EAP-GTC Error - Samsung S20+ connecting to eduroam
Shaun Hoofe
Shaun at harper-adams.ac.uk
Tue Sep 8 10:30:33 CEST 2020
Hi,
I’ve never needed to post here but this one has really stifled me. I have an end user with a Samsung S20+ and the September 2020 security patch attempting to connect to eduroam, everything looks fine client side (PEAP/MSCHAPv2) which has been verified by myself but Freeradius keeps throwing EAP-GTC errors. All other devices hitting Freeradius are connecting normally without issue.
eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed
I’ve no idea why its touching EAP-GTC at all… The client is set for MSCHAPv2 so I’m inclined to say that the client is bad and to wait for the next update but it’s difficult to articulate that to end users who have purchased the latest Samsung. Any ideas?
Debug as per below.
Cheers
Shaun
Copyright (C) 1999-2015 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/local/share/freeradius/dictionary
including dictionary file /usr/local/share/freeradius/dictionary.dhcp
including dictionary file /usr/local/share/freeradius/dictionary.vqp
including dictionary file /usr/local/etc/raddb/dictionary
including configuration file /usr/local/etc/raddb/radiusd.conf
including configuration file /usr/local/etc/raddb/proxy.conf
including configuration file /usr/local/etc/raddb/clients.conf
including files in directory /usr/local/etc/raddb/mods-enabled/
including configuration file /usr/local/etc/raddb/mods-enabled/cache_eap
including configuration file /usr/local/etc/raddb/mods-enabled/realm
including configuration file /usr/local/etc/raddb/mods-enabled/eap
including configuration file /usr/local/etc/raddb/mods-enabled/exec
including configuration file /usr/local/etc/raddb/mods-enabled/dhcp
including configuration file /usr/local/etc/raddb/mods-enabled/logintime
including configuration file /usr/local/etc/raddb/mods-enabled/server_log
including configuration file /usr/local/etc/raddb/mods-enabled/dynamic_clients
including configuration file /usr/local/etc/raddb/mods-enabled/detail.log
including configuration file /usr/local/etc/raddb/mods-enabled/chap
including configuration file /usr/local/etc/raddb/mods-enabled/extended_logging
including configuration file /usr/local/etc/raddb/mods-enabled/always
including configuration file /usr/local/etc/raddb/mods-enabled/replicate
including configuration file /usr/local/etc/raddb/mods-enabled/soh
including configuration file /usr/local/etc/raddb/mods-enabled/files
including configuration file /usr/local/etc/raddb/mods-enabled/passwd
including configuration file /usr/local/etc/raddb/mods-enabled/detail
including configuration file /usr/local/etc/raddb/mods-enabled/mschap
including configuration file /usr/local/etc/raddb/mods-enabled/echo
including configuration file /usr/local/etc/raddb/mods-enabled/expiration
including configuration file /usr/local/etc/raddb/mods-enabled/unpack
including configuration file /usr/local/etc/raddb/mods-enabled/preprocess
including configuration file /usr/local/etc/raddb/mods-enabled/radutmp
including configuration file /usr/local/etc/raddb/mods-enabled/attr_filter
including configuration file /usr/local/etc/raddb/mods-enabled/unix
including configuration file /usr/local/etc/raddb/mods-enabled/sradutmp
including configuration file /usr/local/etc/raddb/mods-enabled/digest
including configuration file /usr/local/etc/raddb/mods-enabled/expr
including configuration file /usr/local/etc/raddb/mods-enabled/ntlm_auth
including configuration file /usr/local/etc/raddb/mods-enabled/pap
including configuration file /usr/local/etc/raddb/mods-enabled/utf8
including configuration file /usr/local/etc/raddb/mods-enabled/linelog
including files in directory /usr/local/etc/raddb/policy.d/
including configuration file /usr/local/etc/raddb/policy.d/eap
including configuration file /usr/local/etc/raddb/policy.d/dhcp
including configuration file /usr/local/etc/raddb/policy.d/canonicalization
including configuration file /usr/local/etc/raddb/policy.d/accounting
including configuration file /usr/local/etc/raddb/policy.d/filter
including configuration file /usr/local/etc/raddb/policy.d/control
including configuration file /usr/local/etc/raddb/policy.d/abfab-tr
including configuration file /usr/local/etc/raddb/policy.d/debug
including configuration file /usr/local/etc/raddb/policy.d/operator-name
including configuration file /usr/local/etc/raddb/policy.d/cui
including files in directory /usr/local/etc/raddb/sites-enabled/
including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel
including configuration file /usr/local/etc/raddb/sites-enabled/default
including configuration file /usr/local/etc/raddb/sites-enabled/status
including configuration file /usr/local/etc/raddb/sites-enabled/eduroam
main {
security {
allow_core_dumps = no
}
}
main {
name = "radiusd"
prefix = "/usr/local"
localstatedir = "/usr/local/var"
sbindir = "/usr/local/sbin"
logdir = "/usr/local/var/log/radius"
run_dir = "/usr/local/var/run/radiusd"
libdir = "/usr/local/lib"
radacctdir = "/usr/local/var/log/radius/radacct"
hostname_lookups = no
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
pidfile = "/usr/local/var/run/radiusd/radiusd.pid"
checkrad = "/usr/local/sbin/checkrad"
debug_level = 0
proxy_requests = yes
log {
stripped_names = no
auth = no
auth_badpass = no
auth_goodpass = no
colourise = yes
msg_denied = "You are already logged in - access denied"
}
resources {
}
security {
max_attributes = 200
reject_delay = 1.000000
status_server = yes
allow_vulnerable_openssl = "yes"
}
}
radiusd: #### Loading Realms and Home Servers ####
proxy server {
retry_delay = 5
retry_count = 3
default_fallback = no
dead_time = 120
wake_all_if_all_dead = no
}
home_server eduroam0 {
ipaddr = roaming0.ja.net IPv4 address [194.82.174.185]
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server eduroam1 {
ipaddr = roaming1.ja.net IPv4 address [194.83.56.233]
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server eduroam2 {
ipaddr = roaming2.ja.net IPv4 address [194.83.56.249]
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server nps0 {
ipaddr = 10.0.38.3
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 30.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "none"
ping_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 300
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
home_server localhost {
ipaddr = 127.0.0.1
port = 1812
type = "auth"
secret = <<< secret >>>
response_window = 20.000000
response_timeouts = 1
max_outstanding = 65536
zombie_period = 40
status_check = "status-server"
ping_interval = 30
check_interval = 30
check_timeout = 4
num_answers_to_alive = 3
revive_interval = 120
limit {
max_connections = 16
max_requests = 0
lifetime = 0
idle_timeout = 0
}
coa {
irt = 2
mrt = 16
mrc = 5
mrd = 30
}
}
realm harper-adams.ac.uk {
}
realm live.harper.ac.uk {
}
realm hkvets.ac.uk {
}
realm students.hkvets.ac.uk {
}
home_server_pool eduroam {
type = client-port-balance
home_server = eduroam0
home_server = eduroam1
home_server = eduroam2
}
realm eduroam {
auth_pool = eduroam
nostrip
}
home_server_pool nps {
type = client-port-balance
home_server = nps0
}
realm nps {
auth_pool = nps
}
home_server_pool my_auth_failover {
type = fail-over
home_server = localhost
}
realm example.com {
auth_pool = my_auth_failover
}
realm LOCAL {
}
radiusd: #### Loading Clients ####
client 10.0.71.71/24 {
ipaddr = 10.0.71.71
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.30.120 {
ipaddr = 192.168.30.120
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.30.121 {
ipaddr = 192.168.30.121
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client roaming0.ja.net {
ipaddr = roaming0.ja.net IPv4 address [194.82.174.185]
require_message_authenticator = no
secret = <<< secret >>>
shortname = "roaming0.ja.net"
virtual_server = "eduroam"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client roaming1.ja.net {
ipaddr = roaming1.ja.net IPv4 address [194.83.56.233]
require_message_authenticator = no
secret = <<< secret >>>
shortname = "roaming1.ja.net"
virtual_server = "eduroam"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client roaming2.ja.net {
ipaddr = roaming2.ja.net IPv4 address [194.83.56.249]
require_message_authenticator = no
secret = <<< secret >>>
shortname = "roaming2.ja.net"
virtual_server = "eduroam"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client 192.168.10.1 {
ipaddr = 192.168.10.1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client nps {
ipaddr = 10.0.38.3
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
nas_type = "other"
proto = "*"
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
client localhost_ipv6 {
ipv6addr = ::1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
Debugger not attached
# Creating Auth-Type = digest
# Creating Autz-Type = Status-Server
radiusd: #### Instantiating modules ####
instantiate {
}
modules {
# Loaded module rlm_mschap
# Instantiating module "keele" from file /usr/local/etc/raddb/radiusd.conf
mschap keele {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=mercia.keele.ac.uk --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
passchange {
}
allow_retry = yes
}
rlm_mschap (keele): authenticating by calling 'ntlm_auth'
# Loaded module rlm_cache
# Instantiating module "cache_eap" from file /usr/local/etc/raddb/mods-enabled/cache_eap
cache cache_eap {
driver = "rlm_cache_rbtree"
key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
ttl = 15
max_entries = 0
epoch = 0
add_stats = no
}
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
# Loaded module rlm_realm
# Instantiating module "IPASS" from file /usr/local/etc/raddb/mods-enabled/realm
realm IPASS {
format = "prefix"
delimiter = "/"
ignore_default = no
ignore_null = no
}
# Instantiating module "suffix" from file /usr/local/etc/raddb/mods-enabled/realm
realm suffix {
format = "suffix"
delimiter = "@"
ignore_default = no
ignore_null = no
}
# Instantiating module "realmpercent" from file /usr/local/etc/raddb/mods-enabled/realm
realm realmpercent {
format = "suffix"
delimiter = "%"
ignore_default = no
ignore_null = no
}
# Instantiating module "ntdomain" from file /usr/local/etc/raddb/mods-enabled/realm
realm ntdomain {
format = "prefix"
delimiter = "\\"
ignore_default = no
ignore_null = no
}
# Loaded module rlm_eap
# Instantiating module "eap" from file /usr/local/etc/raddb/mods-enabled/eap
eap {
default_eap_type = "peap"
timer_expire = 60
ignore_unknown_eap_types = no
mod_accounting_username_bug = no
max_sessions = 1024
}
# Linked to sub-module rlm_eap_md5
# Linked to sub-module rlm_eap_leap
# Linked to sub-module rlm_eap_gtc
gtc {
challenge = "Password: "
auth_type = "PAP"
}
# Linked to sub-module rlm_eap_tls
tls {
tls = "tls-common"
}
tls-config tls-common {
rsa_key_exchange = no
dh_key_exchange = yes
rsa_key_length = 512
dh_key_length = 512
verify_depth = 0
ca_path = "/usr/local/etc/raddb/certs"
pem_file_type = yes
private_key_file = "/usr/local/etc/raddb/certs/server.pem"
certificate_file = "/usr/local/etc/raddb/certs/server.pem"
ca_file = "/usr/local/etc/raddb/certs/ca.pem"
private_key_password = <<< secret >>>
dh_file = "/usr/local/etc/raddb/certs/dh"
fragment_size = 1024
include_length = yes
check_crl = no
cipher_list = "DEFAULT"
ecdh_curve = "prime256v1"
cache {
enable = yes
lifetime = 24
max_entries = 255
}
verify {
}
ocsp {
enable = no
override_cert_url = yes
url = "http://127.0.0.1/ocsp/"
use_nonce = yes
timeout = 0
softfail = no
}
}
# Linked to sub-module rlm_eap_ttls
ttls {
tls = "tls-common"
default_eap_type = "md5"
copy_request_to_tunnel = yes
use_tunneled_reply = yes
virtual_server = "inner-tunnel"
include_length = yes
require_client_cert = no
}
Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_peap
peap {
tls = "tls-common"
default_method = "mschapv2"
copy_request_to_tunnel = yes
use_tunneled_reply = yes
proxy_tunneled_request_as_eap = yes
virtual_server = "inner-tunnel"
soh = no
require_client_cert = no
