =~ /@[^@]*@/ ) {
(17) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(17) if (&User-Name =~ /\.\./ ) {
(17) if (&User-Name =~ /\.\./ ) -> FALSE
(17) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(17) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(17) if (&User-Name =~ /\.$/) {
(17) if (&User-Name =~ /\.$/) -> FALSE
(17) if (&User-Name =~ /@\./) {
(17) if (&User-Name =~ /@\./) -> FALSE
(17) } # if (&User-Name) = notfound
(17) } # policy filter_username = notfound
(17) [preprocess] = ok
(17) [chap] = noop
(17) [mschap] = noop
(17) [digest] = noop
(17) suffix: Checking for suffix after "@"
(17) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(17) suffix: No such realm "NULL"
(17) [suffix] = noop
(17) ntdomain: Checking for prefix before "\"
(17) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(17) ntdomain: Found realm "SEDLMEIER"
(17) ntdomain: Adding Stripped-User-Name = "iah"
(17) ntdomain: Adding Realm = "SEDLMEIER"
(17) ntdomain: Authentication realm is LOCAL
(17) [ntdomain] = ok
(17) eap: Peer sent EAP Response (code 2) ID 12 length 136
(17) eap: Continuing tunnel setup
(17) [eap] = ok
(17) } # authorize = ok
(17) Found Auth-Type = eap
(17) # Executing group from file /etc/raddb/sites-enabled/default
(17) authenticate {
(17) eap: Expiring EAP session with state 0x5c12086c581511e3
(17) eap: Finished EAP session with state 0xd24e2fefd142361e
(17) eap: Previous EAP request found for state 0xd24e2fefd142361e,
released from the list
(17) eap: Peer sent packet with method EAP PEAP (25)
(17) eap: Calling submodule eap_peap to process data
(17) eap_peap: Continuing EAP-TLS
(17) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(17) eap_peap: Got complete TLS record (126 bytes)
(17) eap_peap: [eaptls verify] = length included
(17) eap_peap: <<< recv TLS 1.2 [length 0046]
(17) eap_peap: TLS_accept: SSLv3 read client key exchange A
(17) eap_peap: <<< recv TLS 1.2 [length 0001]
(17) eap_peap: <<< recv TLS 1.2 [length 0010]
(17) eap_peap: TLS_accept: SSLv3 read finished A
(17) eap_peap: >>> send TLS 1.2 [length 0001]
(17) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(17) eap_peap: >>> send TLS 1.2 [length 0010]
(17) eap_peap: TLS_accept: SSLv3 write finished A
(17) eap_peap: TLS_accept: SSLv3 flush data
(17) eap_peap: (other): SSL negotiation finished successfully
(17) eap_peap: SSL Connection Established
(17) eap_peap: [eaptls process] = handled
(17) eap: Sending EAP Request (code 1) ID 13 length 57
(17) eap: EAP session adding &reply:State = 0xd24e2fefd643361e
(17) [eap] = handled
(17) } # authenticate = handled
(17) Using Post-Auth-Type Challenge
(17) # Executing group from file /etc/raddb/sites-enabled/default
(17) Challenge { ... } # empty sub-section is ignored
(17) Sent Access-Challenge Id 90 from 192.168.99.13:1812 to
192.168.99.2:56765 length 0
(17) EAP-Message =
0x010d00391900140303000101160303002843321548245ec01dba73ed278faccef9f8d84f6a91ba22e29ed32d8fa52b655a1961fed4437fbe96
(17) Message-Authenticator = 0x00000000000000000000000000000000
(17) State = 0xd24e2fefd643361eca7551413078c7bf
(17) Finished request
Waking up in 4.8 seconds.
(18) Received Access-Request Id 91 from 192.168.99.2:56766 to
192.168.99.13:1812 length 185
(18) User-Name = "SEDLMEIER\\iah"
(18) Service-Type = Framed-User
(18) Called-Station-Id = "D8-84-66-1C-A0-C2"
(18) Calling-Station-Id = "74-2B-62-85-F5-5D"
(18) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(18) NAS-Port = 5
(18) NAS-Port-Id = "fe.1.5"
(18) Framed-MTU = 1500
(18) NAS-Port-Type = Ethernet
(18) State = 0xd24e2fefd643361eca7551413078c7bf
(18) EAP-Message = 0x020d00061900
(18) NAS-IP-Address = 0.0.0.0
(18) Message-Authenticator = 0x35124549b88f9a323dd5076569fd6f8f
(18) session-state: No cached attributes
(18) # Executing section authorize from file /etc/raddb/sites-enabled/default
(18) authorize {
(18) policy filter_username {
(18) if (&User-Name) {
(18) if (&User-Name) -> TRUE
(18) if (&User-Name) {
(18) if (&User-Name =~ / /) {
(18) if (&User-Name =~ / /) -> FALSE
(18) if (&User-Name =~ /@[^@]*@/ ) {
(18) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(18) if (&User-Name =~ /\.\./ ) {
(18) if (&User-Name =~ /\.\./ ) -> FALSE
(18) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(18) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(18) if (&User-Name =~ /\.$/) {
(18) if (&User-Name =~ /\.$/) -> FALSE
(18) if (&User-Name =~ /@\./) {
(18) if (&User-Name =~ /@\./) -> FALSE
(18) } # if (&User-Name) = notfound
(18) } # policy filter_username = notfound
(18) [preprocess] = ok
(18) [chap] = noop
(18) [mschap] = noop
(18) [digest] = noop
(18) suffix: Checking for suffix after "@"
(18) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(18) suffix: No such realm "NULL"
(18) [suffix] = noop
(18) ntdomain: Checking for prefix before "\"
(18) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(18) ntdomain: Found realm "SEDLMEIER"
(18) ntdomain: Adding Stripped-User-Name = "iah"
(18) ntdomain: Adding Realm = "SEDLMEIER"
(18) ntdomain: Authentication realm is LOCAL
(18) [ntdomain] = ok
(18) eap: Peer sent EAP Response (code 2) ID 13 length 6
(18) eap: Continuing tunnel setup
(18) [eap] = ok
(18) } # authorize = ok
(18) Found Auth-Type = eap
(18) # Executing group from file /etc/raddb/sites-enabled/default
(18) authenticate {
(18) eap: Expiring EAP session with state 0x5c12086c581511e3
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
!! EAP session with state 0x5c12086c581511e3 did not finish! !!
