Freeradius latest rpm on centos7

classic Classic list List threaded Threaded
11 messages Options
| Threaded
Open this post in threaded view
|

Freeradius latest rpm on centos7

Ammad Ali
Hi,

I have installed latest RPM of freeradius from
https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ 
on centos 7. Below are the list of installed RPMs.

freeradius-mysql-3.0.21-8.1.x86_64
freeradius-config-3.0.21-8.1.x86_64
freeradius-unixODBC-3.0.21-8.1.x86_64
freeradius-utils-3.0.21-8.1.x86_64
freeradius-3.0.21-8.1.x86_64
freeradius-perl-3.0.21-8.1.x86_64

After fresh install when I start radius in debug mode, it gives me below
errors of auth and acct protocol.

Mon Sep 28 16:34:26 2020 : Debug: Created signal pipe.  Read end FD 5,
write end FD 6
Mon Sep 28 16:34:26 2020 : Debug: radiusd: #### Opening IP addresses and
Ports ####
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path:
/usr/lib64/freeradius/proto_auth.so
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed:
/usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No
such file or directory - No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search
path(s)
Mon Sep 28 16:34:26 2020 : Debug: Defaults         : /lib:/usr/lib
Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so:
cannot open shared object file: No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: listen {
Mon Sep 28 16:34:26 2020 : Debug:       type = "auth"
Mon Sep 28 16:34:26 2020 : Debug:       ipaddr = *
Mon Sep 28 16:34:26 2020 : Debug:       port = 0
Mon Sep 28 16:34:26 2020 : Debug:    limit {
Mon Sep 28 16:34:26 2020 : Debug:       max_connections = 16
Mon Sep 28 16:34:26 2020 : Debug:       lifetime = 0
Mon Sep 28 16:34:26 2020 : Debug:       idle_timeout = 30
Mon Sep 28 16:34:26 2020 : Debug:    }
Mon Sep 28 16:34:26 2020 : Debug: }
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path:
/usr/lib64/freeradius/proto_acct.so
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed:
/usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No
such file or directory - No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search
path(s)
Mon Sep 28 16:34:26 2020 : Debug: Defaults         : /lib:/usr/lib
Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so:
cannot open shared object file: No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: listen {
Mon Sep 28 16:34:26 2020 : Debug:       type = "acct"
Mon Sep 28 16:34:26 2020 : Debug:       ipaddr = *
Mon Sep 28 16:34:26 2020 : Debug:       port = 0
Mon Sep 28 16:34:26 2020 : Debug:    limit {
Mon Sep 28 16:34:26 2020 : Debug:       max_connections = 16
Mon Sep 28 16:34:26 2020 : Debug:       lifetime = 0
Mon Sep 28 16:34:26 2020 : Debug:       idle_timeout = 30
Mon Sep 28 16:34:26 2020 : Debug:    }
Mon Sep 28 16:34:26 2020 : Debug: }
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path:
/usr/lib64/freeradius/proto_auth.so
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed:
/usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No
such file or directory - No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search
path(s)
Mon Sep 28 16:34:26 2020 : Debug: Defaults         : /lib:/usr/lib
Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so:
cannot open shared object file: No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: listen {
Mon Sep 28 16:34:26 2020 : Debug:       type = "auth"
Mon Sep 28 16:34:26 2020 : Debug:       ipv6addr = ::
Mon Sep 28 16:34:26 2020 : Debug:       port = 0
Mon Sep 28 16:34:26 2020 : Debug:    limit {
Mon Sep 28 16:34:26 2020 : Debug:       max_connections = 16
Mon Sep 28 16:34:26 2020 : Debug:       lifetime = 0
Mon Sep 28 16:34:26 2020 : Debug:       idle_timeout = 30
Mon Sep 28 16:34:26 2020 : Debug:    }
Mon Sep 28 16:34:26 2020 : Debug: }
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct with path:
/usr/lib64/freeradius/proto_acct.so
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_acct failed:
/usr/lib64/freeradius/proto_acct.so: cannot open shared object file: No
such file or directory - No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search
path(s)
Mon Sep 28 16:34:26 2020 : Debug: Defaults         : /lib:/usr/lib
Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_acct.so:
cannot open shared object file: No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: listen {
Mon Sep 28 16:34:26 2020 : Debug:       type = "acct"
Mon Sep 28 16:34:26 2020 : Debug:       ipv6addr = ::
Mon Sep 28 16:34:26 2020 : Debug:       port = 0
Mon Sep 28 16:34:26 2020 : Debug:    limit {
Mon Sep 28 16:34:26 2020 : Debug:       max_connections = 16
Mon Sep 28 16:34:26 2020 : Debug:       lifetime = 0
Mon Sep 28 16:34:26 2020 : Debug:       idle_timeout = 30
Mon Sep 28 16:34:26 2020 : Debug:    }
Mon Sep 28 16:34:26 2020 : Debug: }
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth with path:
/usr/lib64/freeradius/proto_auth.so
Mon Sep 28 16:34:26 2020 : Debug: Loading proto_auth failed:
/usr/lib64/freeradius/proto_auth.so: cannot open shared object file: No
such file or directory - No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: Loading library using linker search
path(s)
Mon Sep 28 16:34:26 2020 : Debug: Defaults         : /lib:/usr/lib
Mon Sep 28 16:34:26 2020 : Debug: Failed with error: proto_auth.so:
cannot open shared object file: No such file or directory
Mon Sep 28 16:34:26 2020 : Debug: listen {
Mon Sep 28 16:34:26 2020 : Debug:       type = "auth"
Mon Sep 28 16:34:26 2020 : Debug:       ipaddr = 127.0.0.1
Mon Sep 28 16:34:26 2020 : Debug:       port = 18120
Mon Sep 28 16:34:26 2020 : Debug: }
Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address * port 1812
bound to server default
Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address * port 1813
bound to server default
Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address :: port 1812
bound to server default
Mon Sep 28 16:34:26 2020 : Debug: Listening on acct address :: port 1813
bound to server default
Mon Sep 28 16:34:26 2020 : Debug: Listening on auth address 127.0.0.1
port 18120 bound to server inner-tunnel
Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address
* port 34165'
Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address * port 34165
Mon Sep 28 16:34:26 2020 : Debug: Opened new proxy socket 'proxy address
:: port 59302'
Mon Sep 28 16:34:26 2020 : Debug: Listening on proxy address :: port 59302
Mon Sep 28 16:34:26 2020 : Info: Ready to process requests

Need your advise.

--
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

deployingradius and send Accounting to a nother server

Linux Threads
Hi Freeradius Users List,

Autentication works as per deployingradius Thank you, now I need
accounting packets forwarded to a nother Radius box via replicate
module, is this possible?

Regards

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Alan DeKok-2
On Sep 28, 2020, at 6:33 AM, Linux Threads <[hidden email]> wrote:
>
> Hi Freeradius Users List,

  It's generally best to start your own thread, instead of replying to someone else message.

> Autentication works as per deployingradius Thank you, now I need
> accounting packets forwarded to a nother Radius box via replicate
> module, is this possible?

  Yes.

  It's documented.

  Do you have a *specific* question about how to do it, or about the documentation?

  Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: Freeradius latest rpm on centos7

Alan DeKok-2
In reply to this post by Ammad Ali
On Sep 28, 2020, at 2:51 AM, Ammad Ali <[hidden email]> wrote:
>
> I have installed latest RPM of freeradius from https://packetfence.org/downloads/PacketFence/CentOS7/devel/x86_64/RPMS/ on centos 7.

  We don't control that site and we have no input into it.

> After fresh install when I start radius in debug mode, it gives me below errors of auth and acct protocol.

  The server still starts.  Ignore the messages.

  Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Linux Threads
In reply to this post by Alan DeKok-2
Hi,

Thank you for taking the time,

On Mon, 2020-09-28 at 07:41 -0400, Alan DeKok wrote:

> On Sep 28, 2020, at 6:33 AM, Linux Threads <[hidden email]>
> wrote:
> > Hi Freeradius Users List,
>
>   It's generally best to start your own thread, instead of replying
> to someone else message.
>
> > Autentication works as per deployingradius Thank you, now I need
> > accounting packets forwarded to a nother Radius box via replicate
> > module, is this possible?
>
>   Yes.
>
>   It's documented.

the replicate module says that it works the same way as proxy


>   Do you have a *specific* question about how to do it, or about the
> documentation?

the user only authenticate with the nt-domain username, how is this
tied to a realm?