}
Using cached TLS configuration from previous invocation
# Linked to sub-module rlm_eap_mschapv2
mschapv2 {
with_ntdomain_hack = no
send_error = no
}
# Loaded module rlm_exec
# Instantiating module "exec" from file /usr/local/etc/raddb/mods-enabled/exec
exec {
wait = no
input_pairs = "request"
shell_escape = yes
timeout = 10
}
# Loaded module rlm_dhcp
# Instantiating module "dhcp" from file /usr/local/etc/raddb/mods-enabled/dhcp
# Loaded module rlm_logintime
# Instantiating module "logintime" from file /usr/local/etc/raddb/mods-enabled/logintime
logintime {
minimum_timeout = 60
}
# Loaded module rlm_linelog
# Instantiating module "default_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog default_server_log {
filename = "/usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "default_server_log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "eduroam_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog eduroam_server_log {
filename = "/usr/local/var/log/radius/radacct/eduroam_server_log/eduroam_server_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "eduroam_server_log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "inner_tunnel_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog inner_tunnel_server_log {
filename = "/usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "accounting_server_log" from file /usr/local/etc/raddb/mods-enabled/server_log
linelog accounting_server_log {
filename = "/usr/local/var/log/radius/radacct/accounting_server_log/accounting_log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "%S#%{User-Name}#%{Framed-IP-Address}#%{Calling-Station-Id}#"
}
# Loaded module rlm_dynamic_clients
# Instantiating module "dynamic_clients" from file /usr/local/etc/raddb/mods-enabled/dynamic_clients
# Loaded module rlm_detail
# Instantiating module "auth_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail auth_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
# Instantiating module "reply_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail reply_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Instantiating module "pre_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail pre_proxy_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Instantiating module "post_proxy_log" from file /usr/local/etc/raddb/mods-enabled/detail.log
detail post_proxy_log {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Loaded module rlm_chap
# Instantiating module "chap" from file /usr/local/etc/raddb/mods-enabled/chap
# Instantiating module "on-site-internal-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog on-site-internal-accept-log {
filename = "/usr/local/var/log/radius/radacct/on-site-internal-accept-log/on-site-internal-accept-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "on-site-internal-accept-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "on-site-external-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog on-site-external-accept-log {
filename = "/usr/local/var/log/radius/radacct/on-site-external-accept-log/on-site-external-accept-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "on-site-external-accept-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "on-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog on-site-reject-log {
filename = "/usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "on-site-reject-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "off-site-accept-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog off-site-accept-log {
filename = "/usr/local/var/log/radius/radacct/off-site-accept-log/off-site-accept-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "off-site-accept-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "off-site-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog off-site-reject-log {
filename = "/usr/local/var/log/radius/radacct/off-site-reject-log/off-site-reject-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "off-site-reject-log.%{%{reply:Packet-Type}:-format}"
}
# Instantiating module "off-site-eduroam-support-reject-log" from file /usr/local/etc/raddb/mods-enabled/extended_logging
linelog off-site-eduroam-support-reject-log {
filename = "/usr/local/var/log/radius/radacct/off-site-eduroam-support-reject-log/off-site-eduroam-support-reject-log-%Y%m%d"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "off-site-eduroam-support-reject-log.%{%{reply:Packet-Type}:-format}"
}
# Loaded module rlm_always
# Instantiating module "reject" from file /usr/local/etc/raddb/mods-enabled/always
always reject {
rcode = "reject"
simulcount = 0
mpp = no
}
# Instantiating module "fail" from file /usr/local/etc/raddb/mods-enabled/always
always fail {
rcode = "fail"
simulcount = 0
mpp = no
}
# Instantiating module "ok" from file /usr/local/etc/raddb/mods-enabled/always
always ok {
rcode = "ok"
simulcount = 0
mpp = no
}
# Instantiating module "handled" from file /usr/local/etc/raddb/mods-enabled/always
always handled {
rcode = "handled"
simulcount = 0
mpp = no
}
# Instantiating module "invalid" from file /usr/local/etc/raddb/mods-enabled/always
always invalid {
rcode = "invalid"
simulcount = 0
mpp = no
}
# Instantiating module "userlock" from file /usr/local/etc/raddb/mods-enabled/always
always userlock {
rcode = "userlock"
simulcount = 0
mpp = no
}
# Instantiating module "notfound" from file /usr/local/etc/raddb/mods-enabled/always
always notfound {
rcode = "notfound"
simulcount = 0
mpp = no
}
# Instantiating module "noop" from file /usr/local/etc/raddb/mods-enabled/always
always noop {
rcode = "noop"
simulcount = 0
mpp = no
}
# Instantiating module "updated" from file /usr/local/etc/raddb/mods-enabled/always
always updated {
rcode = "updated"
simulcount = 0
mpp = no
}
# Loaded module rlm_replicate
# Instantiating module "replicate" from file /usr/local/etc/raddb/mods-enabled/replicate
# Loaded module rlm_soh
# Instantiating module "soh" from file /usr/local/etc/raddb/mods-enabled/soh
soh {
dhcp = yes
}
# Loaded module rlm_files
# Instantiating module "files" from file /usr/local/etc/raddb/mods-enabled/files
files {
filename = "/usr/local/etc/raddb/mods-config/files/authorize"
acctusersfile = "/usr/local/etc/raddb/mods-config/files/accounting"
preproxy_usersfile = "/usr/local/etc/raddb/mods-config/files/pre-proxy"
compat = "cistron"
}
reading pairlist file /usr/local/etc/raddb/mods-config/files/authorize
[/usr/local/etc/raddb/mods-config/files/authorize]:1 Cistron compatibility checks for entry username at harper-adams.ac.uk ...
[/usr/local/etc/raddb/mods-config/files/authorize]:184 Cistron compatibility checks for entry DEFAULT ...
[/usr/local/etc/raddb/mods-config/files/authorize]:191 Cistron compatibility checks for entry DEFAULT ...
[/usr/local/etc/raddb/mods-config/files/authorize]:197 Cistron compatibility checks for entry DEFAULT ...
reading pairlist file /usr/local/etc/raddb/mods-config/files/accounting
reading pairlist file /usr/local/etc/raddb/mods-config/files/pre-proxy
# Loaded module rlm_passwd
# Instantiating module "etc_passwd" from file /usr/local/etc/raddb/mods-enabled/passwd
passwd etc_passwd {
filename = "/etc/passwd"
format = "*User-Name:Crypt-Password:"
delimiter = ":"
ignore_nislike = no
ignore_empty = yes
allow_multiple_keys = no
hash_size = 100
}
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
# Instantiating module "detail" from file /usr/local/etc/raddb/mods-enabled/detail
detail {
filename = "/usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
header = "%t"
permissions = 384
locking = no
escape_filenames = no
log_packet_header = no
}
# Instantiating module "mschap" from file /usr/local/etc/raddb/mods-enabled/mschap
mschap {
use_mppe = yes
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-harper-adams.ac.uk} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
passchange {
}
allow_retry = yes
}
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
# Instantiating module "echo" from file /usr/local/etc/raddb/mods-enabled/echo
exec echo {
wait = yes
program = "/bin/echo %{User-Name}"
input_pairs = "request"
output_pairs = "reply"
shell_escape = yes
}
# Loaded module rlm_expiration
# Instantiating module "expiration" from file /usr/local/etc/raddb/mods-enabled/expiration
# Loaded module rlm_unpack
# Instantiating module "unpack" from file /usr/local/etc/raddb/mods-enabled/unpack
# Loaded module rlm_preprocess
# Instantiating module "preprocess" from file /usr/local/etc/raddb/mods-enabled/preprocess
preprocess {
huntgroups = "/usr/local/etc/raddb/mods-config/preprocess/huntgroups"
hints = "/usr/local/etc/raddb/mods-config/preprocess/hints"
with_ascend_hack = no
ascend_channels_per_line = 23
with_ntdomain_hack = no
with_specialix_jetstream_hack = no
with_cisco_vsa_hack = no
with_alvarion_vsa_hack = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/huntgroups
reading pairlist file /usr/local/etc/raddb/mods-config/preprocess/hints
# Loaded module rlm_radutmp
# Instantiating module "radutmp" from file /usr/local/etc/raddb/mods-enabled/radutmp
radutmp {
filename = "/usr/local/var/log/radius/radutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 384
caller_id = yes
}
# Loaded module rlm_attr_filter
# Instantiating module "attr_filter.post-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.post-proxy {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/post-proxy"
key = "%{Realm}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/post-proxy
# Instantiating module "attr_filter.pre-proxy" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.pre-proxy {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/pre-proxy"
key = "%{Realm}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/pre-proxy
# Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_reject {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_reject"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_reject
# Instantiating module "attr_filter.access_challenge" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.access_challenge {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/access_challenge"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/access_challenge
# Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/mods-enabled/attr_filter
attr_filter attr_filter.accounting_response {
filename = "/usr/local/etc/raddb/mods-config/attr_filter/accounting_response"
key = "%{User-Name}"
relaxed = no
}
reading pairlist file /usr/local/etc/raddb/mods-config/attr_filter/accounting_response
# Loaded module rlm_unix
# Instantiating module "unix" from file /usr/local/etc/raddb/mods-enabled/unix
unix {
radwtmp = "/usr/local/var/log/radius/radwtmp"
}
# Instantiating module "sradutmp" from file /usr/local/etc/raddb/mods-enabled/sradutmp
radutmp sradutmp {
filename = "/usr/local/var/log/radius/sradutmp"
username = "%{User-Name}"
case_sensitive = yes
check_with_nas = yes
permissions = 420
caller_id = no
}
# Loaded module rlm_digest
# Instantiating module "digest" from file /usr/local/etc/raddb/mods-enabled/digest
# Loaded module rlm_expr
# Instantiating module "expr" from file /usr/local/etc/raddb/mods-enabled/expr
expr {
safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
}
# Instantiating module "ntlm_auth" from file /usr/local/etc/raddb/mods-enabled/ntlm_auth
exec ntlm_auth {
wait = yes
program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
shell_escape = yes
}
# Loaded module rlm_pap
# Instantiating module "pap" from file /usr/local/etc/raddb/mods-enabled/pap
pap {
normalise = yes
}
# Loaded module rlm_utf8
# Instantiating module "utf8" from file /usr/local/etc/raddb/mods-enabled/utf8
# Instantiating module "linelog" from file /usr/local/etc/raddb/mods-enabled/linelog
linelog {
filename = "/usr/local/var/log/radius/linelog"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = "This is a log message for %{User-Name}"
reference = "messages.%{%{Packet-Type}:-default}"
}
# Instantiating module "log_accounting" from file /usr/local/etc/raddb/mods-enabled/linelog
linelog log_accounting {