!! Please read http://wiki.freeradius.org/guide/Certificate_Compatibility !!
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
(18) eap: Expiring EAP session with state 0xd24e2fefd643361e
(18) eap: Finished EAP session with state 0xd24e2fefd643361e
(18) eap: Previous EAP request found for state 0xd24e2fefd643361e,
released from the list
(18) eap: Peer sent packet with method EAP PEAP (25)
(18) eap: Calling submodule eap_peap to process data
(18) eap_peap: Continuing EAP-TLS
(18) eap_peap: Peer ACKed our handshake fragment. handshake is finished
(18) eap_peap: [eaptls verify] = success
(18) eap_peap: [eaptls process] = success
(18) eap_peap: Session established. Decoding tunneled attributes
(18) eap_peap: PEAP state TUNNEL ESTABLISHED
(18) eap: Sending EAP Request (code 1) ID 14 length 40
(18) eap: EAP session adding &reply:State = 0xd24e2fefd740361e
(18) [eap] = handled
(18) } # authenticate = handled
(18) Using Post-Auth-Type Challenge
(18) # Executing group from file /etc/raddb/sites-enabled/default
(18) Challenge { ... } # empty sub-section is ignored
(18) Sent Access-Challenge Id 91 from 192.168.99.13:1812 to
192.168.99.2:56766 length 0
(18) EAP-Message =
0x010e00281900170303001d43321548245ec01e88708f1dd4574539af080bc7be566d374a7cdc5bcf
(18) Message-Authenticator = 0x00000000000000000000000000000000
(18) State = 0xd24e2fefd740361eca7551413078c7bf
(18) Finished request
Waking up in 1.1 seconds.
(19) Received Access-Request Id 92 from 192.168.99.2:56766 to
192.168.99.13:1812 length 228
(19) User-Name = "SEDLMEIER\\iah"
(19) Service-Type = Framed-User
(19) Called-Station-Id = "D8-84-66-1C-A0-C2"
(19) Calling-Station-Id = "74-2B-62-85-F5-5D"
(19) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(19) NAS-Port = 5
(19) NAS-Port-Id = "fe.1.5"
(19) Framed-MTU = 1500
(19) NAS-Port-Type = Ethernet
(19) State = 0xd24e2fefd740361eca7551413078c7bf
(19) EAP-Message =
0x020e00311900170303002600000000000000014c60e795d3fff33be1fe23d361a3ffdd260b0c9848c8ab9a79295107f35c
(19) NAS-IP-Address = 0.0.0.0
(19) Message-Authenticator = 0xf15bf8bf58a9bddd9cb9d5bcd7258a75
(19) session-state: No cached attributes
(19) # Executing section authorize from file /etc/raddb/sites-enabled/default
(19) authorize {
(19) policy filter_username {
(19) if (&User-Name) {
(19) if (&User-Name) -> TRUE
(19) if (&User-Name) {
(19) if (&User-Name =~ / /) {
(19) if (&User-Name =~ / /) -> FALSE
(19) if (&User-Name =~ /@[^@]*@/ ) {
(19) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(19) if (&User-Name =~ /\.\./ ) {
(19) if (&User-Name =~ /\.\./ ) -> FALSE
(19) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(19) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(19) if (&User-Name =~ /\.$/) {
(19) if (&User-Name =~ /\.$/) -> FALSE
(19) if (&User-Name =~ /@\./) {
(19) if (&User-Name =~ /@\./) -> FALSE
(19) } # if (&User-Name) = notfound
(19) } # policy filter_username = notfound
(19) [preprocess] = ok
(19) [chap] = noop
(19) [mschap] = noop
(19) [digest] = noop
(19) suffix: Checking for suffix after "@"
(19) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(19) suffix: No such realm "NULL"
(19) [suffix] = noop
(19) ntdomain: Checking for prefix before "\"
(19) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(19) ntdomain: Found realm "SEDLMEIER"
(19) ntdomain: Adding Stripped-User-Name = "iah"
(19) ntdomain: Adding Realm = "SEDLMEIER"
(19) ntdomain: Authentication realm is LOCAL
(19) [ntdomain] = ok
(19) eap: Peer sent EAP Response (code 2) ID 14 length 49
(19) eap: Continuing tunnel setup
(19) [eap] = ok
(19) } # authorize = ok
(19) Found Auth-Type = eap
(19) # Executing group from file /etc/raddb/sites-enabled/default
(19) authenticate {
(19) eap: Expiring EAP session with state 0xd24e2fefd740361e
(19) eap: Finished EAP session with state 0xd24e2fefd740361e
(19) eap: Previous EAP request found for state 0xd24e2fefd740361e,
released from the list
(19) eap: Peer sent packet with method EAP PEAP (25)
(19) eap: Calling submodule eap_peap to process data
(19) eap_peap: Continuing EAP-TLS
(19) eap_peap: [eaptls verify] = ok
(19) eap_peap: Done initial handshake
(19) eap_peap: [eaptls process] = ok
(19) eap_peap: Session established. Decoding tunneled attributes
(19) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(19) eap_peap: Identity - SEDLMEIER\iah
(19) eap_peap: Got inner identity 'SEDLMEIER\iah'
(19) eap_peap: Setting default EAP type for tunneled EAP session
(19) eap_peap: Got tunneled request
(19) eap_peap: EAP-Message = 0x020e0012015345444c4d454945525c696168
(19) eap_peap: Setting User-Name to SEDLMEIER\iah
(19) eap_peap: Sending tunneled request to inner-tunnel
(19) eap_peap: EAP-Message = 0x020e0012015345444c4d454945525c696168
(19) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(19) eap_peap: User-Name = "SEDLMEIER\\iah"
(19) Virtual server inner-tunnel received request
(19) EAP-Message = 0x020e0012015345444c4d454945525c696168
(19) FreeRADIUS-Proxied-To = 127.0.0.1
(19) User-Name = "SEDLMEIER\\iah"
(19) WARNING: Outer and inner identities are the same. User privacy
is compromised.