Mon Sep 28 09:46:43 2020 : Debug:  # Loading accounting {...}
Mon Sep 28 09:46:43 2020 : Debug:   replicate
Mon Sep 28 09:46:43 2020 : Debug:   update {
Mon Sep 28 09:46:43 2020 : Debug:    &control:Replicate-To-Realm :=
"CLIENT-ACCT-REALM"


replicate config file:
replicate {
 
home_server CLIENT-ACCT-SERVER {
            type                  = acct
            ipaddr               = 192.168.1.1
            src_ipaddr         = 192.168.1.241
            port                   = 1813
            secret               = replicate-acct
            require_message_authenticator = yes
}  
 
home_server_pool CLIENT-ACCT-SERVER-POOL {
            type = fail-over
            home_server = CLIENT-ACCT-SERVER
 
}

realm CLIENT-ACCT-REALM {
            type      = radius
            pool      = CLIENT-ACCT-SERVER-POOL
nosprip
 
}
}

sites-enabled/default

accounting {
replicate
       update control {
        &Replicate-to-Realm := "CLIENT-ACCT-REALM"

if I place replicate module above update control or below it does not
matter same effect

I can get freeradius to send with the following command but I geuss it
does not come from the nas client

"echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123
Received response ID 21, code 5, length = 20"

Mon Sep 28 14:06:42 2020 : Debug: (33) # Executing section accounting
from file /etc/freeradius/3.0/sites-enabled/default
Mon Sep 28 14:06:42
2020 : Debug: (33)   accounting {
Mon Sep 28 14:06:42 2020 : Debug: (33)
modsingle[accounting]: calling replicate (rlm_replicate)
Mon Sep 28
14:06:42 2020 : Debug: (33)     modsingle[accounting]: returned from
replicate (rlm_replicate)
Mon Sep 28 14:06:42 2020 : Debug: (33)    
[replicate] = noop
Mon Sep 28 14:06:42 2020 : Debug: (33)     update
control {
Mon Sep 28 14:06:42 2020 : Debug: (33)       &Replicate-to-
Realm := "CLIENT-ACCT-REALM"
Mon Sep 28 14:06:42 2020 : Debug: (33)    
} # update control = noop
Mon Sep 28 14:06:42 2020 : Debug: (33)    
modsingle[accounting]: calling detail (rlm_detail)

Mon Sep 28 14:25:29 2020 : Debug: (2) detail:    -->
/var/log/freeradius/radacct/127.0.0.1/detail-20200928


Mon Sep 28 14:25:29 2020
        Message-Authenticator = 0x4e938c9236a109448204634f7930a20d
        NAS-IP-Address = 127.0.0.1
        Event-Timestamp = "Sep 28 2020 14:25:29 SAST"
        Tmp-String-9 = "ai:"
        Acct-Unique-Session-Id = "a90afff2a77f213d484c7ec2be0d0330"
        Timestamp = 1601295929


>   Alan DeKok.

Regards



-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Alan DeKok-2
On Sep 28, 2020, at 8:32 AM, Linux Threads <[hidden email]> wrote:
> the replicate module says that it works the same way as proxy

  No, it doesn't.  The documentation explicitly says that it's not the same as proxying.  It's similar, but not "the same".

>>  Do you have a *specific* question about how to do it, or about the
>> documentation?
>
> the user only authenticate with the nt-domain username, how is this
> tied to a realm?

  via the Replicate-To-Realm attribute... as the documentation says.

  The documentation says how to use the "replicate" module.  If you try to do anything else, it won't work.

> Mon Sep 28 09:46:43 2020 : Debug:  # Loading accounting {...}
> Mon Sep 28 09:46:43 2020 : Debug:   replicate
> Mon Sep 28 09:46:43 2020 : Debug:   update {
> Mon Sep 28 09:46:43 2020 : Debug:    &control:Replicate-To-Realm :=
> "CLIENT-ACCT-REALM"
>
>
> replicate config file:
> replicate {
>
> home_server CLIENT-ACCT-SERVER {

  No, you can't invent configuration and expect it to work.

  You can't put "home_server" into the configuration for the replicate module.

  Read the debug output... it will show you that it is NOT loading the "CLIENT-ACCT-SERVER" configuration.

  Realms and home_servers go into proxy.conf.

  Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Linux Threads
Hi Guys,

I am still not winning,

for replication: the home server, home server pool and the realm are
configured in proxy.conf

replicate should be listed in sites-enabled/"site" either under the
below sections depending on requirements I am using accounting:

authorize
accounting
preacct
pre-proxy
recv-coa

and control I have listed it under accounting:

       update control {
        &Replicate-to-Realm := "REALM-NAME"
    }

do I leave mods-enabled/replicate as is?

replicate {
}

if a user auths with username or nt-domain\username, it does not
replicate,

the only time it send packets to home server is when I use:

echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123
Received response ID 21, code 5, length = 20

replicate is loaded:

Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_replicate, checking if
it's valid
Wed Sep 30 09:02:45 2020 : Debug:   # Loaded module rlm_replicate
Wed Sep 30 09:02:45 2020 : Debug:   # Loading module "replicate" from
file /etc/freeradius/3.0/mods-enabled/replicate
Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_realm, checking if it's
valid

I have no otherway of testing this exept if I auth against the AP

Thanks in advance

On Mon, 2020-09-28 at 08:55 -0400, Alan DeKok wrote:

> > the replicate module says that it works the same way as proxy
>
>   No, it doesn't.  The documentation explicitly says that it's not
> the same as proxying.  It's similar, but not "the same".
>>>
> > > Do you have a *specific* question about how to do it, or about
> > > the
> > > documentation?
> >
> > the user only authenticate with the nt-domain username, how is this
> > tied to a realm?
>
>   via the Replicate-To-Realm attribute... as the documentation says.
>
>   The documentation says how to use the "replicate" module.  If you
> try to do anything else, it won't work.
>
> > Mon Sep 28 09:46:43 2020 : Debug:  # Loading accounting {...}
> > Mon Sep 28 09:46:43 2020 : Debug:   replicate
> > Mon Sep 28 09:46:43 2020 : Debug:   update {
> > Mon Sep 28 09:46:43 2020 : Debug:    &control:Replicate-To-Realm :=
> > "CLIENT-ACCT-REALM"
> >
> >
> > replicate config file:
> > replicate {
> >
> > home_server CLIENT-ACCT-SERVER {
>
>   No, you can't invent configuration and expect it to work.
>
>   You can't put "home_server" into the configuration for the
> replicate module.
>
>   Read the debug output... it will show you that it is NOT loading
> the "CLIENT-ACCT-SERVER" configuration.
>
>   Realms and home_servers go into proxy.conf.
>
>   Alan DeKok.
>

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Alan DeKok-2

> On Sep 30, 2020, at 8:31 AM, Linux Threads <[hidden email]> wrote:
>
> for replication: the home server, home server pool and the realm are
> configured in proxy.conf

  That's good.

> replicate should be listed in sites-enabled/"site" either under the
> below sections depending on requirements I am using accounting:

  OK.

> and control I have listed it under accounting:
>
>       update control {
>        &Replicate-to-Realm := "REALM-NAME"
>    }
>
> do I leave mods-enabled/replicate as is?

  Yes.  That's the default configuration for the module.  The documentation makes it clear what you need to do.

> if a user auths with username or nt-domain\username, it does not
> replicate,

  So.... where is the debug output?

> the only time it send packets to home server is when I use:
>
> echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123
> Received response ID 21, code 5, length = 20
>
> replicate is loaded:
>
> Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_replicate, checking if
> it's valid

  Don't use "radiusd -Xxx".

> I have no otherway of testing this exept if I auth against the AP

  You can run the server in debugging mode to see the packets from the AP.  Then, copy the packets, and resend them using radclient.

  And PLEASE read http://wiki.freeradius.org/list-help

  ALL of the documentation says to run the server in debugging mode, and post the output to the list.  The above page also links to another page which explains how to read the output of "radiusd -X".

  When you ignore the documentation, you're wasting your time and ours.  We wrote the documentation in order to help people.  If you want help, READ THE DOCS, and FOLLOW THE INSTRUCTIONS.

  Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Linux Threads
HI,


thanks for your effords thus far;

what is strange is that the radius server is sending an arp request for
the homeserver I have configured not sure if it is related,