filename = "/usr/local/var/log/radius/linelog-accounting"
escape_filenames = no
syslog_severity = "info"
permissions = 384
format = ""
reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
}
} # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /usr/local/etc/raddb/radiusd.conf
} # server
server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
# Loading authenticate {...}
# Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
Ignoring "ldap" (see raddb/mods-available/README.rst)
# Loading session {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server inner-tunnel
server default { # from file /usr/local/etc/raddb/sites-enabled/default
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server default
server status { # from file /usr/local/etc/raddb/sites-enabled/status
# Loading authorize {...}
} # server status
server eduroam { # from file /usr/local/etc/raddb/sites-enabled/eduroam
# Loading authenticate {...}
# Loading authorize {...}
# Loading preacct {...}
# Loading accounting {...}
# Loading pre-proxy {...}
# Loading post-proxy {...}
# Loading post-auth {...}
} # server eduroam
/usr/local/etc/raddb/sites-enabled/default[705] Please change %{Realm}} to &Realm}
radiusd: #### Opening IP addresses and Ports ####
listen {
type = "auth"
ipaddr = 127.0.0.1
port = 18120
}
listen {
type = "auth"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipaddr = *
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "auth"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "acct"
ipv6addr = ::
port = 0
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
listen {
type = "status"
ipaddr = 127.0.0.1
port = 18121
client admin {
ipaddr = 127.0.0.1
require_message_authenticator = no
secret = <<< secret >>>
limit {
max_connections = 16
lifetime = 0
idle_timeout = 30
}
}
}
Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on status address 127.0.0.1 port 18121 bound to server status
Opening new proxy socket 'proxy address * port 0'
Listening on proxy address * port 54558
Ready to process requests
(0) Received Access-Request Id 66 from 192.168.30.121:59063 to 192.168.10.211:1812 length 228
(0) User-Name = '00703070 at harper-adams.ac.uk'
(0) NAS-IP-Address = 192.168.30.121
(0) NAS-Port = 0
(0) NAS-Identifier = '192.168.30.121'
(0) NAS-Port-Type = Wireless-802.11
(0) Calling-Station-Id = '96006F089222'
(0) Called-Station-Id = '001A1E01CF58'
(0) Service-Type = Framed-User
(0) Framed-MTU = 1100
(0) EAP-Message = 0x02010020013030373033303730406861727065722d6164616d732e61632e756b
(0) Aruba-Essid-Name = 'eduroam'
(0) Aruba-Location-Id = 'CETLfoyer_AP01'
(0) Aruba-AP-Group = 'apg-comp'
(0) Message-Authenticator = 0xeea556b9e161ae9c916574dcf448efa7
(0) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(0) authorize {
(0) policy eduroam_filter {
(0) if (User-Name !~ /@/) {
(0) if (User-Name !~ /@/) -> FALSE
(0) if ("%{User-Name}" =~ /@$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070 at harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /@$/) -> FALSE
(0) if ("%{User-Name}" =~ /@gmail\.com$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070 at harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(0) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070 at harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(0) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070 at harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(0) } # policy eduroam_filter = notfound
(0) [preprocess] = ok
(0) policy operator-name.authorize {
(0) if ("%{client:Operator-Name}") {
(0) EXPAND %{client:Operator-Name}
(0) --> 1harper-adams.ac.uk
(0) if ("%{client:Operator-Name}") -> TRUE
(0) if ("%{client:Operator-Name}") {
(0) update request {
(0) EXPAND %{client:Operator-Name}
(0) --> 1harper-adams.ac.uk
(0) &Operator-Name = 1harper-adams.ac.uk
(0) } # update request = noop
(0) } # if ("%{client:Operator-Name}") = noop
(0) } # policy operator-name.authorize = noop
(0) policy cui.authorize {
(0) if ("%{client:add_cui}" == 'yes') {
(0) EXPAND %{client:add_cui}
(0) --> yes
(0) if ("%{client:add_cui}" == 'yes') -> TRUE
(0) if ("%{client:add_cui}" == 'yes') {
(0) update request {
(0) &Chargeable-User-Identity := 0x00
(0) } # update request = noop
(0) } # if ("%{client:add_cui}" == 'yes') = noop
(0) } # policy cui.authorize = noop
(0) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070 at harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(0) else {
(0) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(0) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(0) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(0) auth_log: EXPAND %t
(0) auth_log: --> Mon Sep 7 19:55:28 2020
(0) [auth_log] = ok
(0) } # else = ok
(0) [chap] = noop
(0) [mschap] = noop
(0) [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(0) suffix: Found realm "harper-adams.ac.uk"
(0) suffix: Adding Stripped-User-Name = "00703070"
(0) suffix: Adding Realm = "harper-adams.ac.uk"
(0) suffix: Authentication realm is LOCAL
(0) [suffix] = ok
(0) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(0) EXPAND %{User-Name}
(0) --> 00703070 at harper-adams.ac.uk
(0) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(0) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(0) [noop] = noop
(0) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(0) ... skipping elsif for request 0: Preceding "if" was taken
(0) ... skipping elsif for request 0: Preceding "if" was taken
(0) ... skipping elsif for request 0: Preceding "if" was taken
(0) ... skipping else for request 0: Preceding "if" was taken
(0) eap: Peer sent code Response (2) ID 1 length 32
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(0) [eap] = ok
(0) } # authorize = ok
(0) Found Auth-Type = EAP
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) authenticate {
(0) eap: Peer sent method Identity (1)
(0) eap: Calling eap_peap to process EAP data
(0) eap_peap: Flushing SSL sessions (of #0)
(0) eap_peap: Initiate
(0) eap_peap: Start returned 1
(0) eap: EAP session adding &reply:State = 0x5d232d885d2134dd
(0) [eap] = handled
(0) } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) Post-Auth-Type sub-section not found. Ignoring.
(0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(0) Sent Access-Challenge Id 66 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(0) EAP-Message = 0x010200061920
(0) Message-Authenticator = 0x00000000000000000000000000000000
(0) State = 0x5d232d885d2134dd60443f4cd8d35175
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 36 from 192.168.30.121:59063 to 192.168.10.211:1812 length 365
(1) User-Name = '00703070 at harper-adams.ac.uk'
(1) NAS-IP-Address = 192.168.30.121
(1) NAS-Port = 0
(1) NAS-Identifier = '192.168.30.121'
(1) NAS-Port-Type = Wireless-802.11
(1) Calling-Station-Id = '96006F089222'
(1) Called-Station-Id = '001A1E01CF58'
(1) Service-Type = Framed-User
(1) Framed-MTU = 1100
(1) EAP-Message = 0x0202009719800000008d16030100880100008403033d6bb98ca56f708bfefc5724df297400c611b45f02b6135a065b604a87f97e4d000028c02bc02fc02cc030cca9cca8c009c013c00ac014c007c011009c009d002f003c0035003d0005000a0100003300170000ff01000100000a00080006001d0017
(1) State = 0x5d232d885d2134dd60443f4cd8d35175
(1) Aruba-Essid-Name = 'eduroam'
(1) Aruba-Location-Id = 'CETLfoyer_AP01'
(1) Aruba-AP-Group = 'apg-comp'
(1) Message-Authenticator = 0x221852c8ef612ff7a655f72f18256d56
(1) session-state: No cached attributes
(1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(1) authorize {
(1) policy eduroam_filter {
(1) if (User-Name !~ /@/) {
(1) if (User-Name !~ /@/) -> FALSE
(1) if ("%{User-Name}" =~ /@$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070 at harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /@$/) -> FALSE
(1) if ("%{User-Name}" =~ /@gmail\.com$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070 at harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(1) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070 at harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(1) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070 at harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(1) } # policy eduroam_filter = notfound
(1) [preprocess] = ok
(1) policy operator-name.authorize {
(1) if ("%{client:Operator-Name}") {
(1) EXPAND %{client:Operator-Name}
(1) --> 1harper-adams.ac.uk
(1) if ("%{client:Operator-Name}") -> TRUE
(1) if ("%{client:Operator-Name}") {
(1) update request {
(1) EXPAND %{client:Operator-Name}
(1) --> 1harper-adams.ac.uk
(1) &Operator-Name = 1harper-adams.ac.uk
(1) } # update request = noop
(1) } # if ("%{client:Operator-Name}") = noop
(1) } # policy operator-name.authorize = noop
(1) policy cui.authorize {
(1) if ("%{client:add_cui}" == 'yes') {
(1) EXPAND %{client:add_cui}
(1) --> yes
(1) if ("%{client:add_cui}" == 'yes') -> TRUE
(1) if ("%{client:add_cui}" == 'yes') {
(1) update request {
(1) &Chargeable-User-Identity := 0x00
(1) } # update request = noop
(1) } # if ("%{client:add_cui}" == 'yes') = noop
(1) } # policy cui.authorize = noop
(1) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070 at harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(1) else {
(1) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(1) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(1) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(1) auth_log: EXPAND %t
(1) auth_log: --> Mon Sep 7 19:55:28 2020
(1) [auth_log] = ok
(1) } # else = ok
(1) [chap] = noop
(1) [mschap] = noop
(1) [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(1) suffix: Found realm "harper-adams.ac.uk"
(1) suffix: Adding Stripped-User-Name = "00703070"
(1) suffix: Adding Realm = "harper-adams.ac.uk"
(1) suffix: Authentication realm is LOCAL
(1) [suffix] = ok
(1) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(1) EXPAND %{User-Name}
(1) --> 00703070 at harper-adams.ac.uk
(1) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(1) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(1) [noop] = noop
(1) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(1) ... skipping elsif for request 1: Preceding "if" was taken
(1) ... skipping elsif for request 1: Preceding "if" was taken
(1) ... skipping elsif for request 1: Preceding "if" was taken
(1) ... skipping else for request 1: Preceding "if" was taken
(1) eap: Peer sent code Response (2) ID 2 length 151
(1) eap: Continuing tunnel setup
(1) [eap] = ok
(1) } # authorize = ok
(1) Found Auth-Type = EAP
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) authenticate {
(1) eap: Expiring EAP session with state 0x5d232d885d2134dd
(1) eap: Finished EAP session with state 0x5d232d885d2134dd
(1) eap: Previous EAP request found for state 0x5d232d885d2134dd, released from the list
(1) eap: Peer sent method PEAP (25)
(1) eap: EAP PEAP (25)
(1) eap: Calling eap_peap to process EAP data
(1) eap_peap: processing EAP-TLS
(1) eap_peap: TLS Length 141
(1) eap_peap: Length Included
(1) eap_peap: eaptls_verify returned 11
(1) eap_peap: (other): before/accept initialization
(1) eap_peap: TLS_accept: before/accept initialization
(1) eap_peap: <<< TLS 1.2 [length 0088]
(1) eap_peap: TLS_accept: SSLv3 read client hello A
(1) eap_peap: >>> TLS 1.2 [length 0059]
(1) eap_peap: TLS_accept: SSLv3 write server hello A
(1) eap_peap: >>> TLS 1.2 [length 098e]
(1) eap_peap: TLS_accept: SSLv3 write certificate A
(1) eap_peap: >>> TLS 1.2 [length 014d]
(1) eap_peap: TLS_accept: SSLv3 write key exchange A
(1) eap_peap: >>> TLS 1.2 [length 0004]
(1) eap_peap: TLS_accept: SSLv3 write server done A
(1) eap_peap: TLS_accept: SSLv3 flush data
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A
(1) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
(1) eap_peap: eaptls_process returned 13
(1) eap_peap: FR_TLS_HANDLED
(1) eap: EAP session adding &reply:State = 0x5d232d885c2034dd
(1) [eap] = handled
(1) } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) Post-Auth-Type sub-section not found. Ignoring.