(19) server inner-tunnel {
(19) # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
(19) authorize {
(19) policy filter_username {
(19) if (&User-Name) {
(19) if (&User-Name) -> TRUE
(19) if (&User-Name) {
(19) if (&User-Name =~ / /) {
(19) if (&User-Name =~ / /) -> FALSE
(19) if (&User-Name =~ /@[^@]*@/ ) {
(19) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(19) if (&User-Name =~ /\.\./ ) {
(19) if (&User-Name =~ /\.\./ ) -> FALSE
(19) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(19) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(19) if (&User-Name =~ /\.$/) {
(19) if (&User-Name =~ /\.$/) -> FALSE
(19) if (&User-Name =~ /@\./) {
(19) if (&User-Name =~ /@\./) -> FALSE
(19) } # if (&User-Name) = notfound
(19) } # policy filter_username = notfound
(19) [chap] = noop
(19) [mschap] = noop
(19) suffix: Checking for suffix after "@"
(19) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(19) suffix: No such realm "NULL"
(19) [suffix] = noop
(19) update control {
(19) &Proxy-To-Realm := LOCAL
(19) } # update control = noop
(19) eap: Peer sent EAP Response (code 2) ID 14 length 18
(19) eap: EAP-Identity reply, returning 'ok' so we can short-circuit
the rest of authorize
(19) [eap] = ok
(19) } # authorize = ok
(19) Found Auth-Type = eap
(19) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(19) authenticate {
(19) eap: Peer sent packet with method EAP Identity (1)
(19) eap: Calling submodule eap_mschapv2 to process data
(19) eap_mschapv2: Issuing Challenge
(19) eap: Sending EAP Request (code 1) ID 15 length 43
(19) eap: EAP session adding &reply:State = 0xd63550fbd63a4a59
(19) [eap] = handled
(19) } # authenticate = handled
(19) } # server inner-tunnel
(19) Virtual server sending reply
(19) EAP-Message =
0x010f002b1a010f002610cdb5ec45cd7c8807ca51f4db0a9a0f8e667265657261646975732d332e302e3135
(19) Message-Authenticator = 0x00000000000000000000000000000000
(19) State = 0xd63550fbd63a4a59a7b76b3185c969aa
(19) eap_peap: Got tunneled reply code 11
(19) eap_peap: EAP-Message =
0x010f002b1a010f002610cdb5ec45cd7c8807ca51f4db0a9a0f8e667265657261646975732d332e302e3135
(19) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(19) eap_peap: State = 0xd63550fbd63a4a59a7b76b3185c969aa
(19) eap_peap: Got tunneled reply RADIUS code 11
(19) eap_peap: EAP-Message =
0x010f002b1a010f002610cdb5ec45cd7c8807ca51f4db0a9a0f8e667265657261646975732d332e302e3135
(19) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(19) eap_peap: State = 0xd63550fbd63a4a59a7b76b3185c969aa
(19) eap_peap: Got tunneled Access-Challenge
(19) eap: Sending EAP Request (code 1) ID 15 length 74
(19) eap: EAP session adding &reply:State = 0xd24e2fefd441361e
(19) [eap] = handled
(19) } # authenticate = handled
(19) Using Post-Auth-Type Challenge
(19) # Executing group from file /etc/raddb/sites-enabled/default
(19) Challenge { ... } # empty sub-section is ignored
(19) Sent Access-Challenge Id 92 from 192.168.99.13:1812 to
192.168.99.2:56766 length 0
(19) EAP-Message =
0x010f004a1900170303003f43321548245ec01fd8d4b27cca3a84abb84109983ba36bcbb5f93f5107a6d42a8784d3e3a77558274dc11880a5f3da779aa89051dcb25dd6ab1c86923b3cbb
(19) Message-Authenticator = 0x00000000000000000000000000000000
(19) State = 0xd24e2fefd441361eca7551413078c7bf
(19) Finished request
Waking up in 0.8 seconds.