as requested here is the debug output

sudo freeradius -X
FreeRADIUS Version 3.0.17
Copyright (C) 1999-2017 The FreeRADIUS server project and contributors
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License
For more information about these matters, see the file named COPYRIGHT
Starting - reading configuration files ...
including dictionary file /usr/share/freeradius/dictionary
including dictionary file /usr/share/freeradius/dictionary.dhcp
including dictionary file /usr/share/freeradius/dictionary.vqp
including dictionary file /etc/freeradius/3.0/dictionary
including configuration file /etc/freeradius/3.0/radiusd.conf
including configuration file /etc/freeradius/3.0/proxy.conf
including configuration file /etc/freeradius/3.0/clients.conf
including files in directory /etc/freeradius/3.0/mods-enabled/
including configuration file /etc/freeradius/3.0/mods-enabled/always
including configuration file /etc/freeradius/3.0/mods-
enabled/attr_filter
including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap
including configuration file /etc/freeradius/3.0/mods-enabled/chap
including configuration file /etc/freeradius/3.0/mods-enabled/date
including configuration file /etc/freeradius/3.0/mods-enabled/detail
including configuration file /etc/freeradius/3.0/mods-
enabled/detail.log
including configuration file /etc/freeradius/3.0/mods-
enabled/dynamic_clients
including configuration file /etc/freeradius/3.0/mods-enabled/eap
including configuration file /etc/freeradius/3.0/mods-enabled/echo
including configuration file /etc/freeradius/3.0/mods-enabled/exec
including configuration file /etc/freeradius/3.0/mods-
enabled/expiration
including configuration file /etc/freeradius/3.0/mods-enabled/expr
including configuration file /etc/freeradius/3.0/mods-enabled/files
including configuration file /etc/freeradius/3.0/mods-enabled/linelog
including configuration file /etc/freeradius/3.0/mods-enabled/logintime
including configuration file /etc/freeradius/3.0/mods-enabled/passwd
including configuration file /etc/freeradius/3.0/mods-
enabled/preprocess
including configuration file /etc/freeradius/3.0/mods-enabled/radutmp
including configuration file /etc/freeradius/3.0/mods-enabled/soh
including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp
including configuration file /etc/freeradius/3.0/mods-enabled/unix
including configuration file /etc/freeradius/3.0/mods-enabled/unpack
including configuration file /etc/freeradius/3.0/mods-enabled/utf8
including configuration file /etc/freeradius/3.0/mods-enabled/perl
including configuration file /etc/freeradius/3.0/mods-enabled/pap
including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth
including configuration file /etc/freeradius/3.0/mods-enabled/mschap
including configuration file /etc/freeradius/3.0/mods-enabled/digest
including configuration file /etc/freeradius/3.0/mods-enabled/replicate
including configuration file /etc/freeradius/3.0/mods-enabled/realm
including files in directory /etc/freeradius/3.0/policy.d/
including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
including configuration file /etc/freeradius/3.0/policy.d/accounting
including configuration file
/etc/freeradius/3.0/policy.d/accounting.dpkg-old
including configuration file
/etc/freeradius/3.0/policy.d/canonicalization
including configuration file /etc/freeradius/3.0/policy.d/control
including configuration file /etc/freeradius/3.0/policy.d/cui
including configuration file /etc/freeradius/3.0/policy.d/debug
including configuration file /etc/freeradius/3.0/policy.d/dhcp
including configuration file /etc/freeradius/3.0/policy.d/eap
including configuration file /etc/freeradius/3.0/policy.d/filter
including configuration file /etc/freeradius/3.0/policy.d/moonshot-
targeted-ids
including configuration file /etc/freeradius/3.0/policy.d/moonshot-
targeted-ids.dpkg-old
including configuration file /etc/freeradius/3.0/policy.d/operator-name
including configuration file /etc/freeradius/3.0/policy.d/rfc7542
including files in directory /etc/freeradius/3.0/sites-enabled/
including configuration file /etc/freeradius/3.0/sites-enabled/inner-
tunnel
including configuration file /etc/freeradius/3.0/sites-enabled/default
main {
 security {
  user = "freerad"
  group = "freerad"
  allow_core_dumps = no
 }
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
}
main {
        name = "freeradius"
        prefix = "/usr"
        localstatedir = "/var"
        sbindir = "/usr/sbin"
        logdir = "/var/log/freeradius"
        run_dir = "/var/run/freeradius"
        libdir = "/usr/lib/freeradius"
        radacctdir = "/var/log/freeradius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 16384
        pidfile = "/var/run/freeradius/freeradius.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
  stripped_names = no
  auth = yes
  auth_badpass = yes
  auth_goodpass = no
  colourise = yes
  msg_denied = "You are already logged in - access denied"
 }
 resources {
 }
 security {
  max_attributes = 200
  reject_delay = 1.000000
  status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
  retry_delay = 5
  retry_count = 3
  default_fallback = no
  dead_time = 120
  wake_all_if_all_dead = no
 }
 home_server localhost {
  ipaddr = 127.0.0.1
  port = 1812
  type = "auth"
  secret = <<< secret >>>
  response_window = 20.000000
  response_timeouts = 1
  max_outstanding = 65536
  zombie_period = 40
  status_check = "status-server"
  ping_interval = 30
  check_interval = 30
  check_timeout = 4
  num_answers_to_alive = 3
  revive_interval = 120
  limit {
  max_connections = 16
  max_requests = 0
  lifetime = 0
  idle_timeout = 0
  }
  coa {
  irt = 2
  mrt = 16
  mrc = 5
  mrd = 30
  }
 }
 home_server CLIENT-ACCT-SERVER {
  ipaddr = 192.168.1.1
  port = 1813
  type = "acct"
  secret = <<< secret >>>
  src_ipaddr = "192.168.1.241"
  response_window = 30.000000
  response_timeouts = 1
  max_outstanding = 65536
  zombie_period = 40
  status_check = "none"
  ping_interval = 30
  check_timeout = 4
  num_answers_to_alive = 3
  revive_interval = 300
  limit {
  max_connections = 16
  max_requests = 0
  lifetime = 0
  idle_timeout = 0
  }
  coa {
  irt = 2
  mrt = 16
  mrc = 5
  mrd = 30
  }
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
 home_server_pool CLIENT-ACCT-SERVER-POOL {
        type = fail-over
        home_server = CLIENT-ACCT-SERVER
 }
 realm CLIENT-ACCT-REALM {
        acct_pool = CLIENT-ACCT-SERVER-POOL
 }
radiusd: #### Loading Clients ####
 client localhost {
  ipaddr = 127.0.0.1
  require_message_authenticator = no
  secret = <<< secret >>>
  nas_type = "other"
  proto = "*"
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
 client localhost_ipv6 {
  ipv6addr = ::1
  require_message_authenticator = no
  secret = <<< secret >>>
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
 client CLIENT-TEST-AP {
  ipaddr = 10.0.1.241
  require_message_authenticator = no
  secret = <<< secret >>>
  limit {
  max_connections = 16
  lifetime = 0
  idle_timeout = 30
  }
 }
Debugger not attached
 # Creating Auth-Type = mschap
 # Creating Auth-Type = eap
 # Creating Auth-Type = PAP
 # Creating Auth-Type = CHAP
 # Creating Auth-Type = MS-CHAP
 # Creating Auth-Type = NTLM
 # Creating Auth-Type = digest
radiusd: #### Instantiating modules ####
 modules {
  # Loaded module rlm_always
  # Loading module "reject" from file /etc/freeradius/3.0/mods-
enabled/always
  always reject {
  rcode = "reject"
  simulcount = 0
  mpp = no
  }
  # Loading module "fail" from file /etc/freeradius/3.0/mods-
enabled/always
  always fail {
  rcode = "fail"
  simulcount = 0
  mpp = no
  }
  # Loading module "ok" from file /etc/freeradius/3.0/mods-
enabled/always
  always ok {
  rcode = "ok"
  simulcount = 0
  mpp = no
  }
  # Loading module "handled" from file /etc/freeradius/3.0/mods-
enabled/always
  always handled {
  rcode = "handled"
  simulcount = 0
  mpp = no
  }
  # Loading module "invalid" from file /etc/freeradius/3.0/mods-
enabled/always
  always invalid {
  rcode = "invalid"
  simulcount = 0
  mpp = no
  }
  # Loading module "userlock" from file /etc/freeradius/3.0/mods-
enabled/always
  always userlock {
  rcode = "userlock"
  simulcount = 0
  mpp = no
  }
  # Loading module "notfound" from file /etc/freeradius/3.0/mods-
enabled/always
  always notfound {
  rcode = "notfound"
  simulcount = 0
  mpp = no
  }
  # Loading module "noop" from file /etc/freeradius/3.0/mods-
enabled/always
  always noop {
  rcode = "noop"
  simulcount = 0
  mpp = no
  }
  # Loading module "updated" from file /etc/freeradius/3.0/mods-
enabled/always
  always updated {
  rcode = "updated"
  simulcount = 0
  mpp = no
  }
  # Loaded module rlm_attr_filter
  # Loading module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.post-proxy {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-
proxy"
  key = "%{Realm}"
  relaxed = no
  }
  # Loading module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.pre-proxy {
  filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-
proxy"
  key = "%{Realm}"
  relaxed = no
  }
  # Loading module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.access_reject {
  filename = "/etc/freeradius/3.0/mods-
config/attr_filter/access_reject"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.access_challenge {
  filename = "/etc/freeradius/3.0/mods-
config/attr_filter/access_challenge"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loading module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