(1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(1) Sent Access-Challenge Id 36 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(1) EAP-Message = 0x010303ec19c000000b4c16030300590200005503035f5682202fb7a02869ff5572887e4559c92fea1887530f7a4ce236db46270e3e205c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08cc02f00000dff01000100000b000403000102160303098e0b00098a000987000430
(1) Message-Authenticator = 0x00000000000000000000000000000000
(1) State = 0x5d232d885c2034dd60443f4cd8d35175
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 101 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(2) User-Name = '00703070 at harper-adams.ac.uk'
(2) NAS-IP-Address = 192.168.30.121
(2) NAS-Port = 0
(2) NAS-Identifier = '192.168.30.121'
(2) NAS-Port-Type = Wireless-802.11
(2) Calling-Station-Id = '96006F089222'
(2) Called-Station-Id = '001A1E01CF58'
(2) Service-Type = Framed-User
(2) Framed-MTU = 1100
(2) EAP-Message = 0x020300061900
(2) State = 0x5d232d885c2034dd60443f4cd8d35175
(2) Aruba-Essid-Name = 'eduroam'
(2) Aruba-Location-Id = 'CETLfoyer_AP01'
(2) Aruba-AP-Group = 'apg-comp'
(2) Message-Authenticator = 0x4a33f9c19d7d272caf3b88dd8235def4
(2) session-state: No cached attributes
(2) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(2) authorize {
(2) policy eduroam_filter {
(2) if (User-Name !~ /@/) {
(2) if (User-Name !~ /@/) -> FALSE
(2) if ("%{User-Name}" =~ /@$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070 at harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /@$/) -> FALSE
(2) if ("%{User-Name}" =~ /@gmail\.com$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070 at harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(2) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070 at harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(2) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070 at harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(2) } # policy eduroam_filter = notfound
(2) [preprocess] = ok
(2) policy operator-name.authorize {
(2) if ("%{client:Operator-Name}") {
(2) EXPAND %{client:Operator-Name}
(2) --> 1harper-adams.ac.uk
(2) if ("%{client:Operator-Name}") -> TRUE
(2) if ("%{client:Operator-Name}") {
(2) update request {
(2) EXPAND %{client:Operator-Name}
(2) --> 1harper-adams.ac.uk
(2) &Operator-Name = 1harper-adams.ac.uk
(2) } # update request = noop
(2) } # if ("%{client:Operator-Name}") = noop
(2) } # policy operator-name.authorize = noop
(2) policy cui.authorize {
(2) if ("%{client:add_cui}" == 'yes') {
(2) EXPAND %{client:add_cui}
(2) --> yes
(2) if ("%{client:add_cui}" == 'yes') -> TRUE
(2) if ("%{client:add_cui}" == 'yes') {
(2) update request {
(2) &Chargeable-User-Identity := 0x00
(2) } # update request = noop
(2) } # if ("%{client:add_cui}" == 'yes') = noop
(2) } # policy cui.authorize = noop
(2) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070 at harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(2) else {
(2) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(2) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(2) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(2) auth_log: EXPAND %t
(2) auth_log: --> Mon Sep 7 19:55:28 2020
(2) [auth_log] = ok
(2) } # else = ok
(2) [chap] = noop
(2) [mschap] = noop
(2) [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(2) suffix: Found realm "harper-adams.ac.uk"
(2) suffix: Adding Stripped-User-Name = "00703070"
(2) suffix: Adding Realm = "harper-adams.ac.uk"
(2) suffix: Authentication realm is LOCAL
(2) [suffix] = ok
(2) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(2) EXPAND %{User-Name}
(2) --> 00703070 at harper-adams.ac.uk
(2) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(2) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(2) [noop] = noop
(2) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(2) ... skipping elsif for request 2: Preceding "if" was taken
(2) ... skipping elsif for request 2: Preceding "if" was taken
(2) ... skipping elsif for request 2: Preceding "if" was taken
(2) ... skipping else for request 2: Preceding "if" was taken
(2) eap: Peer sent code Response (2) ID 3 length 6
(2) eap: Continuing tunnel setup
(2) [eap] = ok
(2) } # authorize = ok
(2) Found Auth-Type = EAP
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) authenticate {
(2) eap: Expiring EAP session with state 0x5d232d885c2034dd
(2) eap: Finished EAP session with state 0x5d232d885c2034dd
(2) eap: Previous EAP request found for state 0x5d232d885c2034dd, released from the list
(2) eap: Peer sent method PEAP (25)
(2) eap: EAP PEAP (25)
(2) eap: Calling eap_peap to process EAP data
(2) eap_peap: processing EAP-TLS
(2) eap_peap: Received TLS ACK
(2) eap_peap: Received TLS ACK
(2) eap_peap: ACK handshake fragment handler
(2) eap_peap: eaptls_verify returned 1
(2) eap_peap: eaptls_process returned 13
(2) eap_peap: FR_TLS_HANDLED
(2) eap: EAP session adding &reply:State = 0x5d232d885f2734dd
(2) [eap] = handled
(2) } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) Post-Auth-Type sub-section not found. Ignoring.
(2) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(2) Sent Access-Challenge Id 101 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(2) EAP-Message = 0x010403e81940c62d385a960250f6b378ff612d4e0358d9e5148a4625e6eb2f327082ccac93595352448e797948d8e21b0e9ce3a327425387a40fd951a553641188a18a0043138afb9919c64efc9d62007450b116f5a314ea1febd84785af8dd231b48cbd10608dfaf8ba002ab346f2a6298790750a64a3
(2) Message-Authenticator = 0x00000000000000000000000000000000
(2) State = 0x5d232d885f2734dd60443f4cd8d35175
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 246 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(3) User-Name = '00703070 at harper-adams.ac.uk'
(3) NAS-IP-Address = 192.168.30.121
(3) NAS-Port = 0
(3) NAS-Identifier = '192.168.30.121'
(3) NAS-Port-Type = Wireless-802.11
(3) Calling-Station-Id = '96006F089222'
(3) Called-Station-Id = '001A1E01CF58'
(3) Service-Type = Framed-User
(3) Framed-MTU = 1100
(3) EAP-Message = 0x020400061900
(3) State = 0x5d232d885f2734dd60443f4cd8d35175
(3) Aruba-Essid-Name = 'eduroam'
(3) Aruba-Location-Id = 'CETLfoyer_AP01'
(3) Aruba-AP-Group = 'apg-comp'
(3) Message-Authenticator = 0xf2cc65af35bb01ad9e3dad5a7462c71d
(3) session-state: No cached attributes
(3) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(3) authorize {
(3) policy eduroam_filter {
(3) if (User-Name !~ /@/) {
(3) if (User-Name !~ /@/) -> FALSE
(3) if ("%{User-Name}" =~ /@$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070 at harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /@$/) -> FALSE
(3) if ("%{User-Name}" =~ /@gmail\.com$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070 at harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(3) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070 at harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(3) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070 at harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(3) } # policy eduroam_filter = notfound
(3) [preprocess] = ok
(3) policy operator-name.authorize {
(3) if ("%{client:Operator-Name}") {
(3) EXPAND %{client:Operator-Name}
(3) --> 1harper-adams.ac.uk
(3) if ("%{client:Operator-Name}") -> TRUE
(3) if ("%{client:Operator-Name}") {
(3) update request {
(3) EXPAND %{client:Operator-Name}
(3) --> 1harper-adams.ac.uk
(3) &Operator-Name = 1harper-adams.ac.uk
(3) } # update request = noop
(3) } # if ("%{client:Operator-Name}") = noop
(3) } # policy operator-name.authorize = noop
(3) policy cui.authorize {
(3) if ("%{client:add_cui}" == 'yes') {
(3) EXPAND %{client:add_cui}
(3) --> yes
(3) if ("%{client:add_cui}" == 'yes') -> TRUE
(3) if ("%{client:add_cui}" == 'yes') {
(3) update request {
(3) &Chargeable-User-Identity := 0x00
(3) } # update request = noop
(3) } # if ("%{client:add_cui}" == 'yes') = noop
(3) } # policy cui.authorize = noop
(3) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070 at harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(3) else {
(3) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(3) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(3) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(3) auth_log: EXPAND %t
(3) auth_log: --> Mon Sep 7 19:55:28 2020
(3) [auth_log] = ok
(3) } # else = ok
(3) [chap] = noop
(3) [mschap] = noop
(3) [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(3) suffix: Found realm "harper-adams.ac.uk"
(3) suffix: Adding Stripped-User-Name = "00703070"
(3) suffix: Adding Realm = "harper-adams.ac.uk"
(3) suffix: Authentication realm is LOCAL
(3) [suffix] = ok
(3) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(3) EXPAND %{User-Name}
(3) --> 00703070 at harper-adams.ac.uk
(3) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(3) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(3) [noop] = noop
(3) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(3) ... skipping elsif for request 3: Preceding "if" was taken
(3) ... skipping elsif for request 3: Preceding "if" was taken
(3) ... skipping elsif for request 3: Preceding "if" was taken
(3) ... skipping else for request 3: Preceding "if" was taken
(3) eap: Peer sent code Response (2) ID 4 length 6
(3) eap: Continuing tunnel setup
(3) [eap] = ok
(3) } # authorize = ok
(3) Found Auth-Type = EAP
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) authenticate {
(3) eap: Expiring EAP session with state 0x5d232d885f2734dd
(3) eap: Finished EAP session with state 0x5d232d885f2734dd
(3) eap: Previous EAP request found for state 0x5d232d885f2734dd, released from the list
(3) eap: Peer sent method PEAP (25)
(3) eap: EAP PEAP (25)
(3) eap: Calling eap_peap to process EAP data
(3) eap_peap: processing EAP-TLS
(3) eap_peap: Received TLS ACK
(3) eap_peap: Received TLS ACK
(3) eap_peap: ACK handshake fragment handler
(3) eap_peap: eaptls_verify returned 1
(3) eap_peap: eaptls_process returned 13
(3) eap_peap: FR_TLS_HANDLED
(3) eap: EAP session adding &reply:State = 0x5d232d885e2634dd
(3) [eap] = handled
(3) } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) Post-Auth-Type sub-section not found. Ignoring.
(3) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(3) Sent Access-Challenge Id 246 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(3) EAP-Message = 0x0105038e1900f6e330ad8b0cf435a181bda481ba3081b7310b3009060355040613024742311330110603550408130a5368726f7073686972653110300e060355040713074e6577706f72743120301e060355040a1317486172706572204164616d7320556e69766572736974793130302e06092a864886
(3) Message-Authenticator = 0x00000000000000000000000000000000
(3) State = 0x5d232d885e2634dd60443f4cd8d35175
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 93 from 192.168.30.121:59063 to 192.168.10.211:1812 length 350
(4) User-Name = '00703070 at harper-adams.ac.uk'
(4) NAS-IP-Address = 192.168.30.121
(4) NAS-Port = 0
(4) NAS-Identifier = '192.168.30.121'
(4) NAS-Port-Type = Wireless-802.11
(4) Calling-Station-Id = '96006F089222'
(4) Called-Station-Id = '001A1E01CF58'
(4) Service-Type = Framed-User
(4) Framed-MTU = 1100
(4) EAP-Message = 0x0205008819800000007e1603030046100000424104ea56d436078e56e2ae2b44a72fce084ff89022001433c236008ea69f4edb350f1ca370aa1f2747dde6eca44f4c0da3dc9a19cacbdb7a2dd9dd517c8db718015114030300010116030300280000000000000000710ce2eedf52a18519e02d3291cf76
(4) State = 0x5d232d885e2634dd60443f4cd8d35175
(4) Aruba-Essid-Name = 'eduroam'
(4) Aruba-Location-Id = 'CETLfoyer_AP01'
(4) Aruba-AP-Group = 'apg-comp'
(4) Message-Authenticator = 0x3910c0df262016725b161488467b1bde
(4) session-state: No cached attributes
(4) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(4) authorize {
(4) policy eduroam_filter {
(4) if (User-Name !~ /@/) {
(4) if (User-Name !~ /@/) -> FALSE
(4) if ("%{User-Name}" =~ /@$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070 at harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /@$/) -> FALSE
(4) if ("%{User-Name}" =~ /@gmail\.com$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070 at harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(4) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070 at harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(4) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070 at harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(4) } # policy eduroam_filter = notfound
(4) [preprocess] = ok
(4) policy operator-name.authorize {
(4) if ("%{client:Operator-Name}") {
(4) EXPAND %{client:Operator-Name}
(4) --> 1harper-adams.ac.uk
(4) if ("%{client:Operator-Name}") -> TRUE
(4) if ("%{client:Operator-Name}") {
(4) update request {
(4) EXPAND %{client:Operator-Name}
(4) --> 1harper-adams.ac.uk
(4) &Operator-Name = 1harper-adams.ac.uk
(4) } # update request = noop
(4) } # if ("%{client:Operator-Name}") = noop
(4) } # policy operator-name.authorize = noop
(4) policy cui.authorize {
(4) if ("%{client:add_cui}" == 'yes') {
(4) EXPAND %{client:add_cui}
(4) --> yes
(4) if ("%{client:add_cui}" == 'yes') -> TRUE
(4) if ("%{client:add_cui}" == 'yes') {
(4) update request {
(4) &Chargeable-User-Identity := 0x00
(4) } # update request = noop
(4) } # if ("%{client:add_cui}" == 'yes') = noop
(4) } # policy cui.authorize = noop
(4) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070 at harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(4) else {
(4) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(4) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(4) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(4) auth_log: EXPAND %t
(4) auth_log: --> Mon Sep 7 19:55:28 2020
(4) [auth_log] = ok
(4) } # else = ok
(4) [chap] = noop
(4) [mschap] = noop
(4) [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(4) suffix: Found realm "harper-adams.ac.uk"
(4) suffix: Adding Stripped-User-Name = "00703070"
(4) suffix: Adding Realm = "harper-adams.ac.uk"
(4) suffix: Authentication realm is LOCAL
(4) [suffix] = ok
(4) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(4) EXPAND %{User-Name}
(4) --> 00703070 at harper-adams.ac.uk
(4) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(4) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(4) [noop] = noop
(4) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(4) ... skipping elsif for request 4: Preceding "if" was taken
(4) ... skipping elsif for request 4: Preceding "if" was taken
(4) ... skipping elsif for request 4: Preceding "if" was taken
(4) ... skipping else for request 4: Preceding "if" was taken
(4) eap: Peer sent code Response (2) ID 5 length 136
(4) eap: Continuing tunnel setup
(4) [eap] = ok
(4) } # authorize = ok
(4) Found Auth-Type = EAP
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) authenticate {
(4) eap: Expiring EAP session with state 0x5d232d885e2634dd
(4) eap: Finished EAP session with state 0x5d232d885e2634dd
(4) eap: Previous EAP request found for state 0x5d232d885e2634dd, released from the list
(4) eap: Peer sent method PEAP (25)
(4) eap: EAP PEAP (25)
(4) eap: Calling eap_peap to process EAP data
(4) eap_peap: processing EAP-TLS
(4) eap_peap: TLS Length 126
(4) eap_peap: Length Included
(4) eap_peap: eaptls_verify returned 11
(4) eap_peap: <<< TLS 1.2 [length 0046]
(4) eap_peap: TLS_accept: SSLv3 read client key exchange A
(4) eap_peap: <<< TLS 1.2 [length 0001]
(4) eap_peap: <<< TLS 1.2 [length 0010]
(4) eap_peap: TLS_accept: SSLv3 read finished A
(4) eap_peap: >>> TLS 1.2 [length 0001]
(4) eap_peap: TLS_accept: SSLv3 write change cipher spec A
(4) eap_peap: >>> TLS 1.2 [length 0010]
(4) eap_peap: TLS_accept: SSLv3 write finished A
(4) eap_peap: TLS_accept: SSLv3 flush data
TLS: adding session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c to cache
(4) eap_peap: (other): SSL negotiation finished successfully
SSL Connection Established
(4) eap_peap: eaptls_process returned 13
(4) eap_peap: FR_TLS_HANDLED
(4) eap: EAP session adding &reply:State = 0x5d232d88592534dd
(4) [eap] = handled
(4) } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) Post-Auth-Type sub-section not found. Ignoring.