(20) Received Access-Request Id 93 from 192.168.99.2:56766 to
192.168.99.13:1812 length 282
(20) User-Name = "SEDLMEIER\\iah"
(20) Service-Type = Framed-User
(20) Called-Station-Id = "D8-84-66-1C-A0-C2"
(20) Calling-Station-Id = "74-2B-62-85-F5-5D"
(20) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(20) NAS-Port = 5
(20) NAS-Port-Id = "fe.1.5"
(20) Framed-MTU = 1500
(20) NAS-Port-Type = Ethernet
(20) State = 0xd24e2fefd441361eca7551413078c7bf
(20) EAP-Message =
0x020f00671900170303005c000000000000000243241aa425d6f7c8d71509c3b60a4c6b8db4cad3d64eef888d40802d40c2c86b4500c9bb1901556e079452b3643718c88cdb7fe0a50aa320e9d9c7f849290f380b06d9730e79d4e4c2be3e04b14c604a00ccbdd2
(20) NAS-IP-Address = 0.0.0.0
(20) Message-Authenticator = 0xa846eca9d309e94652e1c58fbaa05dce
(20) session-state: No cached attributes
(20) # Executing section authorize from file /etc/raddb/sites-enabled/default
(20) authorize {
(20) policy filter_username {
(20) if (&User-Name) {
(20) if (&User-Name) -> TRUE
(20) if (&User-Name) {
(20) if (&User-Name =~ / /) {
(20) if (&User-Name =~ / /) -> FALSE
(20) if (&User-Name =~ /@[^@]*@/ ) {
(20) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(20) if (&User-Name =~ /\.\./ ) {
(20) if (&User-Name =~ /\.\./ ) -> FALSE
(20) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(20) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(20) if (&User-Name =~ /\.$/) {
(20) if (&User-Name =~ /\.$/) -> FALSE
(20) if (&User-Name =~ /@\./) {
(20) if (&User-Name =~ /@\./) -> FALSE
(20) } # if (&User-Name) = notfound
(20) } # policy filter_username = notfound
(20) [preprocess] = ok
(20) [chap] = noop
(20) [mschap] = noop
(20) [digest] = noop
(20) suffix: Checking for suffix after "@"
(20) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(20) suffix: No such realm "NULL"
(20) [suffix] = noop
(20) ntdomain: Checking for prefix before "\"
(20) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(20) ntdomain: Found realm "SEDLMEIER"
(20) ntdomain: Adding Stripped-User-Name = "iah"
(20) ntdomain: Adding Realm = "SEDLMEIER"
(20) ntdomain: Authentication realm is LOCAL
(20) [ntdomain] = ok
(20) eap: Peer sent EAP Response (code 2) ID 15 length 103
(20) eap: Continuing tunnel setup
(20) [eap] = ok
(20) } # authorize = ok
(20) Found Auth-Type = eap
(20) # Executing group from file /etc/raddb/sites-enabled/default
(20) authenticate {
(20) eap: Expiring EAP session with state 0xd63550fbd63a4a59
(20) eap: Finished EAP session with state 0xd24e2fefd441361e
(20) eap: Previous EAP request found for state 0xd24e2fefd441361e,
released from the list
(20) eap: Peer sent packet with method EAP PEAP (25)
(20) eap: Calling submodule eap_peap to process data
(20) eap_peap: Continuing EAP-TLS
(20) eap_peap: [eaptls verify] = ok
(20) eap_peap: Done initial handshake
(20) eap_peap: [eaptls process] = ok
(20) eap_peap: Session established. Decoding tunneled attributes
(20) eap_peap: PEAP state phase2
(20) eap_peap: EAP method MSCHAPv2 (26)
(20) eap_peap: Got tunneled request
(20) eap_peap: EAP-Message =
0x020f00481a020f0043312af06a1435a1a34bfca5dc612d69a1d10000000000000000aee7c918d346a026e864b8344642b61250828f7f16106ae4005345444c4d454945525c696168
(20) eap_peap: Setting User-Name to SEDLMEIER\iah
(20) eap_peap: Sending tunneled request to inner-tunnel
(20) eap_peap: EAP-Message =
0x020f00481a020f0043312af06a1435a1a34bfca5dc612d69a1d10000000000000000aee7c918d346a026e864b8344642b61250828f7f16106ae4005345444c4d454945525c696168
(20) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(20) eap_peap: User-Name = "SEDLMEIER\\iah"
(20) eap_peap: State = 0xd63550fbd63a4a59a7b76b3185c969aa
(20) Virtual server inner-tunnel received request
(20) EAP-Message =
0x020f00481a020f0043312af06a1435a1a34bfca5dc612d69a1d10000000000000000aee7c918d346a026e864b8344642b61250828f7f16106ae4005345444c4d454945525c696168
(20) FreeRADIUS-Proxied-To = 127.0.0.1
(20) User-Name = "SEDLMEIER\\iah"
(20) State = 0xd63550fbd63a4a59a7b76b3185c969aa
(20) WARNING: Outer and inner identities are the same. User privacy
is compromised.
(20) server inner-tunnel {
(20) session-state: No cached attributes
(20) # Executing section authorize from file
/etc/raddb/sites-enabled/inner-tunnel
(20) authorize {
(20) policy filter_username {
(20) if (&User-Name) {
(20) if (&User-Name) -> TRUE
(20) if (&User-Name) {
(20) if (&User-Name =~ / /) {
(20) if (&User-Name =~ / /) -> FALSE
(20) if (&User-Name =~ /@[^@]*@/ ) {
(20) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(20) if (&User-Name =~ /\.\./ ) {
(20) if (&User-Name =~ /\.\./ ) -> FALSE
(20) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(20) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(20) if (&User-Name =~ /\.$/) {
(20) if (&User-Name =~ /\.$/) -> FALSE
(20) if (&User-Name =~ /@\./) {
(20) if (&User-Name =~ /@\./) -> FALSE
(20) } # if (&User-Name) = notfound
(20) } # policy filter_username = notfound
(20) [chap] = noop
(20) [mschap] = noop
(20) suffix: Checking for suffix after "@"
(20) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(20) suffix: No such realm "NULL"
(20) [suffix] = noop
(20) update control {
(20) &Proxy-To-Realm := LOCAL
(20) } # update control = noop
(20) eap: Peer sent EAP Response (code 2) ID 15 length 72
(20) eap: No EAP Start, assuming it's an on-going EAP conversation
(20) [eap] = updated
(20) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (5): Hit idle_timeout, was idle
for 61 seconds
rlm_ldap (ldap): Reserved connection (0)
(20) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(20) files: --> (samaccountname=SEDLMEIER\5c5ciah)
(20) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=SEDLMEIER\5c5ciah)", scope "sub"
(20) files: Waiting for search result...