  attr_filter attr_filter.accounting_response {
  filename = "/etc/freeradius/3.0/mods-
config/attr_filter/accounting_response"
  key = "%{User-Name}"
  relaxed = no
  }
  # Loaded module rlm_cache
  # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-
enabled/cache_eap
  cache cache_eap {
  driver = "rlm_cache_rbtree"
  key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
  ttl = 15
  max_entries = 0
  epoch = 0
  add_stats = no
  }
  # Loaded module rlm_chap
  # Loading module "chap" from file /etc/freeradius/3.0/mods-
enabled/chap
  # Loaded module rlm_date
  # Loading module "date" from file /etc/freeradius/3.0/mods-
enabled/date
  date {
  format = "%b %e %Y %H:%M:%S %Z"
  utc = no
  }
  # Loading module "wispr2date" from file /etc/freeradius/3.0/mods-
enabled/date
  date wispr2date {
  format = "%Y-%m-%dT%H:%M:%S"
  utc = no
  }
  # Loaded module rlm_detail
  # Loading module "detail" from file /etc/freeradius/3.0/mods-
enabled/detail
  detail {
  filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-
Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "auth_log" from file /etc/freeradius/3.0/mods-
enabled/detail.log
  detail auth_log {
  filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-
Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "reply_log" from file /etc/freeradius/3.0/mods-
enabled/detail.log
  detail reply_log {
  filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-
Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-
enabled/detail.log
  detail pre_proxy_log {
  filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-
Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-
enabled/detail.log
  detail post_proxy_log {
  filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-
Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
  header = "%t"
  permissions = 384
  locking = no
  escape_filenames = no
  log_packet_header = no
  }
  # Loaded module rlm_dynamic_clients
  # Loading module "dynamic_clients" from file
/etc/freeradius/3.0/mods-enabled/dynamic_clients
  # Loaded module rlm_eap
  # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  eap {
  default_eap_type = "md5"
  timer_expire = 60
  ignore_unknown_eap_types = no
  cisco_accounting_username_bug = no
  max_sessions = 16384
  }
  # Loaded module rlm_exec
  # Loading module "echo" from file /etc/freeradius/3.0/mods-
enabled/echo
  exec echo {
  wait = yes
  program = "/bin/echo %{User-Name}"
  input_pairs = "request"
  output_pairs = "reply"
  shell_escape = yes
  }
  # Loading module "exec" from file /etc/freeradius/3.0/mods-
enabled/exec
  exec {
  wait = no
  input_pairs = "request"
  shell_escape = yes
  timeout = 10
  }
  # Loaded module rlm_expiration
  # Loading module "expiration" from file /etc/freeradius/3.0/mods-
enabled/expiration
  # Loaded module rlm_expr
  # Loading module "expr" from file /etc/freeradius/3.0/mods-
enabled/expr
  expr {
  safe_characters =
"@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:
/äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  }
  # Loaded module rlm_files
  # Loading module "files" from file /etc/freeradius/3.0/mods-
enabled/files
  files {
  filename = "/etc/freeradius/3.0/mods-config/files/authorize"
  acctusersfile = "/etc/freeradius/3.0/mods-
config/files/accounting"
  preproxy_usersfile = "/etc/freeradius/3.0/mods-
config/files/pre-proxy"
  }
  # Loaded module rlm_linelog
  # Loading module "linelog" from file /etc/freeradius/3.0/mods-
enabled/linelog
  linelog {
  filename = "/var/log/freeradius/linelog"
  escape_filenames = no
  syslog_severity = "info"
  permissions = 384
  format = "This is a log message for %{User-Name}"
  reference = "messages.%{%{reply:Packet-Type}:-default}"
  }
  # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-
enabled/linelog
  linelog log_accounting {
  filename = "/var/log/freeradius/linelog-accounting"
  escape_filenames = no
  syslog_severity = "info"
  permissions = 384
  format = ""
  reference = "Accounting-Request.%{%{Acct-Status-Type}:-
unknown}"
  }
  # Loaded module rlm_logintime
  # Loading module "logintime" from file /etc/freeradius/3.0/mods-
enabled/logintime
  logintime {
  minimum_timeout = 60
  }
  # Loaded module rlm_passwd
  # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-
enabled/passwd
  passwd etc_passwd {
  filename = "/etc/passwd"
  format = "*User-Name:Crypt-Password:"
  delimiter = ":"
  ignore_nislike = no
  ignore_empty = yes
  allow_multiple_keys = no
  hash_size = 100
  }
  # Loaded module rlm_preprocess
  # Loading module "preprocess" from file /etc/freeradius/3.0/mods-
enabled/preprocess
  preprocess {
  huntgroups = "/etc/freeradius/3.0/mods-
config/preprocess/huntgroups"
  hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"
  with_ascend_hack = no
  ascend_channels_per_line = 23
  with_ntdomain_hack = no
  with_specialix_jetstream_hack = no
  with_cisco_vsa_hack = no
  with_alvarion_vsa_hack = no
  }
  # Loaded module rlm_radutmp
  # Loading module "radutmp" from file /etc/freeradius/3.0/mods-
enabled/radutmp
  radutmp {
  filename = "/var/log/freeradius/radutmp"
  username = "%{User-Name}"
  case_sensitive = yes
  check_with_nas = yes
  permissions = 384
  caller_id = yes
  }
  # Loaded module rlm_soh
  # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh
  soh {
  dhcp = yes
  }
  # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-
enabled/sradutmp
  radutmp sradutmp {
  filename = "/var/log/freeradius/sradutmp"
  username = "%{User-Name}"
  case_sensitive = yes
  check_with_nas = yes
  permissions = 420
  caller_id = no
  }
  # Loaded module rlm_unix
  # Loading module "unix" from file /etc/freeradius/3.0/mods-
enabled/unix
  unix {
  radwtmp = "/var/log/freeradius/radwtmp"
  }
Creating attribute Unix-Group
  # Loaded module rlm_unpack
  # Loading module "unpack" from file /etc/freeradius/3.0/mods-
enabled/unpack
  # Loaded module rlm_utf8
  # Loading module "utf8" from file /etc/freeradius/3.0/mods-
enabled/utf8
  # Loaded module rlm_perl
  # Loading module "perl" from file /etc/freeradius/3.0/mods-
enabled/perl
  perl {
  filename = "/etc/freeradius/3.0/mods-config/perl/example.pl"
  func_authorize = "authorize"
  func_authenticate = "authenticate"
  func_post_auth = "post_auth"
  func_accounting = "accounting"
  func_preacct = "preacct"
  func_checksimul = "checksimul"
  func_detach = "detach"
  func_xlat = "xlat"
  func_pre_proxy = "pre_proxy"
  func_post_proxy = "post_proxy"
  func_recv_coa = "recv_coa"
  func_send_coa = "send_coa"
  perl_flags = "-T"
  }
  # Loaded module rlm_pap
  # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  pap {
  normalise = yes
  }
  # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-
enabled/ntlm_auth
  exec ntlm_auth {
  wait = yes
  program = "/usr/bin/ntlm_auth --request-nt-key --domain=client-
nt-domain --username=%{mschap:User-Name} --password=%{User-Password}"
  shell_escape = yes
  }
  # Loaded module rlm_mschap
  # Loading module "mschap" from file /etc/freeradius/3.0/mods-
enabled/mschap
  mschap {
  use_mppe = yes
  require_encryption = no
  require_strong = no
  with_ntdomain_hack = yes
  ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --
username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-
client-nt-domain} --challenge=%{mschap:Challenge:-00} --nt-
response=%{mschap:NT-Response:-00}"
   passchange {
   }
  allow_retry = yes
  winbind_retry_with_normalised_username = no
  }
  # Loaded module rlm_digest
  # Loading module "digest" from file /etc/freeradius/3.0/mods-
enabled/digest
  # Loaded module rlm_replicate
  # Loading module "replicate" from file /etc/freeradius/3.0/mods-
enabled/replicate
  # Loaded module rlm_realm
  # Loading module "IPASS" from file /etc/freeradius/3.0/mods-
enabled/realm
  realm IPASS {
  format = "prefix"
  delimiter = "/"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "suffix" from file /etc/freeradius/3.0/mods-
enabled/realm
  realm suffix {
  format = "suffix"
  delimiter = "@"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "bangpath" from file /etc/freeradius/3.0/mods-
enabled/realm
  realm bangpath {
  format = "prefix"
  delimiter = "!"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-
enabled/realm
  realm realmpercent {
  format = "suffix"
  delimiter = "%"
  ignore_default = no
  ignore_null = no
  }
  # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-
enabled/realm
  realm ntdomain {
  format = "prefix"
  delimiter = "\\"
  ignore_default = no
  ignore_null = no
  }
  instantiate {
  }
  # Instantiating module "reject" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "fail" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "ok" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "handled" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "noop" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "updated" from file /etc/freeradius/3.0/mods-
enabled/always
  # Instantiating module "attr_filter.post-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-
proxy
  # Instantiating module "attr_filter.pre-proxy" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-
proxy
  # Instantiating module "attr_filter.access_reject" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-
config/attr_filter/access_reject
  # Instantiating module "attr_filter.access_challenge" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-
config/attr_filter/access_challenge
  # Instantiating module "attr_filter.accounting_response" from file
/etc/freeradius/3.0/mods-enabled/attr_filter