(4) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(4) Sent Access-Challenge Id 93 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(4) EAP-Message = 0x0106003919001403030001011603030028dbf9a5fe6b58c9af4878bf5aad50c37591306f56a34e452abe46d4816656f7c59a7d672a722fba90
(4) Message-Authenticator = 0x00000000000000000000000000000000
(4) State = 0x5d232d88592534dd60443f4cd8d35175
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 254 from 192.168.30.121:59063 to 192.168.10.211:1812 length 220
(5) User-Name = '00703070 at harper-adams.ac.uk'
(5) NAS-IP-Address = 192.168.30.121
(5) NAS-Port = 0
(5) NAS-Identifier = '192.168.30.121'
(5) NAS-Port-Type = Wireless-802.11
(5) Calling-Station-Id = '96006F089222'
(5) Called-Station-Id = '001A1E01CF58'
(5) Service-Type = Framed-User
(5) Framed-MTU = 1100
(5) EAP-Message = 0x020600061900
(5) State = 0x5d232d88592534dd60443f4cd8d35175
(5) Aruba-Essid-Name = 'eduroam'
(5) Aruba-Location-Id = 'CETLfoyer_AP01'
(5) Aruba-AP-Group = 'apg-comp'
(5) Message-Authenticator = 0xc6d5fb9e7db34af2acf0e6c12d84368a
(5) session-state: No cached attributes
(5) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(5) authorize {
(5) policy eduroam_filter {
(5) if (User-Name !~ /@/) {
(5) if (User-Name !~ /@/) -> FALSE
(5) if ("%{User-Name}" =~ /@$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070 at harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /@$/) -> FALSE
(5) if ("%{User-Name}" =~ /@gmail\.com$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070 at harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(5) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070 at harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(5) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070 at harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(5) } # policy eduroam_filter = notfound
(5) [preprocess] = ok
(5) policy operator-name.authorize {
(5) if ("%{client:Operator-Name}") {
(5) EXPAND %{client:Operator-Name}
(5) --> 1harper-adams.ac.uk
(5) if ("%{client:Operator-Name}") -> TRUE
(5) if ("%{client:Operator-Name}") {
(5) update request {
(5) EXPAND %{client:Operator-Name}
(5) --> 1harper-adams.ac.uk
(5) &Operator-Name = 1harper-adams.ac.uk
(5) } # update request = noop
(5) } # if ("%{client:Operator-Name}") = noop
(5) } # policy operator-name.authorize = noop
(5) policy cui.authorize {
(5) if ("%{client:add_cui}" == 'yes') {
(5) EXPAND %{client:add_cui}
(5) --> yes
(5) if ("%{client:add_cui}" == 'yes') -> TRUE
(5) if ("%{client:add_cui}" == 'yes') {
(5) update request {
(5) &Chargeable-User-Identity := 0x00
(5) } # update request = noop
(5) } # if ("%{client:add_cui}" == 'yes') = noop
(5) } # policy cui.authorize = noop
(5) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070 at harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(5) else {
(5) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(5) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(5) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(5) auth_log: EXPAND %t
(5) auth_log: --> Mon Sep 7 19:55:28 2020
(5) [auth_log] = ok
(5) } # else = ok
(5) [chap] = noop
(5) [mschap] = noop
(5) [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(5) suffix: Found realm "harper-adams.ac.uk"
(5) suffix: Adding Stripped-User-Name = "00703070"
(5) suffix: Adding Realm = "harper-adams.ac.uk"
(5) suffix: Authentication realm is LOCAL
(5) [suffix] = ok
(5) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(5) EXPAND %{User-Name}
(5) --> 00703070 at harper-adams.ac.uk
(5) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(5) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(5) [noop] = noop
(5) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(5) ... skipping elsif for request 5: Preceding "if" was taken
(5) ... skipping elsif for request 5: Preceding "if" was taken
(5) ... skipping elsif for request 5: Preceding "if" was taken
(5) ... skipping else for request 5: Preceding "if" was taken
(5) eap: Peer sent code Response (2) ID 6 length 6
(5) eap: Continuing tunnel setup
(5) [eap] = ok
(5) } # authorize = ok
(5) Found Auth-Type = EAP
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) authenticate {
(5) eap: Expiring EAP session with state 0x5d232d88592534dd
(5) eap: Finished EAP session with state 0x5d232d88592534dd
(5) eap: Previous EAP request found for state 0x5d232d88592534dd, released from the list
(5) eap: Peer sent method PEAP (25)
(5) eap: EAP PEAP (25)
(5) eap: Calling eap_peap to process EAP data
(5) eap_peap: processing EAP-TLS
(5) eap_peap: Received TLS ACK
(5) eap_peap: Received TLS ACK
(5) eap_peap: ACK handshake is finished
(5) eap_peap: eaptls_verify returned 3
(5) eap_peap: eaptls_process returned 3
(5) eap_peap: FR_TLS_SUCCESS
(5) eap_peap: Session established. Decoding tunneled attributes
(5) eap_peap: PEAP state TUNNEL ESTABLISHED
(5) eap: EAP session adding &reply:State = 0x5d232d88582434dd
(5) [eap] = handled
(5) } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) Post-Auth-Type sub-section not found. Ignoring.
(5) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(5) Sent Access-Challenge Id 254 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(5) EAP-Message = 0x010700281900170303001ddbf9a5fe6b58c9b06dc36a69e0eb76f60129709c828fc278149f06d1b9
(5) Message-Authenticator = 0x00000000000000000000000000000000
(5) State = 0x5d232d88582434dd60443f4cd8d35175
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 236 from 192.168.30.121:59063 to 192.168.10.211:1812 length 277
(6) User-Name = '00703070 at harper-adams.ac.uk'
(6) NAS-IP-Address = 192.168.30.121
(6) NAS-Port = 0
(6) NAS-Identifier = '192.168.30.121'
(6) NAS-Port-Type = Wireless-802.11
(6) Calling-Station-Id = '96006F089222'
(6) Called-Station-Id = '001A1E01CF58'
(6) Service-Type = Framed-User
(6) Framed-MTU = 1100
(6) EAP-Message = 0x0207003f190017030300340000000000000001f7d1c2bc51c0f6614a1bc2831a5e10b3a0532248f7cde8cd0675872eafaf1768f108ad5c3b6a73038f8c63bf
(6) State = 0x5d232d88582434dd60443f4cd8d35175
(6) Aruba-Essid-Name = 'eduroam'
(6) Aruba-Location-Id = 'CETLfoyer_AP01'
(6) Aruba-AP-Group = 'apg-comp'
(6) Message-Authenticator = 0x8a17b53039a0230e8b09c960ea038aea
(6) session-state: No cached attributes
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(6) authorize {
(6) policy eduroam_filter {
(6) if (User-Name !~ /@/) {
(6) if (User-Name !~ /@/) -> FALSE
(6) if ("%{User-Name}" =~ /@$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070 at harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /@$/) -> FALSE
(6) if ("%{User-Name}" =~ /@gmail\.com$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070 at harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(6) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070 at harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(6) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070 at harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(6) } # policy eduroam_filter = notfound
(6) [preprocess] = ok
(6) policy operator-name.authorize {
(6) if ("%{client:Operator-Name}") {
(6) EXPAND %{client:Operator-Name}
(6) --> 1harper-adams.ac.uk
(6) if ("%{client:Operator-Name}") -> TRUE
(6) if ("%{client:Operator-Name}") {
(6) update request {
(6) EXPAND %{client:Operator-Name}
(6) --> 1harper-adams.ac.uk
(6) &Operator-Name = 1harper-adams.ac.uk
(6) } # update request = noop
(6) } # if ("%{client:Operator-Name}") = noop
(6) } # policy operator-name.authorize = noop
(6) policy cui.authorize {
(6) if ("%{client:add_cui}" == 'yes') {
(6) EXPAND %{client:add_cui}
(6) --> yes
(6) if ("%{client:add_cui}" == 'yes') -> TRUE
(6) if ("%{client:add_cui}" == 'yes') {
(6) update request {
(6) &Chargeable-User-Identity := 0x00
(6) } # update request = noop
(6) } # if ("%{client:add_cui}" == 'yes') = noop
(6) } # policy cui.authorize = noop
(6) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070 at harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(6) else {
(6) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(6) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(6) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(6) auth_log: EXPAND %t
(6) auth_log: --> Mon Sep 7 19:55:28 2020
(6) [auth_log] = ok
(6) } # else = ok
(6) [chap] = noop
(6) [mschap] = noop
(6) [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(6) suffix: Found realm "harper-adams.ac.uk"
(6) suffix: Adding Stripped-User-Name = "00703070"
(6) suffix: Adding Realm = "harper-adams.ac.uk"
(6) suffix: Authentication realm is LOCAL
(6) [suffix] = ok
(6) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(6) EXPAND %{User-Name}
(6) --> 00703070 at harper-adams.ac.uk
(6) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(6) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(6) [noop] = noop
(6) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(6) ... skipping elsif for request 6: Preceding "if" was taken
(6) ... skipping elsif for request 6: Preceding "if" was taken
(6) ... skipping elsif for request 6: Preceding "if" was taken
(6) ... skipping else for request 6: Preceding "if" was taken
(6) eap: Peer sent code Response (2) ID 7 length 63
(6) eap: Continuing tunnel setup
(6) [eap] = ok
(6) } # authorize = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) authenticate {
(6) eap: Expiring EAP session with state 0x5d232d88582434dd
(6) eap: Finished EAP session with state 0x5d232d88582434dd
(6) eap: Previous EAP request found for state 0x5d232d88582434dd, released from the list
(6) eap: Peer sent method PEAP (25)
(6) eap: EAP PEAP (25)
(6) eap: Calling eap_peap to process EAP data
(6) eap_peap: processing EAP-TLS
(6) eap_peap: eaptls_verify returned 7
(6) eap_peap: Done initial handshake
(6) eap_peap: eaptls_process returned 7
(6) eap_peap: FR_TLS_OK
(6) eap_peap: Session established. Decoding tunneled attributes
(6) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(6) eap_peap: Identity - 00703070 at harper-adams.ac.uk
(6) eap_peap: Got inner identity '00703070 at harper-adams.ac.uk'
(6) eap_peap: Setting default EAP type for tunneled EAP session
(6) eap_peap: Got tunneled request
(6) eap_peap: EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) eap_peap: Setting User-Name to 00703070 at harper-adams.ac.uk
(6) eap_peap: Sending tunneled request to inner-tunnel
(6) eap_peap: EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(6) eap_peap: User-Name = '00703070 at harper-adams.ac.uk'
(6) eap_peap: NAS-IP-Address = 192.168.30.121
(6) eap_peap: NAS-Port = 0
(6) eap_peap: NAS-Identifier = '192.168.30.121'
(6) eap_peap: NAS-Port-Type = Wireless-802.11
(6) eap_peap: Calling-Station-Id = '96006F089222'
(6) eap_peap: Called-Station-Id = '001A1E01CF58'
(6) eap_peap: Service-Type = Framed-User
(6) eap_peap: Framed-MTU = 1100
(6) eap_peap: Aruba-Essid-Name = 'eduroam'
(6) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01'
(6) eap_peap: Aruba-AP-Group = 'apg-comp'
(6) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(6) eap_peap: Operator-Name = '1harper-adams.ac.uk'
(6) eap_peap: Chargeable-User-Identity := 0x00
(6) Virtual server inner-tunnel received request
(6) EAP-Message = 0x02070020013030373033303730406861727065722d6164616d732e61632e756b