(20) files: Search returned no results
rlm_ldap (ldap): Released connection (0)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (8), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(20) files: users: Matched entry DEFAULT at line 48
(20) [files] = ok
rlm_ldap (ldap): Reserved connection (7)
(20) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(20) ldap: --> (samaccountname=SEDLMEIER\5c5ciah)
(20) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=SEDLMEIER\5c5ciah)", scope "sub"
(20) ldap: Waiting for search result...
(20) ldap: Search returned no results
rlm_ldap (ldap): Released connection (7)
(20) [ldap] = notfound
(20) [expiration] = noop
(20) [logintime] = noop
(20) pap: WARNING: Auth-Type already set. Not setting to PAP
(20) [pap] = noop
(20) } # authorize = updated
(20) Found Auth-Type = Reject
(20) Auth-Type = Reject, rejecting user
(20) Failed to authenticate the user
(20) Using Post-Auth-Type Reject
(20) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(20) Post-Auth-Type REJECT {
(20) attr_filter.access_reject: EXPAND %{User-Name}
(20) attr_filter.access_reject: --> SEDLMEIER\\iah
(20) attr_filter.access_reject: Matched entry DEFAULT at line 11
(20) [attr_filter.access_reject] = updated
(20) update outer.session-state {
(20) No attributes updated
(20) } # update outer.session-state = noop
(20) } # Post-Auth-Type REJECT = updated
(20) } # server inner-tunnel
(20) Virtual server sending reply
(20) eap_peap: Got tunneled reply code 3
(20) eap_peap: Got tunneled reply RADIUS code 3
(20) eap_peap: Tunneled authentication was rejected
(20) eap_peap: FAILURE
(20) eap: Sending EAP Request (code 1) ID 16 length 46
(20) eap: EAP session adding &reply:State = 0xd24e2fefd55e361e
(20) [eap] = handled
(20) } # authenticate = handled
(20) Using Post-Auth-Type Challenge
(20) # Executing group from file /etc/raddb/sites-enabled/default
(20) Challenge { ... } # empty sub-section is ignored
(20) Sent Access-Challenge Id 93 from 192.168.99.13:1812 to
192.168.99.2:56766 length 0
(20) EAP-Message =
0x0110002e1900170303002343321548245ec020494ccfac9bdaeb65e6d6b730b817ad0e5a713d9147d8907ee86758
(20) Message-Authenticator = 0x00000000000000000000000000000000
(20) State = 0xd24e2fefd55e361eca7551413078c7bf
(20) Finished request
Waking up in 0.8 seconds.
(21) Received Access-Request Id 94 from 192.168.99.2:56766 to
192.168.99.13:1812 length 225
(21) User-Name = "SEDLMEIER\\iah"
(21) Service-Type = Framed-User
(21) Called-Station-Id = "D8-84-66-1C-A0-C2"
(21) Calling-Station-Id = "74-2B-62-85-F5-5D"
(21) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(21) NAS-Port = 5
(21) NAS-Port-Id = "fe.1.5"
(21) Framed-MTU = 1500
(21) NAS-Port-Type = Ethernet
(21) State = 0xd24e2fefd55e361eca7551413078c7bf
(21) EAP-Message =
0x0210002e190017030300230000000000000003fd9a2119383e53ff7d00f1f74abce68623121647bbdf04f935dd79
(21) NAS-IP-Address = 0.0.0.0
(21) Message-Authenticator = 0xa80f722db31b729f2e934bd07c37b528
(21) session-state: No cached attributes
(21) # Executing section authorize from file /etc/raddb/sites-enabled/default
(21) authorize {
(21) policy filter_username {
(21) if (&User-Name) {
(21) if (&User-Name) -> TRUE
(21) if (&User-Name) {
(21) if (&User-Name =~ / /) {
(21) if (&User-Name =~ / /) -> FALSE
(21) if (&User-Name =~ /@[^@]*@/ ) {
(21) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(21) if (&User-Name =~ /\.\./ ) {
(21) if (&User-Name =~ /\.\./ ) -> FALSE
(21) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(21) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(21) if (&User-Name =~ /\.$/) {
(21) if (&User-Name =~ /\.$/) -> FALSE
(21) if (&User-Name =~ /@\./) {
(21) if (&User-Name =~ /@\./) -> FALSE
(21) } # if (&User-Name) = notfound
(21) } # policy filter_username = notfound
(21) [preprocess] = ok
(21) [chap] = noop
(21) [mschap] = noop
(21) [digest] = noop
(21) suffix: Checking for suffix after "@"
(21) suffix: No '@' in User-Name = "SEDLMEIER\iah", looking up realm NULL
(21) suffix: No such realm "NULL"
(21) [suffix] = noop
(21) ntdomain: Checking for prefix before "\"
(21) ntdomain: Looking up realm "SEDLMEIER" for User-Name = "SEDLMEIER\iah"
(21) ntdomain: Found realm "SEDLMEIER"
(21) ntdomain: Adding Stripped-User-Name = "iah"
(21) ntdomain: Adding Realm = "SEDLMEIER"
(21) ntdomain: Authentication realm is LOCAL
(21) [ntdomain] = ok
(21) eap: Peer sent EAP Response (code 2) ID 16 length 46
(21) eap: Continuing tunnel setup
(21) [eap] = ok
(21) } # authorize = ok
(21) Found Auth-Type = eap
(21) # Executing group from file /etc/raddb/sites-enabled/default
(21) authenticate {
(21) eap: Expiring EAP session with state 0xd63550fbd63a4a59
(21) eap: Finished EAP session with state 0xd24e2fefd55e361e
(21) eap: Previous EAP request found for state 0xd24e2fefd55e361e,
released from the list
(21) eap: Peer sent packet with method EAP PEAP (25)
(21) eap: Calling submodule eap_peap to process data
(21) eap_peap: Continuing EAP-TLS
(21) eap_peap: [eaptls verify] = ok
(21) eap_peap: Done initial handshake
(21) eap_peap: [eaptls process] = ok
(21) eap_peap: Session established. Decoding tunneled attributes
(21) eap_peap: PEAP state send tlv failure
(21) eap_peap: Received EAP-TLV response
(21) eap_peap: ERROR: The users session was previously rejected:
returning reject (again.)