reading pairlist file /etc/freeradius/3.0/mods-
config/attr_filter/accounting_response
  # Instantiating module "cache_eap" from file
/etc/freeradius/3.0/mods-enabled/cache_eap
rlm_cache (cache_eap): Driver rlm_cache_rbtree (module
rlm_cache_rbtree) loaded and linked
  # Instantiating module "detail" from file /etc/freeradius/3.0/mods-
enabled/detail
  # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-
enabled/detail.log
rlm_detail (auth_log): 'User-Password' suppressed, will not appear in
detail output
  # Instantiating module "reply_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "pre_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "post_proxy_log" from file
/etc/freeradius/3.0/mods-enabled/detail.log
  # Instantiating module "eap" from file /etc/freeradius/3.0/mods-
enabled/eap
   # Linked to sub-module rlm_eap_md5
   # Linked to sub-module rlm_eap_leap
   # Linked to sub-module rlm_eap_gtc
   gtc {
    challenge = "Password: "
    auth_type = "PAP"
   }
   # Linked to sub-module rlm_eap_tls
   tls {
    tls = "tls-common"
   }
   tls-config tls-common {
    verify_depth = 0
    ca_path = "/etc/freeradius/3.0/certs"
    pem_file_type = yes
    private_key_file = "/etc/freeradius/3.0/certs/server.pem"
    certificate_file = "/etc/freeradius/3.0/certs/server.pem"
    ca_file = "/etc/freeradius/3.0/certs/ca.pem"
    private_key_password = <<< secret >>>
    dh_file = "/etc/freeradius/3.0/certs/dh"
    fragment_size = 1024
    include_length = yes
    auto_chain = yes
    check_crl = no
    check_all_crl = no
    cipher_list = "DEFAULT"
    cipher_server_preference = no
    ecdh_curve = "prime256v1"
    disable_tlsv1 = yes
    disable_tlsv1_1 = yes
    tls_max_version = "1.2"
    tls_min_version = "1.2"
    cache {
    enable = no
    lifetime = 24
    max_entries = 255
    }
    verify {
    skip_if_ocsp_ok = no
    }
    ocsp {
    enable = no
    override_cert_url = yes
    url = "http://127.0.0.1/ocsp/"
    use_nonce = yes
    timeout = 0
    softfail = no
    }
   }
Please use tls_min_version and tls_max_version instead of disable_tlsv1
Please use tls_min_version and tls_max_version instead of
disable_tlsv1_2
   # Linked to sub-module rlm_eap_ttls
   ttls {
    tls = "tls-common"
    default_eap_type = "md5"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    virtual_server = "inner-tunnel"
    include_length = yes
    require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_peap
   peap {
    tls = "tls-common"
    default_eap_type = "mschapv2"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    proxy_tunneled_request_as_eap = yes
    virtual_server = "inner-tunnel"
    soh = no
    require_client_cert = no
   }
tls: Using cached TLS configuration from previous invocation
   # Linked to sub-module rlm_eap_mschapv2
   mschapv2 {
    with_ntdomain_hack = no
    send_error = no
   }
  # Instantiating module "expiration" from file
/etc/freeradius/3.0/mods-enabled/expiration
  # Instantiating module "files" from file /etc/freeradius/3.0/mods-
enabled/files
reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting
reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy
  # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-
enabled/linelog
  # Instantiating module "log_accounting" from file
/etc/freeradius/3.0/mods-enabled/linelog
  # Instantiating module "logintime" from file
/etc/freeradius/3.0/mods-enabled/logintime
  # Instantiating module "etc_passwd" from file
/etc/freeradius/3.0/mods-enabled/passwd
rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  # Instantiating module "preprocess" from file
/etc/freeradius/3.0/mods-enabled/preprocess
reading pairlist file /etc/freeradius/3.0/mods-
config/preprocess/huntgroups
reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints
  # Instantiating module "perl" from file /etc/freeradius/3.0/mods-
enabled/perl
  # Instantiating module "pap" from file /etc/freeradius/3.0/mods-
enabled/pap
  # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-
enabled/mschap
rlm_mschap (mschap): authenticating by calling 'ntlm_auth'
  # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-
enabled/realm
  # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-
enabled/realm
  # Instantiating module "bangpath" from file /etc/freeradius/3.0/mods-
enabled/realm
  # Instantiating module "realmpercent" from file
/etc/freeradius/3.0/mods-enabled/realm
  # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-
enabled/realm
 } # modules
radiusd: #### Loading Virtual Servers ####
server { # from file /etc/freeradius/3.0/radiusd.conf
} # server
server inner-tunnel { # from file /etc/freeradius/3.0/sites-
enabled/inner-tunnel
 # Loading authenticate {...}
 # Loading authorize {...}
Ignoring "sql" (see raddb/mods-available/README.rst)
Ignoring "ldap" (see raddb/mods-available/README.rst)
 # Loading session {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
 # Skipping contents of 'if' as it is always 'false' --
/etc/freeradius/3.0/sites-enabled/inner-tunnel:341
} # server inner-tunnel
server default { # from file /etc/freeradius/3.0/sites-enabled/default
 # Loading authenticate {...}
 # Loading authorize {...}
 # Loading preacct {...}
 # Loading accounting {...}
 # Loading post-proxy {...}
 # Loading post-auth {...}
} # server default
radiusd: #### Opening IP addresses and Ports ####
listen {
  type = "auth"
  ipaddr = 127.0.0.1
  port = 18120
}
listen {
  type = "auth"
  ipaddr = *
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "acct"
  ipaddr = *
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "auth"
  ipv6addr = ::
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
listen {
  type = "acct"
  ipv6addr = ::
  port = 0
   limit {
    max_connections = 16
    lifetime = 0
    idle_timeout = 30
   }
}
Listening on auth address 127.0.0.1 port 18120 bound to server inner-
tunnel
Listening on auth address * port 1812 bound to server default
Listening on acct address * port 1813 bound to server default
Listening on auth address :: port 1812 bound to server default
Listening on acct address :: port 1813 bound to server default
Listening on proxy address * port 37028
Listening on proxy address :: port 51490
Ready to process requests
(0) Received Access-Request Id 187 from 10.0.1.241:32768 to
192.168.1.241:1812 length 141
(0)   User-Name = "client-test-user"
(0)   NAS-IP-Address = 10.0.1.241
(0)   NAS-Port = 0
(0)   Called-Station-Id = "60-03-47-12-C5-7F"
(0)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(0)   Framed-MTU = 1400
(0)   NAS-Port-Type = Wireless-802.11
(0)   EAP-Message = 0x02010015016173747574652d746573742d75736572
(0)   Message-Authenticator = 0xa99423b63e9e814224134870e99ec71d
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"
(0) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(0) suffix: No such realm "NULL"
(0)     [suffix] = noop
(0) eap: Peer sent EAP Response (code 2) ID 1 length 21
(0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(0)     [eap] = ok
(0)   } # authorize = ok
(0) Found Auth-Type = eap
(0) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(0)   authenticate {
(0) eap: Peer sent packet with method EAP Identity (1)
(0) eap: Calling submodule eap_md5 to process data
(0) eap_md5: Issuing MD5 Challenge
(0) eap: Sending EAP Request (code 1) ID 2 length 22
(0) eap: EAP session adding &reply:State = 0x2f19408c2f1b44c6
(0)     [eap] = handled
(0)   } # authenticate = handled
(0) Using Post-Auth-Type Challenge
(0) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(0)   Challenge { ... } # empty sub-section is ignored
(0) Sent Access-Challenge Id 187 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(0)   EAP-Message = 0x010200160410ac3f54d14b3a4f03c3401d8309dc1cec
(0)   Message-Authenticator = 0x00000000000000000000000000000000
(0)   State = 0x2f19408c2f1b44c676c2fe7afaf965a8
(0) Finished request
Waking up in 4.9 seconds.
(1) Received Access-Request Id 188 from 10.0.1.241:32768 to
192.168.1.241:1812 length 144
(1)   User-Name = "client-test-user"
(1)   NAS-IP-Address = 10.0.1.241
(1)   NAS-Port = 0
(1)   Called-Station-Id = "60-03-47-12-C5-7F"
(1)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(1)   Framed-MTU = 1400
(1)   NAS-Port-Type = Wireless-802.11
(1)   EAP-Message = 0x020200060319
(1)   State = 0x2f19408c2f1b44c676c2fe7afaf965a8
(1)   Message-Authenticator = 0x3e36f0495ca757e9c65b6c20dd2331c0
(1) session-state: No cached attributes
(1) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if (&User-Name =~ /\.\./ ) {
(1)         if (&User-Name =~ /\.\./ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> FALSE
(1)         if (&User-Name =~ /@\./)  {
(1)         if (&User-Name =~ /@\./)   -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"
(1) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(1) suffix: No such realm "NULL"
(1)     [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 2 length 6
(1) eap: No EAP Start, assuming it's an on-going EAP conversation
(1)     [eap] = updated
(1)     [files] = noop
(1)     [expiration] = noop
(1)     [logintime] = noop
(1) pap: WARNING: No "known good" password found for the user.  Not
setting Auth-Type
(1) pap: WARNING: Authentication will fail unless a "known good"
password is available
(1)     [pap] = noop
(1)   } # authorize = updated
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(1)   authenticate {
(1) eap: Expiring EAP session with state 0x2f19408c2f1b44c6
(1) eap: Finished EAP session with state 0x2f19408c2f1b44c6