(6) FreeRADIUS-Proxied-To = 127.0.0.1
(6) User-Name = '00703070 at harper-adams.ac.uk'
(6) NAS-IP-Address = 192.168.30.121
(6) NAS-Port = 0
(6) NAS-Identifier = '192.168.30.121'
(6) NAS-Port-Type = Wireless-802.11
(6) Calling-Station-Id = '96006F089222'
(6) Called-Station-Id = '001A1E01CF58'
(6) Service-Type = Framed-User
(6) Framed-MTU = 1100
(6) Aruba-Essid-Name = 'eduroam'
(6) Aruba-Location-Id = 'CETLfoyer_AP01'
(6) Aruba-AP-Group = 'apg-comp'
(6) Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(6) Operator-Name = '1harper-adams.ac.uk'
(6) Chargeable-User-Identity := 0x00
(6) server inner-tunnel {
(6) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(6) authorize {
(6) [chap] = noop
(6) [mschap] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(6) suffix: Found realm "harper-adams.ac.uk"
(6) suffix: Adding Stripped-User-Name = "00703070"
(6) suffix: Adding Realm = "harper-adams.ac.uk"
(6) suffix: Authentication realm is LOCAL
(6) [suffix] = ok
(6) update control {
(6) &Proxy-To-Realm := LOCAL
(6) } # update control = noop
(6) eap: Peer sent code Response (2) ID 7 length 32
(6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
(6) [eap] = ok
(6) } # authorize = ok
(6) Found Auth-Type = EAP
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(6) authenticate {
(6) eap: Peer sent method Identity (1)
(6) eap: Calling eap_mschapv2 to process EAP data
(6) eap_mschapv2: Issuing Challenge
(6) eap: EAP session adding &reply:State = 0xcef5e17acefdfb91
(6) [eap] = handled
(6) } # authenticate = handled
(6) } # server inner-tunnel
(6) Virtual server sending reply
(6) EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) Message-Authenticator = 0x00000000000000000000000000000000
(6) State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled reply code 11
(6) eap_peap: EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled reply RADIUS code 11
(6) eap_peap: EAP-Message = 0x0108002a1a0108002510b32b3c4603cdfbd861dec80ae9c95905667265657261646975732d332e302e38
(6) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(6) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d
(6) eap_peap: Got tunneled Access-Challenge
(6) eap: EAP session adding &reply:State = 0x5d232d885b2b34dd
(6) [eap] = handled
(6) } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) Post-Auth-Type sub-section not found. Ignoring.
(6) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(6) Sent Access-Challenge Id 236 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(6) EAP-Message = 0x010800491900170303003edbf9a5fe6b58c9b1f544c668c8ce20a13bbdddec520dff4b916704c39eb5cd65054c4d14c94d5a4c2febf9467b7a0fb1cb9210743e34f5fc43aa84eb3dbd
(6) Message-Authenticator = 0x00000000000000000000000000000000
(6) State = 0x5d232d885b2b34dd60443f4cd8d35175
(6) Finished request
Waking up in 4.9 seconds.
(7) Received Access-Request Id 109 from 192.168.30.121:59063 to 192.168.10.211:1812 length 251
(7) User-Name = '00703070 at harper-adams.ac.uk'
(7) NAS-IP-Address = 192.168.30.121
(7) NAS-Port = 0
(7) NAS-Identifier = '192.168.30.121'
(7) NAS-Port-Type = Wireless-802.11
(7) Calling-Station-Id = '96006F089222'
(7) Called-Station-Id = '001A1E01CF58'
(7) Service-Type = Framed-User
(7) Framed-MTU = 1100
(7) EAP-Message = 0x020800251900170303001a00000000000000025abd5dd6bbbaa0d2d85ec8fd3fc775e655b6
(7) State = 0x5d232d885b2b34dd60443f4cd8d35175
(7) Aruba-Essid-Name = 'eduroam'
(7) Aruba-Location-Id = 'CETLfoyer_AP01'
(7) Aruba-AP-Group = 'apg-comp'
(7) Message-Authenticator = 0xaf7a8dee6f40dcbd4932d108769f58b3
(7) session-state: No cached attributes
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(7) authorize {
(7) policy eduroam_filter {
(7) if (User-Name !~ /@/) {
(7) if (User-Name !~ /@/) -> FALSE
(7) if ("%{User-Name}" =~ /@$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070 at harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /@$/) -> FALSE
(7) if ("%{User-Name}" =~ /@gmail\.com$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070 at harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(7) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070 at harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(7) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070 at harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(7) } # policy eduroam_filter = notfound
(7) [preprocess] = ok
(7) policy operator-name.authorize {
(7) if ("%{client:Operator-Name}") {
(7) EXPAND %{client:Operator-Name}
(7) --> 1harper-adams.ac.uk
(7) if ("%{client:Operator-Name}") -> TRUE
(7) if ("%{client:Operator-Name}") {
(7) update request {
(7) EXPAND %{client:Operator-Name}
(7) --> 1harper-adams.ac.uk
(7) &Operator-Name = 1harper-adams.ac.uk
(7) } # update request = noop
(7) } # if ("%{client:Operator-Name}") = noop
(7) } # policy operator-name.authorize = noop
(7) policy cui.authorize {
(7) if ("%{client:add_cui}" == 'yes') {
(7) EXPAND %{client:add_cui}
(7) --> yes
(7) if ("%{client:add_cui}" == 'yes') -> TRUE
(7) if ("%{client:add_cui}" == 'yes') {
(7) update request {
(7) &Chargeable-User-Identity := 0x00
(7) } # update request = noop
(7) } # if ("%{client:add_cui}" == 'yes') = noop
(7) } # policy cui.authorize = noop
(7) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070 at harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(7) else {
(7) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(7) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(7) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(7) auth_log: EXPAND %t
(7) auth_log: --> Mon Sep 7 19:55:28 2020
(7) [auth_log] = ok
(7) } # else = ok
(7) [chap] = noop
(7) [mschap] = noop
(7) [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(7) suffix: Found realm "harper-adams.ac.uk"
(7) suffix: Adding Stripped-User-Name = "00703070"
(7) suffix: Adding Realm = "harper-adams.ac.uk"
(7) suffix: Authentication realm is LOCAL
(7) [suffix] = ok
(7) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(7) EXPAND %{User-Name}
(7) --> 00703070 at harper-adams.ac.uk
(7) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(7) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(7) [noop] = noop
(7) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(7) ... skipping elsif for request 7: Preceding "if" was taken
(7) ... skipping elsif for request 7: Preceding "if" was taken
(7) ... skipping elsif for request 7: Preceding "if" was taken
(7) ... skipping else for request 7: Preceding "if" was taken
(7) eap: Peer sent code Response (2) ID 8 length 37
(7) eap: Continuing tunnel setup
(7) [eap] = ok
(7) } # authorize = ok
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) authenticate {
(7) eap: Expiring EAP session with state 0xcef5e17acefdfb91
(7) eap: Finished EAP session with state 0x5d232d885b2b34dd
(7) eap: Previous EAP request found for state 0x5d232d885b2b34dd, released from the list
(7) eap: Peer sent method PEAP (25)
(7) eap: EAP PEAP (25)
(7) eap: Calling eap_peap to process EAP data
(7) eap_peap: processing EAP-TLS
(7) eap_peap: eaptls_verify returned 7
(7) eap_peap: Done initial handshake
(7) eap_peap: eaptls_process returned 7
(7) eap_peap: FR_TLS_OK
(7) eap_peap: Session established. Decoding tunneled attributes
(7) eap_peap: PEAP state phase2
(7) eap_peap: EAP type NAK (3)
(7) eap_peap: Got tunneled request
(7) eap_peap: EAP-Message = 0x020800060306
(7) eap_peap: Setting User-Name to 00703070 at harper-adams.ac.uk
(7) eap_peap: Sending tunneled request to inner-tunnel
(7) eap_peap: EAP-Message = 0x020800060306
(7) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(7) eap_peap: User-Name = '00703070 at harper-adams.ac.uk'
(7) eap_peap: State = 0xcef5e17acefdfb9195ed82a9e621722d
(7) eap_peap: NAS-IP-Address = 192.168.30.121
(7) eap_peap: NAS-Port = 0
(7) eap_peap: NAS-Identifier = '192.168.30.121'
(7) eap_peap: NAS-Port-Type = Wireless-802.11
(7) eap_peap: Calling-Station-Id = '96006F089222'
(7) eap_peap: Called-Station-Id = '001A1E01CF58'
(7) eap_peap: Service-Type = Framed-User
(7) eap_peap: Framed-MTU = 1100
(7) eap_peap: Aruba-Essid-Name = 'eduroam'
(7) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01'
(7) eap_peap: Aruba-AP-Group = 'apg-comp'
(7) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(7) eap_peap: Operator-Name = '1harper-adams.ac.uk'
(7) eap_peap: Chargeable-User-Identity := 0x00
(7) Virtual server inner-tunnel received request
(7) EAP-Message = 0x020800060306
(7) FreeRADIUS-Proxied-To = 127.0.0.1
(7) User-Name = '00703070 at harper-adams.ac.uk'
(7) State = 0xcef5e17acefdfb9195ed82a9e621722d
(7) NAS-IP-Address = 192.168.30.121
(7) NAS-Port = 0
(7) NAS-Identifier = '192.168.30.121'
(7) NAS-Port-Type = Wireless-802.11
(7) Calling-Station-Id = '96006F089222'
(7) Called-Station-Id = '001A1E01CF58'
(7) Service-Type = Framed-User
(7) Framed-MTU = 1100
(7) Aruba-Essid-Name = 'eduroam'
(7) Aruba-Location-Id = 'CETLfoyer_AP01'
(7) Aruba-AP-Group = 'apg-comp'
(7) Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(7) Operator-Name = '1harper-adams.ac.uk'
(7) Chargeable-User-Identity := 0x00
(7) server inner-tunnel {
(7) session-state: No cached attributes
(7) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) authorize {
(7) [chap] = noop
(7) [mschap] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(7) suffix: Found realm "harper-adams.ac.uk"
(7) suffix: Adding Stripped-User-Name = "00703070"
(7) suffix: Adding Realm = "harper-adams.ac.uk"
(7) suffix: Authentication realm is LOCAL
(7) [suffix] = ok
(7) update control {
(7) &Proxy-To-Realm := LOCAL
(7) } # update control = noop
(7) eap: Peer sent code Response (2) ID 8 length 6
(7) eap: No EAP Start, assuming it's an on-going EAP conversation
(7) [eap] = updated
(7) [files] = noop
(7) [expiration] = noop
(7) [logintime] = noop
(7) [pap] = noop
(7) } # authorize = updated
(7) Found Auth-Type = EAP
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(7) authenticate {
(7) eap: Expiring EAP session with state 0xcef5e17acefdfb91
(7) eap: Finished EAP session with state 0xcef5e17acefdfb91
(7) eap: Previous EAP request found for state 0xcef5e17acefdfb91, released from the list
(7) eap: Peer sent method NAK (3)
(7) eap: Found mutually acceptable type GTC (6)
(7) eap: Calling eap_gtc to process EAP data
(7) eap_gtc: EXPAND Password:
(7) eap_gtc: --> Password:
(7) eap: EAP session adding &reply:State = 0xcef5e17acffce791
(7) [eap] = handled
(7) } # authenticate = handled
(7) } # server inner-tunnel
(7) Virtual server sending reply
(7) EAP-Message = 0x0109000f0650617373776f72643a20
(7) Message-Authenticator = 0x00000000000000000000000000000000
(7) State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled reply code 11
(7) eap_peap: EAP-Message = 0x0109000f0650617373776f72643a20
(7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled reply RADIUS code 11
(7) eap_peap: EAP-Message = 0x0109000f0650617373776f72643a20
(7) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(7) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d
(7) eap_peap: Got tunneled Access-Challenge
(7) eap: EAP session adding &reply:State = 0x5d232d885a2a34dd
(7) [eap] = handled
(7) } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) Post-Auth-Type sub-section not found. Ignoring.