(21) eap_peap: This means you need to read the PREVIOUS messages in
the debug output
(21) eap_peap: to find out the reason why the user was rejected
(21) eap_peap: Look for "reject" or "fail". Those earlier messages
will tell you
(21) eap_peap: what went wrong, and how to fix the problem
(21) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed
(21) eap: Sending EAP Failure (code 4) ID 16 length 4
(21) eap: Failed in EAP select
(21) [eap] = invalid
(21) } # authenticate = invalid
(21) Failed to authenticate the user
(21) Using Post-Auth-Type Reject
(21) # Executing group from file /etc/raddb/sites-enabled/default
(21) Post-Auth-Type REJECT {
(21) attr_filter.access_reject: EXPAND %{User-Name}
(21) attr_filter.access_reject: --> SEDLMEIER\\iah
(21) attr_filter.access_reject: Matched entry DEFAULT at line 11
(21) [attr_filter.access_reject] = updated
(21) [eap] = noop
(21) policy remove_reply_message_if_eap {
(21) if (&reply:EAP-Message && &reply:Reply-Message) {
(21) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(21) else {
(21) [noop] = noop
(21) } # else = noop
(21) } # policy remove_reply_message_if_eap = noop
(21) } # Post-Auth-Type REJECT = updated
(21) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.5 seconds.
(13) Cleaning up request packet ID 86 with timestamp +120
(14) Cleaning up request packet ID 87 with timestamp +120
(15) Cleaning up request packet ID 88 with timestamp +120
(16) Cleaning up request packet ID 89 with timestamp +120
(17) Cleaning up request packet ID 90 with timestamp +120
(21) Sending delayed response
(21) Sent Access-Reject Id 94 from 192.168.99.13:1812 to
192.168.99.2:56766 length 44
(21) EAP-Message = 0x04100004
(21) Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.7 seconds.
(22) Received Access-Request Id 95 from 192.168.99.2:56767 to
192.168.99.13:1812 length 175
(22) User-Name = "74-2B-62-85-F5-5D"
(22) Service-Type = Framed-User
(22) Called-Station-Id = "D8-84-66-1C-A0-C2"
(22) Calling-Station-Id = "74-2B-62-85-F5-5D"
(22) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(22) NAS-Port = 5
(22) NAS-Port-Type = Ethernet
(22) NAS-Port-Id = "fe.1.5"
(22) NAS-IP-Address = 0.0.0.0
(22) User-Password = "NOPASSWORD"
(22) Message-Authenticator = 0x021b111bb35ea99580a18323fb64c271
(22) # Executing section authorize from file /etc/raddb/sites-enabled/default
(22) authorize {
(22) policy filter_username {
(22) if (&User-Name) {
(22) if (&User-Name) -> TRUE
(22) if (&User-Name) {
(22) if (&User-Name =~ / /) {
(22) if (&User-Name =~ / /) -> FALSE
(22) if (&User-Name =~ /@[^@]*@/ ) {
(22) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(22) if (&User-Name =~ /\.\./ ) {
(22) if (&User-Name =~ /\.\./ ) -> FALSE
(22) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(22) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(22) if (&User-Name =~ /\.$/) {
(22) if (&User-Name =~ /\.$/) -> FALSE
(22) if (&User-Name =~ /@\./) {
(22) if (&User-Name =~ /@\./) -> FALSE
(22) } # if (&User-Name) = notfound
(22) } # policy filter_username = notfound
(22) [preprocess] = ok
(22) [chap] = noop
(22) [mschap] = noop
(22) [digest] = noop
(22) suffix: Checking for suffix after "@"
(22) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(22) suffix: No such realm "NULL"
(22) [suffix] = noop
(22) ntdomain: Checking for prefix before "\"
(22) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(22) ntdomain: No such realm "NULL"
(22) [ntdomain] = noop
(22) eap: No EAP-Message, not doing EAP
(22) [eap] = noop
(22) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Reserved connection (6)
(22) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(22) files: --> (samaccountname=74-2B-62-85-F5-5D)
(22) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(22) files: Waiting for search result...
(22) files: Search returned no results
rlm_ldap (ldap): Released connection (6)
Need 6 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (9), 1 of 28 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(22) files: users: Matched entry DEFAULT at line 48
(22) [files] = ok
rlm_ldap (ldap): Reserved connection (0)
(22) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(22) ldap: --> (samaccountname=74-2B-62-85-F5-5D)
(22) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(22) ldap: Waiting for search result...