(1) eap: Previous EAP request found for state 0x2f19408c2f1b44c6,
released from the list
(1) eap: Peer sent packet with method EAP NAK (3)
(1) eap: Found mutually acceptable type PEAP (25)
(1) eap: Calling submodule eap_peap to process data
(1) eap_peap: Initiating new EAP-TLS session
(1) eap_peap: [eaptls start] = request
(1) eap: Sending EAP Request (code 1) ID 3 length 6
(1) eap: EAP session adding &reply:State = 0x2f19408c2e1a59c6
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(1)   Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 188 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(1)   EAP-Message = 0x010300061920
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0x2f19408c2e1a59c676c2fe7afaf965a8
(1) Finished request
Waking up in 4.9 seconds.
(2) Received Access-Request Id 189 from 10.0.1.241:32768 to
192.168.1.241:1812 length 310
(2)   User-Name = "client-test-user"
(2)   NAS-IP-Address = 10.0.1.241
(2)   NAS-Port = 0
(2)   Called-Station-Id = "60-03-47-12-C5-7F"
(2)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(2)   Framed-MTU = 1400
(2)   NAS-Port-Type = Wireless-802.11
(2)   EAP-Message =
0x020300ac1980000000a2160303009d0100009903035f7590d6bd503a391b92654f49a
c436d073b3e922a2c5e3369776b0b75eddadc00002ac02cc02bc030c02f009f009ec024
c023c028c027c00ac009c014c013009d009c003d003c0035002f000a010000460005000
50100000000000a00080006001d
(2)   State = 0x2f19408c2e1a59c676c2fe7afaf965a8
(2)   Message-Authenticator = 0xb44537a405aed36e10fd26ff1212ec81
(2) session-state: No cached attributes
(2) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"
(2) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(2) suffix: No such realm "NULL"
(2)     [suffix] = noop
(2) eap: Peer sent EAP Response (code 2) ID 3 length 172
(2) eap: Continuing tunnel setup
(2)     [eap] = ok
(2)   } # authorize = ok
(2) Found Auth-Type = eap
(2) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(2)   authenticate {
(2) eap: Expiring EAP session with state 0x2f19408c2e1a59c6
(2) eap: Finished EAP session with state 0x2f19408c2e1a59c6
(2) eap: Previous EAP request found for state 0x2f19408c2e1a59c6,
released from the list
(2) eap: Peer sent packet with method EAP PEAP (25)
(2) eap: Calling submodule eap_peap to process data
(2) eap_peap: Continuing EAP-TLS
(2) eap_peap: Peer indicated complete TLS record size will be 162 bytes
(2) eap_peap: Got complete TLS record (162 bytes)
(2) eap_peap: [eaptls verify] = length included
(2) eap_peap: (other): before SSL initialization
(2) eap_peap: TLS_accept: before SSL initialization
(2) eap_peap: TLS_accept: before SSL initialization
(2) eap_peap: <<< recv UNKNOWN TLS VERSION ?0304? [length 009d]
(2) eap_peap: TLS_accept: SSLv3/TLS read client hello
(2) eap_peap: >>> send TLS 1.2  [length 003d]
(2) eap_peap: TLS_accept: SSLv3/TLS write server hello
(2) eap_peap: >>> send TLS 1.2  [length 08bf]
(2) eap_peap: TLS_accept: SSLv3/TLS write certificate
(2) eap_peap: >>> send TLS 1.2  [length 014d]
(2) eap_peap: TLS_accept: SSLv3/TLS write key exchange
(2) eap_peap: >>> send TLS 1.2  [length 0004]
(2) eap_peap: TLS_accept: SSLv3/TLS write server done
(2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write
server done
(2) eap_peap: In SSL Handshake Phase
(2) eap_peap: In SSL Accept mode
(2) eap_peap: [eaptls process] = handled
(2) eap: Sending EAP Request (code 1) ID 4 length 1004
(2) eap: EAP session adding &reply:State = 0x2f19408c2d1d59c6
(2)     [eap] = handled
(2)   } # authenticate = handled
(2) Using Post-Auth-Type Challenge
(2) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(2)   Challenge { ... } # empty sub-section is ignored
(2) Sent Access-Challenge Id 189 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(2)   EAP-Message =
0x010403ec19c000000a61160303003d0200003903038f3d3f8f7f3fb1ff22498475736
563182fca8341022e1746de1bac3afbf6f12200c030000011ff01000100000b00040300
01020017000016030308bf0b0008bb0008b80003d2308203ce308202b6a003020102020
102300d06092a864886f70d0101
(2)   Message-Authenticator = 0x00000000000000000000000000000000
(2)   State = 0x2f19408c2d1d59c676c2fe7afaf965a8
(2) Finished request
Waking up in 4.9 seconds.
(3) Received Access-Request Id 190 from 10.0.1.241:32768 to
192.168.1.241:1812 length 144
(3)   User-Name = "client-test-user"
(3)   NAS-IP-Address = 10.0.1.241
(3)   NAS-Port = 0
(3)   Called-Station-Id = "60-03-47-12-C5-7F"
(3)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(3)   Framed-MTU = 1400
(3)   NAS-Port-Type = Wireless-802.11
(3)   EAP-Message = 0x020400061900
(3)   State = 0x2f19408c2d1d59c676c2fe7afaf965a8
(3)   Message-Authenticator = 0x68716177af467d2a12d6a8940ee6ab7d
(3) session-state: No cached attributes
(3) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (&User-Name) {
(3)       if (&User-Name)  -> TRUE
(3)       if (&User-Name)  {
(3)         if (&User-Name =~ / /) {
(3)         if (&User-Name =~ / /)  -> FALSE
(3)         if (&User-Name =~ /@[^@]*@/ ) {
(3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(3)         if (&User-Name =~ /\.\./ ) {
(3)         if (&User-Name =~ /\.\./ )  -> FALSE
(3)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(3)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(3)         if (&User-Name =~ /\.$/)  {
(3)         if (&User-Name =~ /\.$/)   -> FALSE
(3)         if (&User-Name =~ /@\./)  {
(3)         if (&User-Name =~ /@\./)   -> FALSE
(3)       } # if (&User-Name)  = notfound
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"
(3) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(3) suffix: No such realm "NULL"
(3)     [suffix] = noop
(3) eap: Peer sent EAP Response (code 2) ID 4 length 6
(3) eap: Continuing tunnel setup
(3)     [eap] = ok
(3)   } # authorize = ok
(3) Found Auth-Type = eap
(3) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(3)   authenticate {
(3) eap: Expiring EAP session with state 0x2f19408c2d1d59c6
(3) eap: Finished EAP session with state 0x2f19408c2d1d59c6
(3) eap: Previous EAP request found for state 0x2f19408c2d1d59c6,
released from the list
(3) eap: Peer sent packet with method EAP PEAP (25)
(3) eap: Calling submodule eap_peap to process data
(3) eap_peap: Continuing EAP-TLS
(3) eap_peap: Peer ACKed our handshake fragment
(3) eap_peap: [eaptls verify] = request
(3) eap_peap: [eaptls process] = handled
(3) eap: Sending EAP Request (code 1) ID 5 length 1000
(3) eap: EAP session adding &reply:State = 0x2f19408c2c1c59c6
(3)     [eap] = handled
(3)   } # authenticate = handled
(3) Using Post-Auth-Type Challenge
(3) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(3)   Challenge { ... } # empty sub-section is ignored
(3) Sent Access-Challenge Id 190 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(3)   EAP-Message =
0x010503e81940217e113b0db74005ed147213bb838d5b883dd7a71e480026d17f84189
851ad07796d0c48913c87ebdbb4e5cffb3ae09e56bbe20d7b93f5a3799c1a60343f1ca1
ee0004e0308204dc308203c4a003020102021449a7f678b76499ed03327ae353204d115
dfaba62300d06092a864886f70d
(3)   Message-Authenticator = 0x00000000000000000000000000000000
(3)   State = 0x2f19408c2c1c59c676c2fe7afaf965a8
(3) Finished request
Waking up in 4.9 seconds.
(4) Received Access-Request Id 191 from 10.0.1.241:32768 to
192.168.1.241:1812 length 144
(4)   User-Name = "client-test-user"
(4)   NAS-IP-Address = 10.0.1.241
(4)   NAS-Port = 0
(4)   Called-Station-Id = "60-03-47-12-C5-7F"
(4)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(4)   Framed-MTU = 1400
(4)   NAS-Port-Type = Wireless-802.11
(4)   EAP-Message = 0x020500061900
(4)   State = 0x2f19408c2c1c59c676c2fe7afaf965a8
(4)   Message-Authenticator = 0x0b54bdad79479e5d45d47f5f2079f512
(4) session-state: No cached attributes
(4) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(4)   authorize {
(4)     policy filter_username {
(4)       if (&User-Name) {
(4)       if (&User-Name)  -> TRUE
(4)       if (&User-Name)  {
(4)         if (&User-Name =~ / /) {
(4)         if (&User-Name =~ / /)  -> FALSE
(4)         if (&User-Name =~ /@[^@]*@/ ) {
(4)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(4)         if (&User-Name =~ /\.\./ ) {
(4)         if (&User-Name =~ /\.\./ )  -> FALSE
(4)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(4)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(4)         if (&User-Name =~ /\.$/)  {
(4)         if (&User-Name =~ /\.$/)   -> FALSE
(4)         if (&User-Name =~ /@\./)  {
(4)         if (&User-Name =~ /@\./)   -> FALSE
(4)       } # if (&User-Name)  = notfound
(4)     } # policy filter_username = notfound
(4)     [preprocess] = ok
(4)     [chap] = noop
(4)     [mschap] = noop
(4)     [digest] = noop
(4) suffix: Checking for suffix after "@"
(4) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(4) suffix: No such realm "NULL"
(4)     [suffix] = noop
(4) eap: Peer sent EAP Response (code 2) ID 5 length 6
(4) eap: Continuing tunnel setup
(4)     [eap] = ok
(4)   } # authorize = ok
(4) Found Auth-Type = eap
(4) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(4)   authenticate {
(4) eap: Expiring EAP session with state 0x2f19408c2c1c59c6
(4) eap: Finished EAP session with state 0x2f19408c2c1c59c6
(4) eap: Previous EAP request found for state 0x2f19408c2c1c59c6,
released from the list
(4) eap: Peer sent packet with method EAP PEAP (25)
(4) eap: Calling submodule eap_peap to process data
(4) eap_peap: Continuing EAP-TLS
(4) eap_peap: Peer ACKed our handshake fragment
(4) eap_peap: [eaptls verify] = request
(4) eap_peap: [eaptls process] = handled
(4) eap: Sending EAP Request (code 1) ID 6 length 675