(7) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(7) Sent Access-Challenge Id 109 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(7) EAP-Message = 0x0109002e19001703030023dbf9a5fe6b58c9b2c86f77544490173e291a25dd612c301797c162a5c8fc06f66e5112
(7) Message-Authenticator = 0x00000000000000000000000000000000
(7) State = 0x5d232d885a2a34dd60443f4cd8d35175
(7) Finished request
Waking up in 4.9 seconds.
(8) Received Access-Request Id 95 from 192.168.30.121:59063 to 192.168.10.211:1812 length 265
(8) User-Name = '00703070 at harper-adams.ac.uk'
(8) NAS-IP-Address = 192.168.30.121
(8) NAS-Port = 0
(8) NAS-Identifier = '192.168.30.121'
(8) NAS-Port-Type = Wireless-802.11
(8) Calling-Station-Id = '96006F089222'
(8) Called-Station-Id = '001A1E01CF58'
(8) Service-Type = Framed-User
(8) Framed-MTU = 1100
(8) EAP-Message = 0x02090033190017030300280000000000000003e26173435d91e7f61b6321efcb63810a55eedad5f9ee2e3b1bd11f0c34e5d051
(8) State = 0x5d232d885a2a34dd60443f4cd8d35175
(8) Aruba-Essid-Name = 'eduroam'
(8) Aruba-Location-Id = 'CETLfoyer_AP01'
(8) Aruba-AP-Group = 'apg-comp'
(8) Message-Authenticator = 0x6290f9ac9790288097d9abada7f4cf76
(8) session-state: No cached attributes
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(8) authorize {
(8) policy eduroam_filter {
(8) if (User-Name !~ /@/) {
(8) if (User-Name !~ /@/) -> FALSE
(8) if ("%{User-Name}" =~ /@$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070 at harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /@$/) -> FALSE
(8) if ("%{User-Name}" =~ /@gmail\.com$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070 at harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(8) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070 at harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(8) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070 at harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(8) } # policy eduroam_filter = notfound
(8) [preprocess] = ok
(8) policy operator-name.authorize {
(8) if ("%{client:Operator-Name}") {
(8) EXPAND %{client:Operator-Name}
(8) --> 1harper-adams.ac.uk
(8) if ("%{client:Operator-Name}") -> TRUE
(8) if ("%{client:Operator-Name}") {
(8) update request {
(8) EXPAND %{client:Operator-Name}
(8) --> 1harper-adams.ac.uk
(8) &Operator-Name = 1harper-adams.ac.uk
(8) } # update request = noop
(8) } # if ("%{client:Operator-Name}") = noop
(8) } # policy operator-name.authorize = noop
(8) policy cui.authorize {
(8) if ("%{client:add_cui}" == 'yes') {
(8) EXPAND %{client:add_cui}
(8) --> yes
(8) if ("%{client:add_cui}" == 'yes') -> TRUE
(8) if ("%{client:add_cui}" == 'yes') {
(8) update request {
(8) &Chargeable-User-Identity := 0x00
(8) } # update request = noop
(8) } # if ("%{client:add_cui}" == 'yes') = noop
(8) } # policy cui.authorize = noop
(8) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070 at harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(8) else {
(8) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(8) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(8) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(8) auth_log: EXPAND %t
(8) auth_log: --> Mon Sep 7 19:55:28 2020
(8) [auth_log] = ok
(8) } # else = ok
(8) [chap] = noop
(8) [mschap] = noop
(8) [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(8) suffix: Found realm "harper-adams.ac.uk"
(8) suffix: Adding Stripped-User-Name = "00703070"
(8) suffix: Adding Realm = "harper-adams.ac.uk"
(8) suffix: Authentication realm is LOCAL
(8) [suffix] = ok
(8) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(8) EXPAND %{User-Name}
(8) --> 00703070 at harper-adams.ac.uk
(8) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(8) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(8) [noop] = noop
(8) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(8) ... skipping elsif for request 8: Preceding "if" was taken
(8) ... skipping elsif for request 8: Preceding "if" was taken
(8) ... skipping elsif for request 8: Preceding "if" was taken
(8) ... skipping else for request 8: Preceding "if" was taken
(8) eap: Peer sent code Response (2) ID 9 length 51
(8) eap: Continuing tunnel setup
(8) [eap] = ok
(8) } # authorize = ok
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) authenticate {
(8) eap: Expiring EAP session with state 0xcef5e17acffce791
(8) eap: Finished EAP session with state 0x5d232d885a2a34dd
(8) eap: Previous EAP request found for state 0x5d232d885a2a34dd, released from the list
(8) eap: Peer sent method PEAP (25)
(8) eap: EAP PEAP (25)
(8) eap: Calling eap_peap to process EAP data
(8) eap_peap: processing EAP-TLS
(8) eap_peap: eaptls_verify returned 7
(8) eap_peap: Done initial handshake
(8) eap_peap: eaptls_process returned 7
(8) eap_peap: FR_TLS_OK
(8) eap_peap: Session established. Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP type GTC (6)
(8) eap_peap: Got tunneled request
(8) eap_peap: EAP-Message = 0x020900140654726964656e743234313030303239
(8) eap_peap: Setting User-Name to 00703070 at harper-adams.ac.uk
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap: EAP-Message = 0x020900140654726964656e743234313030303239
(8) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap: User-Name = '00703070 at harper-adams.ac.uk'
(8) eap_peap: State = 0xcef5e17acffce79195ed82a9e621722d
(8) eap_peap: NAS-IP-Address = 192.168.30.121
(8) eap_peap: NAS-Port = 0
(8) eap_peap: NAS-Identifier = '192.168.30.121'
(8) eap_peap: NAS-Port-Type = Wireless-802.11
(8) eap_peap: Calling-Station-Id = '96006F089222'
(8) eap_peap: Called-Station-Id = '001A1E01CF58'
(8) eap_peap: Service-Type = Framed-User
(8) eap_peap: Framed-MTU = 1100
(8) eap_peap: Aruba-Essid-Name = 'eduroam'
(8) eap_peap: Aruba-Location-Id = 'CETLfoyer_AP01'
(8) eap_peap: Aruba-AP-Group = 'apg-comp'
(8) eap_peap: Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(8) eap_peap: Operator-Name = '1harper-adams.ac.uk'
(8) eap_peap: Chargeable-User-Identity := 0x00
(8) Virtual server inner-tunnel received request
(8) EAP-Message = 0x020900140654726964656e743234313030303239
(8) FreeRADIUS-Proxied-To = 127.0.0.1
(8) User-Name = '00703070 at harper-adams.ac.uk'
(8) State = 0xcef5e17acffce79195ed82a9e621722d
(8) NAS-IP-Address = 192.168.30.121
(8) NAS-Port = 0
(8) NAS-Identifier = '192.168.30.121'
(8) NAS-Port-Type = Wireless-802.11
(8) Calling-Station-Id = '96006F089222'
(8) Called-Station-Id = '001A1E01CF58'
(8) Service-Type = Framed-User
(8) Framed-MTU = 1100
(8) Aruba-Essid-Name = 'eduroam'
(8) Aruba-Location-Id = 'CETLfoyer_AP01'
(8) Aruba-AP-Group = 'apg-comp'
(8) Event-Timestamp = 'Sep 7 2020 19:55:28 BST'
(8) Operator-Name = '1harper-adams.ac.uk'
(8) Chargeable-User-Identity := 0x00
(8) server inner-tunnel {
(8) session-state: No cached attributes
(8) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) authorize {
(8) [chap] = noop
(8) [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(8) suffix: Found realm "harper-adams.ac.uk"
(8) suffix: Adding Stripped-User-Name = "00703070"
(8) suffix: Adding Realm = "harper-adams.ac.uk"
(8) suffix: Authentication realm is LOCAL
(8) [suffix] = ok
(8) update control {
(8) &Proxy-To-Realm := LOCAL
(8) } # update control = noop
(8) eap: Peer sent code Response (2) ID 9 length 20
(8) eap: No EAP Start, assuming it's an on-going EAP conversation
(8) [eap] = updated
(8) [files] = noop
(8) [expiration] = noop
(8) [logintime] = noop
(8) [pap] = noop
(8) } # authorize = updated
(8) Found Auth-Type = EAP
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) authenticate {
(8) eap: Expiring EAP session with state 0xcef5e17acffce791
(8) eap: Finished EAP session with state 0xcef5e17acffce791
(8) eap: Previous EAP request found for state 0xcef5e17acffce791, released from the list
(8) eap: Peer sent method GTC (6)
(8) eap: EAP GTC (6)
(8) eap: Calling eap_gtc to process EAP data
(8) eap_gtc: # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) eap_gtc: Auth-Type PAP {
(8) pap: Login attempt with password
(8) pap: No password configured for the user. Cannot do authentication
(8) [pap] = fail
(8) } # Auth-Type PAP = fail
(8) eap: ERROR: Failed continuing EAP GTC (6) session. EAP sub-module failed
(8) eap: Failed in EAP select
(8) [eap] = invalid
(8) } # authenticate = invalid
(8) Failed to authenticate the user
(8) Using Post-Auth-Type Reject
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel
(8) Post-Auth-Type REJECT {
(8) attr_filter.access_reject: EXPAND %{User-Name}
(8) attr_filter.access_reject: --> 00703070 at harper-adams.ac.uk
(8) attr_filter.access_reject: Matched entry DEFAULT at line 18
(8) [attr_filter.access_reject] = updated
(8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log.%{%{reply:Packet-Type}:-format}
(8) inner_tunnel_server_log: --> inner_tunnel_server_log.Access-Reject
(8) inner_tunnel_server_log: EXPAND /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-%Y%m%d
(8) inner_tunnel_server_log: --> /usr/local/var/log/radius/radacct/inner_tunnel_server_log/inner_tunnel_server_log-20200907
(8) inner_tunnel_server_log: EXPAND inner_tunnel_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject
(8) inner_tunnel_server_log: --> inner_tunnel_server_log#Mon Sep 7 19:55:28 2020#USERNAME=00703070 at harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020900140654726964656e743234313030303239#RESULT=Access-Reject
(8) [inner_tunnel_server_log] = ok
(8) update outer.session-state {
(8) &Module-Failure-Message := &Module-Failure-Message -> eap: Failed continuing EAP GTC (6) session. EAP sub-module failed
(8) } # update outer.session-state = noop
(8) } # Post-Auth-Type REJECT = updated
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8) EAP-Message = 0x04090004
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Got tunneled reply code 3
(8) eap_peap: EAP-Message = 0x04090004
(8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Got tunneled reply RADIUS code 3
(8) eap_peap: EAP-Message = 0x04090004
(8) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(8) eap_peap: Tunneled authentication was rejected
(8) eap_peap: FAILURE
(8) eap: EAP session adding &reply:State = 0x5d232d88552934dd
(8) [eap] = handled
(8) } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) Post-Auth-Type sub-section not found. Ignoring.