(22) ldap: Search returned no results
rlm_ldap (ldap): Released connection (0)
(22) [ldap] = notfound
(22) [expiration] = noop
(22) [logintime] = noop
(22) pap: WARNING: Auth-Type already set. Not setting to PAP
(22) [pap] = noop
(22) } # authorize = ok
(22) Found Auth-Type = Reject
(22) Auth-Type = Reject, rejecting user
(22) Failed to authenticate the user
(22) Using Post-Auth-Type Reject
(22) # Executing group from file /etc/raddb/sites-enabled/default
(22) Post-Auth-Type REJECT {
(22) attr_filter.access_reject: EXPAND %{User-Name}
(22) attr_filter.access_reject: --> 74-2B-62-85-F5-5D
(22) attr_filter.access_reject: Matched entry DEFAULT at line 11
(22) [attr_filter.access_reject] = updated
(22) [eap] = noop
(22) policy remove_reply_message_if_eap {
(22) if (&reply:EAP-Message && &reply:Reply-Message) {
(22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(22) else {
(22) [noop] = noop
(22) } # else = noop
(22) } # policy remove_reply_message_if_eap = noop
(22) } # Post-Auth-Type REJECT = updated
(22) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(22) Sending delayed response
(22) Sent Access-Reject Id 95 from 192.168.99.13:1812 to
192.168.99.2:56767 length 20
Waking up in 1.4 seconds.
(18) Cleaning up request packet ID 91 with timestamp +124
Waking up in 0.2 seconds.
(19) Cleaning up request packet ID 92 with timestamp +124
(20) Cleaning up request packet ID 93 with timestamp +124
(21) Cleaning up request packet ID 94 with timestamp +124
Waking up in 2.2 seconds.
(22) Cleaning up request packet ID 95 with timestamp +127
Ready to process requests
(23) Received Access-Request Id 96 from 192.168.99.2:56768 to
192.168.99.13:1812 length 175
(23) User-Name = "74-2B-62-85-F5-5D"
(23) Service-Type = Framed-User
(23) Called-Station-Id = "D8-84-66-1C-A0-C2"
(23) Calling-Station-Id = "74-2B-62-85-F5-5D"
(23) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(23) NAS-Port = 5
(23) NAS-Port-Type = Ethernet
(23) NAS-Port-Id = "fe.1.5"
(23) NAS-IP-Address = 0.0.0.0
(23) User-Password = "NOPASSWORD"
(23) Message-Authenticator = 0x61a938694f2b1d475b794be1a7b3ebe3
(23) # Executing section authorize from file /etc/raddb/sites-enabled/default
(23) authorize {
(23) policy filter_username {
(23) if (&User-Name) {
(23) if (&User-Name) -> TRUE
(23) if (&User-Name) {
(23) if (&User-Name =~ / /) {
(23) if (&User-Name =~ / /) -> FALSE
(23) if (&User-Name =~ /@[^@]*@/ ) {
(23) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(23) if (&User-Name =~ /\.\./ ) {
(23) if (&User-Name =~ /\.\./ ) -> FALSE
(23) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(23) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(23) if (&User-Name =~ /\.$/) {
(23) if (&User-Name =~ /\.$/) -> FALSE
(23) if (&User-Name =~ /@\./) {
(23) if (&User-Name =~ /@\./) -> FALSE
(23) } # if (&User-Name) = notfound
(23) } # policy filter_username = notfound
(23) [preprocess] = ok
(23) [chap] = noop
(23) [mschap] = noop
(23) [digest] = noop
(23) suffix: Checking for suffix after "@"
(23) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(23) suffix: No such realm "NULL"
(23) [suffix] = noop
(23) ntdomain: Checking for prefix before "\"
(23) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(23) ntdomain: No such realm "NULL"
(23) [ntdomain] = noop
(23) eap: No EAP-Message, not doing EAP
(23) [eap] = noop
(23) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Reserved connection (8)
(23) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(23) files: --> (samaccountname=74-2B-62-85-F5-5D)
(23) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(23) files: Waiting for search result...
(23) files: Search returned no results
rlm_ldap (ldap): Released connection (8)
Need 5 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (10), 1 of 27 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(23) files: users: Matched entry DEFAULT at line 48
(23) [files] = ok
rlm_ldap (ldap): Reserved connection (7)
(23) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(23) ldap: --> (samaccountname=74-2B-62-85-F5-5D)
(23) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(23) ldap: Waiting for search result...
(23) ldap: Search returned no results
rlm_ldap (ldap): Released connection (7)
(23) [ldap] = notfound
(23) [expiration] = noop
(23) [logintime] = noop
(23) pap: WARNING: Auth-Type already set. Not setting to PAP
(23) [pap] = noop
(23) } # authorize = ok
(23) Found Auth-Type = Reject
(23) Auth-Type = Reject, rejecting user
(23) Failed to authenticate the user
(23) Using Post-Auth-Type Reject
(23) # Executing group from file /etc/raddb/sites-enabled/default
(23) Post-Auth-Type REJECT {
(23) attr_filter.access_reject: EXPAND %{User-Name}
(23) attr_filter.access_reject: --> 74-2B-62-85-F5-5D
(23) attr_filter.access_reject: Matched entry DEFAULT at line 11
(23) [attr_filter.access_reject] = updated
(23) [eap] = noop
(23) policy remove_reply_message_if_eap {
(23) if (&reply:EAP-Message && &reply:Reply-Message) {
(23) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(23) else {
(23) [noop] = noop
(23) } # else = noop
(23) } # policy remove_reply_message_if_eap = noop
(23) } # Post-Auth-Type REJECT = updated
(23) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(23) Sending delayed response
(23) Sent Access-Reject Id 96 from 192.168.99.13:1812 to
192.168.99.2:56768 length 20
Waking up in 3.9 seconds.