(4) eap: EAP session adding &reply:State = 0x2f19408c2b1f59c6
(4)     [eap] = handled
(4)   } # authenticate = handled
(4) Using Post-Auth-Type Challenge
(4) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(4)   Challenge { ... } # empty sub-section is ignored
(4) Sent Access-Challenge Id 191 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(4)   EAP-Message =
0x010602a319002d302ba029a0278625687474703a2f2f7777772e6578616d706c652e6
f72672f6578616d706c655f63612e63726c300d06092a864886f70d01010b0500038201
0100962a6f743a739b9e506cbd7ee0a26dc02273355768707b9c29ab09b8c0fbf0dd6ae
51c67fec12412bd2e112f2e871a
(4)   Message-Authenticator = 0x00000000000000000000000000000000
(4)   State = 0x2f19408c2b1f59c676c2fe7afaf965a8
(4) Finished request
Waking up in 4.9 seconds.
(5) Received Access-Request Id 192 from 10.0.1.241:32768 to
192.168.1.241:1812 length 274
(5)   User-Name = "client-test-user"
(5)   NAS-IP-Address = 10.0.1.241
(5)   NAS-Port = 0
(5)   Called-Station-Id = "60-03-47-12-C5-7F"
(5)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(5)   Framed-MTU = 1400
(5)   NAS-Port-Type = Wireless-802.11
(5)   EAP-Message =
0x0206008819800000007e1603030046100000424104135245371b17ce114babd8b9774
038119708b7a7928504e378f8342d161c72d1ae144f247a9ddfdfc5abbff2b3835c233b
1ed3f86c967c3878882ff5564debe714030300010116030300280000000000000000202
2f582ac6ba225f8ba6254b8b501
(5)   State = 0x2f19408c2b1f59c676c2fe7afaf965a8
(5)   Message-Authenticator = 0xee8c616e6b613bc9272d1ead183d260e
(5) session-state: No cached attributes
(5) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(5)   authorize {
(5)     policy filter_username {
(5)       if (&User-Name) {
(5)       if (&User-Name)  -> TRUE
(5)       if (&User-Name)  {
(5)         if (&User-Name =~ / /) {
(5)         if (&User-Name =~ / /)  -> FALSE
(5)         if (&User-Name =~ /@[^@]*@/ ) {
(5)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(5)         if (&User-Name =~ /\.\./ ) {
(5)         if (&User-Name =~ /\.\./ )  -> FALSE
(5)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(5)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(5)         if (&User-Name =~ /\.$/)  {
(5)         if (&User-Name =~ /\.$/)   -> FALSE
(5)         if (&User-Name =~ /@\./)  {
(5)         if (&User-Name =~ /@\./)   -> FALSE
(5)       } # if (&User-Name)  = notfound
(5)     } # policy filter_username = notfound
(5)     [preprocess] = ok
(5)     [chap] = noop
(5)     [mschap] = noop
(5)     [digest] = noop
(5) suffix: Checking for suffix after "@"
(5) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(5) suffix: No such realm "NULL"
(5)     [suffix] = noop
(5) eap: Peer sent EAP Response (code 2) ID 6 length 136
(5) eap: Continuing tunnel setup
(5)     [eap] = ok
(5)   } # authorize = ok
(5) Found Auth-Type = eap
(5) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(5)   authenticate {
(5) eap: Expiring EAP session with state 0x2f19408c2b1f59c6
(5) eap: Finished EAP session with state 0x2f19408c2b1f59c6
(5) eap: Previous EAP request found for state 0x2f19408c2b1f59c6,
released from the list
(5) eap: Peer sent packet with method EAP PEAP (25)
(5) eap: Calling submodule eap_peap to process data
(5) eap_peap: Continuing EAP-TLS
(5) eap_peap: Peer indicated complete TLS record size will be 126 bytes
(5) eap_peap: Got complete TLS record (126 bytes)
(5) eap_peap: [eaptls verify] = length included
(5) eap_peap: TLS_accept: SSLv3/TLS write server done
(5) eap_peap: <<< recv TLS 1.2  [length 0046]
(5) eap_peap: TLS_accept: SSLv3/TLS read client key exchange
(5) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec
(5) eap_peap: <<< recv TLS 1.2  [length 0010]
(5) eap_peap: TLS_accept: SSLv3/TLS read finished
(5) eap_peap: >>> send TLS 1.2  [length 0001]
(5) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec
(5) eap_peap: >>> send TLS 1.2  [length 0010]
(5) eap_peap: TLS_accept: SSLv3/TLS write finished
(5) eap_peap: (other): SSL negotiation finished successfully
(5) eap_peap: SSL Connection Established
(5) eap_peap: [eaptls process] = handled
(5) eap: Sending EAP Request (code 1) ID 7 length 57
(5) eap: EAP session adding &reply:State = 0x2f19408c2a1e59c6
(5)     [eap] = handled
(5)   } # authenticate = handled
(5) Using Post-Auth-Type Challenge
(5) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(5)   Challenge { ... } # empty sub-section is ignored
(5) Sent Access-Challenge Id 192 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(5)   EAP-Message =
0x01070039190014030300010116030300283fd988a4113089de2cec17df7414e410c83
6b9e79ef84b283501b866a43776cf8decfc8808756ee5
(5)   Message-Authenticator = 0x00000000000000000000000000000000
(5)   State = 0x2f19408c2a1e59c676c2fe7afaf965a8
(5) Finished request
Waking up in 4.9 seconds.
(6) Received Access-Request Id 193 from 10.0.1.241:32768 to
192.168.1.241:1812 length 144
(6)   User-Name = "client-test-user"
(6)   NAS-IP-Address = 10.0.1.241
(6)   NAS-Port = 0
(6)   Called-Station-Id = "60-03-47-12-C5-7F"
(6)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(6)   Framed-MTU = 1400
(6)   NAS-Port-Type = Wireless-802.11
(6)   EAP-Message = 0x020700061900
(6)   State = 0x2f19408c2a1e59c676c2fe7afaf965a8
(6)   Message-Authenticator = 0xe929038cf8c386739506b03a026f42da
(6) session-state: No cached attributes
(6) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(6)   authorize {
(6)     policy filter_username {
(6)       if (&User-Name) {
(6)       if (&User-Name)  -> TRUE
(6)       if (&User-Name)  {
(6)         if (&User-Name =~ / /) {
(6)         if (&User-Name =~ / /)  -> FALSE
(6)         if (&User-Name =~ /@[^@]*@/ ) {
(6)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(6)         if (&User-Name =~ /\.\./ ) {
(6)         if (&User-Name =~ /\.\./ )  -> FALSE
(6)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(6)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(6)         if (&User-Name =~ /\.$/)  {
(6)         if (&User-Name =~ /\.$/)   -> FALSE
(6)         if (&User-Name =~ /@\./)  {
(6)         if (&User-Name =~ /@\./)   -> FALSE
(6)       } # if (&User-Name)  = notfound
(6)     } # policy filter_username = notfound
(6)     [preprocess] = ok
(6)     [chap] = noop
(6)     [mschap] = noop
(6)     [digest] = noop
(6) suffix: Checking for suffix after "@"
(6) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(6) suffix: No such realm "NULL"
(6)     [suffix] = noop
(6) eap: Peer sent EAP Response (code 2) ID 7 length 6
(6) eap: Continuing tunnel setup
(6)     [eap] = ok
(6)   } # authorize = ok
(6) Found Auth-Type = eap
(6) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(6)   authenticate {
(6) eap: Expiring EAP session with state 0x2f19408c2a1e59c6
(6) eap: Finished EAP session with state 0x2f19408c2a1e59c6
(6) eap: Previous EAP request found for state 0x2f19408c2a1e59c6,
released from the list
(6) eap: Peer sent packet with method EAP PEAP (25)
(6) eap: Calling submodule eap_peap to process data
(6) eap_peap: Continuing EAP-TLS
(6) eap_peap: Peer ACKed our handshake fragment.  handshake is finished
(6) eap_peap: [eaptls verify] = success
(6) eap_peap: [eaptls process] = success
(6) eap_peap: Session established.  Decoding tunneled attributes
(6) eap_peap: PEAP state TUNNEL ESTABLISHED
(6) eap: Sending EAP Request (code 1) ID 8 length 40
(6) eap: EAP session adding &reply:State = 0x2f19408c291159c6
(6)     [eap] = handled
(6)   } # authenticate = handled
(6) Using Post-Auth-Type Challenge
(6) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(6)   Challenge { ... } # empty sub-section is ignored
(6) Sent Access-Challenge Id 193 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(6)   EAP-Message =
0x010800281900170303001d3fd988a4113089dfa6325137ec2500f4aa1129e7598d55a
6872c83f508
(6)   Message-Authenticator = 0x00000000000000000000000000000000
(6)   State = 0x2f19408c291159c676c2fe7afaf965a8
(6) Finished request
Waking up in 4.9 seconds.
(7) Received Access-Request Id 194 from 10.0.1.241:32768 to
192.168.1.241:1812 length 190
(7)   User-Name = "client-test-user"
(7)   NAS-IP-Address = 10.0.1.241
(7)   NAS-Port = 0
(7)   Called-Station-Id = "60-03-47-12-C5-7F"
(7)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(7)   Framed-MTU = 1400
(7)   NAS-Port-Type = Wireless-802.11
(7)   EAP-Message =
0x0208003419001703030029000000000000000164b3595702a133e733bd03f116fd7c4
b66ad6d5e85b46ef6ca2dfa7873fc871367
(7)   State = 0x2f19408c291159c676c2fe7afaf965a8
(7)   Message-Authenticator = 0xdae6f74c322757ac59e32daab3d39765
(7) session-state: No cached attributes
(7) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(7)   authorize {
(7)     policy filter_username {
(7)       if (&User-Name) {
(7)       if (&User-Name)  -> TRUE
(7)       if (&User-Name)  {
(7)         if (&User-Name =~ / /) {
(7)         if (&User-Name =~ / /)  -> FALSE
(7)         if (&User-Name =~ /@[^@]*@/ ) {
(7)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(7)         if (&User-Name =~ /\.\./ ) {
(7)         if (&User-Name =~ /\.\./ )  -> FALSE
(7)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(7)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(7)         if (&User-Name =~ /\.$/)  {
(7)         if (&User-Name =~ /\.$/)   -> FALSE
(7)         if (&User-Name =~ /@\./)  {
(7)         if (&User-Name =~ /@\./)   -> FALSE
(7)       } # if (&User-Name)  = notfound
(7)     } # policy filter_username = notfound
(7)     [preprocess] = ok
(7)     [chap] = noop
(7)     [mschap] = noop