(8) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(8) session-state: Saving cached attributes
(8) Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed'
(8) Sent Access-Challenge Id 95 from 192.168.10.211:1812 to 192.168.30.121:59063 length 0
(8) EAP-Message = 0x010a002e19001703030023dbf9a5fe6b58c9b35409b5950099335ab262a924b463f36eeabe34c5e86c199e0fb490
(8) Message-Authenticator = 0x00000000000000000000000000000000
(8) State = 0x5d232d88552934dd60443f4cd8d35175
(8) Finished request
Waking up in 4.9 seconds.
(9) Received Access-Request Id 205 from 192.168.30.121:59063 to 192.168.10.211:1812 length 260
(9) User-Name = '00703070 at harper-adams.ac.uk'
(9) NAS-IP-Address = 192.168.30.121
(9) NAS-Port = 0
(9) NAS-Identifier = '192.168.30.121'
(9) NAS-Port-Type = Wireless-802.11
(9) Calling-Station-Id = '96006F089222'
(9) Called-Station-Id = '001A1E01CF58'
(9) Service-Type = Framed-User
(9) Framed-MTU = 1100
(9) EAP-Message = 0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490
(9) State = 0x5d232d88552934dd60443f4cd8d35175
(9) Aruba-Essid-Name = 'eduroam'
(9) Aruba-Location-Id = 'CETLfoyer_AP01'
(9) Aruba-AP-Group = 'apg-comp'
(9) Message-Authenticator = 0x9fd80c90ae227ad00b39d0f216ca9efb
(9) session-state: Found cached attributes
(9) Module-Failure-Message := 'eap: Failed continuing EAP GTC (6) session. EAP sub-module failed'
(9) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default
(9) authorize {
(9) policy eduroam_filter {
(9) if (User-Name !~ /@/) {
(9) if (User-Name !~ /@/) -> FALSE
(9) if ("%{User-Name}" =~ /@$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070 at harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /@$/) -> FALSE
(9) if ("%{User-Name}" =~ /@gmail\.com$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070 at harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /@gmail\.com$/) -> FALSE
(9) if ("%{User-Name}" =~ /@yahoo\.com$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070 at harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /@yahoo\.com$/) -> FALSE
(9) if ("%{User-Name}" =~ /@hotmail\.com$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070 at harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /@hotmail\.com$/) -> FALSE
(9) } # policy eduroam_filter = notfound
(9) [preprocess] = ok
(9) policy operator-name.authorize {
(9) if ("%{client:Operator-Name}") {
(9) EXPAND %{client:Operator-Name}
(9) --> 1harper-adams.ac.uk
(9) if ("%{client:Operator-Name}") -> TRUE
(9) if ("%{client:Operator-Name}") {
(9) update request {
(9) EXPAND %{client:Operator-Name}
(9) --> 1harper-adams.ac.uk
(9) &Operator-Name = 1harper-adams.ac.uk
(9) } # update request = noop
(9) } # if ("%{client:Operator-Name}") = noop
(9) } # policy operator-name.authorize = noop
(9) policy cui.authorize {
(9) if ("%{client:add_cui}" == 'yes') {
(9) EXPAND %{client:add_cui}
(9) --> yes
(9) if ("%{client:add_cui}" == 'yes') -> TRUE
(9) if ("%{client:add_cui}" == 'yes') {
(9) update request {
(9) &Chargeable-User-Identity := 0x00
(9) } # update request = noop
(9) } # if ("%{client:add_cui}" == 'yes') = noop
(9) } # policy cui.authorize = noop
(9) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070 at harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /EduroamSupport at harper-adams\.ac\.uk$/) -> FALSE
(9) else {
(9) auth_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d
(9) auth_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(9) auth_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/auth-detail-20200907
(9) auth_log: EXPAND %t
(9) auth_log: --> Mon Sep 7 19:55:28 2020
(9) [auth_log] = ok
(9) } # else = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: Looking up realm "harper-adams.ac.uk" for User-Name = "00703070 at harper-adams.ac.uk"
(9) suffix: Found realm "harper-adams.ac.uk"
(9) suffix: Adding Stripped-User-Name = "00703070"
(9) suffix: Adding Realm = "harper-adams.ac.uk"
(9) suffix: Authentication realm is LOCAL
(9) [suffix] = ok
(9) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(9) EXPAND %{User-Name}
(9) --> 00703070 at harper-adams.ac.uk
(9) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) -> TRUE
(9) if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) {
(9) [noop] = noop
(9) } # if ("%{User-Name}" =~ /@harper-adams\.ac\.uk$/) = noop
(9) ... skipping elsif for request 9: Preceding "if" was taken
(9) ... skipping elsif for request 9: Preceding "if" was taken
(9) ... skipping elsif for request 9: Preceding "if" was taken
(9) ... skipping else for request 9: Preceding "if" was taken
(9) eap: Peer sent code Response (2) ID 10 length 46
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = EAP
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x5d232d88552934dd
(9) eap: Finished EAP session with state 0x5d232d88552934dd
(9) eap: Previous EAP request found for state 0x5d232d88552934dd, released from the list
(9) eap: Peer sent method PEAP (25)
(9) eap: EAP PEAP (25)
(9) eap: Calling eap_peap to process EAP data
(9) eap_peap: processing EAP-TLS
(9) eap_peap: eaptls_verify returned 7
(9) eap_peap: Done initial handshake
(9) eap_peap: eaptls_process returned 7
(9) eap_peap: FR_TLS_OK
(9) eap_peap: Session established. Decoding tunneled attributes
(9) eap_peap: PEAP state send tlv failure
(9) eap_peap: Received EAP-TLV response
(9) eap_peap: The users session was previously rejected: returning reject (again.)
(9) eap_peap: This means you need to read the PREVIOUS messages in the debug output
(9) eap_peap: to find out the reason why the user was rejected
(9) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you
(9) eap_peap: what went wrong, and how to fix the problem
SSL: Removing session 5c84189163d9dcce699fbb23a7bb5a20a1783463e1a9c03df7be80e25113f08c from the cache
(9) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed
(9) eap: Failed in EAP select
(9) [eap] = invalid
(9) } # authenticate = invalid
(9) Failed to authenticate the user
(9) Using Post-Auth-Type Reject
(9) # Executing group from file /usr/local/etc/raddb/sites-enabled/default
(9) Post-Auth-Type REJECT {
(9) attr_filter.access_reject: EXPAND %{User-Name}
(9) attr_filter.access_reject: --> 00703070 at harper-adams.ac.uk
(9) attr_filter.access_reject: Matched entry DEFAULT at line 18
(9) [attr_filter.access_reject] = updated
(9) [eap] = noop
(9) policy remove_reply_message_if_eap {
(9) if (&reply:EAP-Message && &reply:Reply-Message) {
(9) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(9) else {
(9) [noop] = noop
(9) } # else = noop
(9) } # policy remove_reply_message_if_eap = noop
(9) reply_log: EXPAND /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d
(9) reply_log: --> /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907
(9) reply_log: /usr/local/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.30.121/reply-detail-20200907
(9) reply_log: EXPAND %t
(9) reply_log: --> Mon Sep 7 19:55:28 2020
(9) [reply_log] = ok
(9) default_server_log: EXPAND default_server_log.%{%{reply:Packet-Type}:-format}
(9) default_server_log: --> default_server_log.Access-Reject
(9) default_server_log: EXPAND /usr/local/var/log/radius/radacct/default_server_log/default_server_log-%Y%m%d
(9) default_server_log: --> /usr/local/var/log/radius/radacct/default_server_log/default_server_log-20200907
(9) default_server_log: EXPAND default_server_log#%t#USERNAME=%{request:User-Name}#IDENTIFIER=%{request:Realm}#OPERATOR=%{request:Operator-Name}#CSI=%{%{Calling-Station-Id}:-Unknown Caller Id}#NAS=%{%{Called-Station-Id}:-Unknown Access Point}#CUI=%{%{reply:Chargeable-User-Identity}:-Unknown CUI}#MSG=%{%{EAP-Message}:-No EAP Message}#RESULT=Access-Reject
(9) default_server_log: --> default_server_log#Mon Sep 7 19:55:28 2020#USERNAME=00703070 at harper-adams.ac.uk#IDENTIFIER=harper-adams.ac.uk#OPERATOR=1harper-adams.ac.uk#CSI=96006F089222#NAS=001A1E01CF58#CUI=Unknown CUI#MSG=0x020a002e1900170303002300000000000000046903c8f47e2e33d3a63fb5f582d652fe0cffc0dcc2a4cfe1f48490#RESULT=Access-Reject
(9) [default_server_log] = ok
(9) on-site-reject-log: EXPAND on-site-reject-log.%{%{reply:Packet-Type}:-format}
(9) on-site-reject-log: --> on-site-reject-log.Access-Reject
(9) on-site-reject-log: EXPAND /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-%Y%m%d
(9) on-site-reject-log: --> /usr/local/var/log/radius/radacct/on-site-reject-log/on-site-reject-log-20200907
(9) on-site-reject-log: EXPAND %S#USERNAME=%{%{request:User-Name}:-NO-USER-NAME}#MACADDR=%{%{Calling-Station-Id}:-NO-MAC-ADDR}##DEVICE=%{%{request:Aruba-Device-Type}:-NO-DEVICE-TYPE}#LOCATION=%{%{request:Aruba-Location-Id}:-NO-LOCATION-ID}#ERRORMSG=%{%{reply:Reply-Message}:-%{&session-state:Module-Failure-Message}}
(9) on-site-reject-log: --> 2020-09-07 19:55:28#USERNAME=00703070 at harper-adams.ac.uk#MACADDR=96006F089222##DEVICE=NO-DEVICE-TYPE#LOCATION=CETLfoyer_AP01#ERRORMSG=eap: Failed continuing EAP GTC (6) session. EAP sub-module failed
(9) [on-site-reject-log] = ok
(9) } # Post-Auth-Type REJECT = updated
(9) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(9) <delay>: Sending delayed response
(9) <delay>: Sent Access-Reject Id 205 from 192.168.10.211:1812 to 192.168.30.121:59063 length 44
(9) <delay>: EAP-Message = 0x040a0004
(9) <delay>: Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) <done>: Cleaning up request packet ID 66 with timestamp +5
(1) <done>: Cleaning up request packet ID 36 with timestamp +5
(2) <done>: Cleaning up request packet ID 101 with timestamp +5
(3) <done>: Cleaning up request packet ID 246 with timestamp +5
(4) <done>: Cleaning up request packet ID 93 with timestamp +5
(5) <done>: Cleaning up request packet ID 254 with timestamp +5
(6) <done>: Cleaning up request packet ID 236 with timestamp +5
(7) <done>: Cleaning up request packet ID 109 with timestamp +5
(8) <done>: Cleaning up request packet ID 95 with timestamp +5
(9) <delay>: Cleaning up request packet ID 205 with timestamp +5
Ready to process requests
More information about the Freeradius-Users
mailing list