(23) Cleaning up request packet ID 96 with timestamp +159
Ready to process requests
(24) Received Access-Request Id 97 from 192.168.99.2:56769 to
192.168.99.13:1812 length 175
(24) User-Name = "74-2B-62-85-F5-5D"
(24) Service-Type = Framed-User
(24) Called-Station-Id = "D8-84-66-1C-A0-C2"
(24) Calling-Station-Id = "74-2B-62-85-F5-5D"
(24) NAS-Identifier = "sed-nw-sw-01.sedlmeier.local"
(24) NAS-Port = 5
(24) NAS-Port-Type = Ethernet
(24) NAS-Port-Id = "fe.1.5"
(24) NAS-IP-Address = 0.0.0.0
(24) User-Password = "NOPASSWORD"
(24) Message-Authenticator = 0x9fd73ed0326f59255d14a3f48157518d
(24) # Executing section authorize from file /etc/raddb/sites-enabled/default
(24) authorize {
(24) policy filter_username {
(24) if (&User-Name) {
(24) if (&User-Name) -> TRUE
(24) if (&User-Name) {
(24) if (&User-Name =~ / /) {
(24) if (&User-Name =~ / /) -> FALSE
(24) if (&User-Name =~ /@[^@]*@/ ) {
(24) if (&User-Name =~ /@[^@]*@/ ) -> FALSE
(24) if (&User-Name =~ /\.\./ ) {
(24) if (&User-Name =~ /\.\./ ) -> FALSE
(24) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) {
(24) if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/)) -> FALSE
(24) if (&User-Name =~ /\.$/) {
(24) if (&User-Name =~ /\.$/) -> FALSE
(24) if (&User-Name =~ /@\./) {
(24) if (&User-Name =~ /@\./) -> FALSE
(24) } # if (&User-Name) = notfound
(24) } # policy filter_username = notfound
(24) [preprocess] = ok
(24) [chap] = noop
(24) [mschap] = noop
(24) [digest] = noop
(24) suffix: Checking for suffix after "@"
(24) suffix: No '@' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(24) suffix: No such realm "NULL"
(24) [suffix] = noop
(24) ntdomain: Checking for prefix before "\"
(24) ntdomain: No '\' in User-Name = "74-2B-62-85-F5-5D", looking up realm NULL
(24) ntdomain: No such realm "NULL"
(24) [ntdomain] = noop
(24) eap: No EAP-Message, not doing EAP
(24) [eap] = noop
(24) files: Searching for user in group "CN=Radius
lokal,OU=lokale,OU=Gruppen,OU=spezielle
Konten,OU=Mitarbeiter,DC=sedlmeier,DC=local"
rlm_ldap (ldap): Closing connection (6): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (9): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Closing connection (0): Hit idle_timeout, was idle
for 63 seconds
rlm_ldap (ldap): Reserved connection (8)
(24) files: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(24) files: --> (samaccountname=74-2B-62-85-F5-5D)
(24) files: Performing search in
"OU=Mitarbeiter,DC=sedlmeier,DC=local" with filter
"(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(24) files: Waiting for search result...
(24) files: Search returned no results
rlm_ldap (ldap): Released connection (8)
Need 7 more connections to reach 10 spares
rlm_ldap (ldap): Opening additional connection (11), 1 of 29 pending slots used
rlm_ldap (ldap): Connecting to ldap://sed-vm-dc-01.sedlmeier.local:389
rlm_ldap (ldap): Waiting for bind result...
rlm_ldap (ldap): Bind successful
(24) files: users: Matched entry DEFAULT at line 48
(24) [files] = ok
rlm_ldap (ldap): Reserved connection (10)
(24) ldap: EXPAND (samaccountname=%{%{Stripped-User-Name}:-%{User-Name}})
(24) ldap: --> (samaccountname=74-2B-62-85-F5-5D)
(24) ldap: Performing search in "OU=Mitarbeiter,DC=sedlmeier,DC=local"
with filter "(samaccountname=74-2B-62-85-F5-5D)", scope "sub"
(24) ldap: Waiting for search result...
(24) ldap: Search returned no results
rlm_ldap (ldap): Released connection (10)
(24) [ldap] = notfound
(24) [expiration] = noop
(24) [logintime] = noop
(24) pap: WARNING: Auth-Type already set. Not setting to PAP
(24) [pap] = noop
(24) } # authorize = ok
(24) Found Auth-Type = Reject
(24) Auth-Type = Reject, rejecting user
(24) Failed to authenticate the user
(24) Using Post-Auth-Type Reject
(24) # Executing group from file /etc/raddb/sites-enabled/default
(24) Post-Auth-Type REJECT {
(24) attr_filter.access_reject: EXPAND %{User-Name}
(24) attr_filter.access_reject: --> 74-2B-62-85-F5-5D
(24) attr_filter.access_reject: Matched entry DEFAULT at line 11
(24) [attr_filter.access_reject] = updated
(24) [eap] = noop
(24) policy remove_reply_message_if_eap {
(24) if (&reply:EAP-Message && &reply:Reply-Message) {
(24) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(24) else {
(24) [noop] = noop
(24) } # else = noop
(24) } # policy remove_reply_message_if_eap = noop
(24) } # Post-Auth-Type REJECT = updated
(24) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(24) Sending delayed response
(24) Sent Access-Reject Id 97 from 192.168.99.13:1812 to
192.168.99.2:56769 length 20
Waking up in 3.9 seconds.
(24) Cleaning up request packet ID 97 with timestamp +190
Ready to process requests
-----
Do you have any ideas about what it could be.
Thanks in advance.
More information about the Freeradius-Users
mailing list