(7)     [digest] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(7) suffix: No such realm "NULL"
(7)     [suffix] = noop
(7) eap: Peer sent EAP Response (code 2) ID 8 length 52
(7) eap: Continuing tunnel setup
(7)     [eap] = ok
(7)   } # authorize = ok
(7) Found Auth-Type = eap
(7) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(7)   authenticate {
(7) eap: Expiring EAP session with state 0x2f19408c291159c6
(7) eap: Finished EAP session with state 0x2f19408c291159c6
(7) eap: Previous EAP request found for state 0x2f19408c291159c6,
released from the list
(7) eap: Peer sent packet with method EAP PEAP (25)
(7) eap: Calling submodule eap_peap to process data
(7) eap_peap: Continuing EAP-TLS
(7) eap_peap: [eaptls verify] = ok
(7) eap_peap: Done initial handshake
(7) eap_peap: [eaptls process] = ok
(7) eap_peap: Session established.  Decoding tunneled attributes
(7) eap_peap: PEAP state WAITING FOR INNER IDENTITY
(7) eap_peap: Identity - client-test-user
(7) eap_peap: Got inner identity 'client-test-user'
(7) eap_peap: Setting default EAP type for tunneled EAP session
(7) eap_peap: Got tunneled request
(7) eap_peap:   EAP-Message =
0x02080015016173747574652d746573742d75736572
(7) eap_peap: Setting User-Name to client-test-user
(7) eap_peap: Sending tunneled request to inner-tunnel
(7) eap_peap:   EAP-Message =
0x02080015016173747574652d746573742d75736572
(7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(7) eap_peap:   User-Name = "client-test-user"
(7) Virtual server inner-tunnel received request
(7)   EAP-Message = 0x02080015016173747574652d746573742d75736572
(7)   FreeRADIUS-Proxied-To = 127.0.0.1
(7)   User-Name = "client-test-user"
(7) WARNING: Outer and inner identities are the same.  User privacy is
compromised.
(7) server inner-tunnel {
(7)   # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(7)     authorize {
(7)       policy filter_username {
(7)         if (&User-Name) {
(7)         if (&User-Name)  -> TRUE
(7)         if (&User-Name)  {
(7)           if (&User-Name =~ / /) {
(7)           if (&User-Name =~ / /)  -> FALSE
(7)           if (&User-Name =~ /@[^@]*@/ ) {
(7)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(7)           if (&User-Name =~ /\.\./ ) {
(7)           if (&User-Name =~ /\.\./ )  -> FALSE
(7)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(7)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(7)           if (&User-Name =~ /\.$/)  {
(7)           if (&User-Name =~ /\.$/)   -> FALSE
(7)           if (&User-Name =~ /@\./)  {
(7)           if (&User-Name =~ /@\./)   -> FALSE
(7)         } # if (&User-Name)  = notfound
(7)       } # policy filter_username = notfound
(7)       [chap] = noop
(7)       [mschap] = noop
(7) suffix: Checking for suffix after "@"
(7) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(7) suffix: No such realm "NULL"
(7)       [suffix] = noop
(7)       update control {
(7)         &Proxy-To-Realm := LOCAL
(7)       } # update control = noop
(7) eap: Peer sent EAP Response (code 2) ID 8 length 21
(7) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the
rest of authorize
(7)       [eap] = ok
(7)     } # authorize = ok
(7)   Found Auth-Type = eap
(7)   # Executing group from file /etc/freeradius/3.0/sites-
enabled/inner-tunnel
(7)     authenticate {
(7) eap: Peer sent packet with method EAP Identity (1)
(7) eap: Calling submodule eap_mschapv2 to process data
(7) eap_mschapv2: Issuing Challenge
(7) eap: Sending EAP Request (code 1) ID 9 length 43
(7) eap: EAP session adding &reply:State = 0x32d4275432dd3d85
(7)       [eap] = handled
(7)     } # authenticate = handled
(7) } # server inner-tunnel
(7) Virtual server sending reply
(7)   EAP-Message =
0x0109002b1a01090026106146255b0872fefcd7f91c2e18b2f7b766726565726164697
5732d332e302e3137
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x32d4275432dd3d857188142e16d38f62
(7) eap_peap: Got tunneled reply code 11
(7) eap_peap:   EAP-Message =
0x0109002b1a01090026106146255b0872fefcd7f91c2e18b2f7b766726565726164697
5732d332e302e3137
(7) eap_peap:   Message-Authenticator =
0x00000000000000000000000000000000
(7) eap_peap:   State = 0x32d4275432dd3d857188142e16d38f62
(7) eap_peap: Got tunneled reply RADIUS code 11
(7) eap_peap:   EAP-Message =
0x0109002b1a01090026106146255b0872fefcd7f91c2e18b2f7b766726565726164697
5732d332e302e3137
(7) eap_peap:   Message-Authenticator =
0x00000000000000000000000000000000
(7) eap_peap:   State = 0x32d4275432dd3d857188142e16d38f62
(7) eap_peap: Got tunneled Access-Challenge
(7) eap: Sending EAP Request (code 1) ID 9 length 74
(7) eap: EAP session adding &reply:State = 0x2f19408c281059c6
(7)     [eap] = handled
(7)   } # authenticate = handled
(7) Using Post-Auth-Type Challenge
(7) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(7)   Challenge { ... } # empty sub-section is ignored
(7) Sent Access-Challenge Id 194 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(7)   EAP-Message =
0x0109004a1900170303003f3fd988a4113089e02588a8d5573530c9c35719adfde63de
b907a2e0d9595c68a4082aca2a31fcb76db7c1412622ada742a8df6ee5d2529b8cfe413
2302dbd8
(7)   Message-Authenticator = 0x00000000000000000000000000000000
(7)   State = 0x2f19408c281059c676c2fe7afaf965a8
(7) Finished request
Waking up in 4.9 seconds.
(8) Received Access-Request Id 195 from 10.0.1.241:32768 to
192.168.1.241:1812 length 244
(8)   User-Name = "client-test-user"
(8)   NAS-IP-Address = 10.0.1.241
(8)   NAS-Port = 0
(8)   Called-Station-Id = "60-03-47-12-C5-7F"
(8)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(8)   Framed-MTU = 1400
(8)   NAS-Port-Type = Wireless-802.11
(8)   EAP-Message =
0x0209006a1900170303005f0000000000000002be7dd694ab3a148dab1312f38720aef
bbb3ee5b900cecd1e6ef5b716e62883917393690bd60fdb17789b88cdf191305aabacd4
86003431a162582efcf8b8592d46d4774f23745a0b20ae3c714705617d5a1874c7a322a
9
(8)   State = 0x2f19408c281059c676c2fe7afaf965a8
(8)   Message-Authenticator = 0xd4e295b7b6c6c3efabc7863953a96e4d
(8) session-state: No cached attributes
(8) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(8)   authorize {
(8)     policy filter_username {
(8)       if (&User-Name) {
(8)       if (&User-Name)  -> TRUE
(8)       if (&User-Name)  {
(8)         if (&User-Name =~ / /) {
(8)         if (&User-Name =~ / /)  -> FALSE
(8)         if (&User-Name =~ /@[^@]*@/ ) {
(8)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(8)         if (&User-Name =~ /\.\./ ) {
(8)         if (&User-Name =~ /\.\./ )  -> FALSE
(8)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(8)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(8)         if (&User-Name =~ /\.$/)  {
(8)         if (&User-Name =~ /\.$/)   -> FALSE
(8)         if (&User-Name =~ /@\./)  {
(8)         if (&User-Name =~ /@\./)   -> FALSE
(8)       } # if (&User-Name)  = notfound
(8)     } # policy filter_username = notfound
(8)     [preprocess] = ok
(8)     [chap] = noop
(8)     [mschap] = noop
(8)     [digest] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(8) suffix: No such realm "NULL"
(8)     [suffix] = noop
(8) eap: Peer sent EAP Response (code 2) ID 9 length 106
(8) eap: Continuing tunnel setup
(8)     [eap] = ok
(8)   } # authorize = ok
(8) Found Auth-Type = eap
(8) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(8)   authenticate {
(8) eap: Expiring EAP session with state 0x32d4275432dd3d85
(8) eap: Finished EAP session with state 0x2f19408c281059c6
(8) eap: Previous EAP request found for state 0x2f19408c281059c6,
released from the list
(8) eap: Peer sent packet with method EAP PEAP (25)
(8) eap: Calling submodule eap_peap to process data
(8) eap_peap: Continuing EAP-TLS
(8) eap_peap: [eaptls verify] = ok
(8) eap_peap: Done initial handshake
(8) eap_peap: [eaptls process] = ok
(8) eap_peap: Session established.  Decoding tunneled attributes
(8) eap_peap: PEAP state phase2
(8) eap_peap: EAP method MSCHAPv2 (26)
(8) eap_peap: Got tunneled request
(8) eap_peap:   EAP-Message =
0x0209004b1a02090046316624fdb82698d5a9836d5483f2fef2a00000000000000000a
20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6006173747574652d74657374
2d75736572
(8) eap_peap: Setting User-Name to client-test-user
(8) eap_peap: Sending tunneled request to inner-tunnel
(8) eap_peap:   EAP-Message =
0x0209004b1a02090046316624fdb82698d5a9836d5483f2fef2a00000000000000000a
20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6006173747574652d74657374
2d75736572
(8) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(8) eap_peap:   User-Name = "client-test-user"
(8) eap_peap:   State = 0x32d4275432dd3d857188142e16d38f62
(8) Virtual server inner-tunnel received request
(8)   EAP-Message =
0x0209004b1a02090046316624fdb82698d5a9836d5483f2fef2a00000000000000000a
20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6006173747574652d74657374
2d75736572
(8)   FreeRADIUS-Proxied-To = 127.0.0.1
(8)   User-Name = "client-test-user"
(8)   State = 0x32d4275432dd3d857188142e16d38f62
(8) WARNING: Outer and inner identities are the same.  User privacy is
compromised.
(8) server inner-tunnel {
(8)   session-state: No cached attributes
(8)   # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8)     authorize {
(8)       policy filter_username {
(8)         if (&User-Name) {
(8)         if (&User-Name)  -> TRUE
(8)         if (&User-Name)  {
(8)           if (&User-Name =~ / /) {
(8)           if (&User-Name =~ / /)  -> FALSE
(8)           if (&User-Name =~ /@[^@]*@/ ) {
(8)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(8)           if (&User-Name =~ /\.\./ ) {
(8)           if (&User-Name =~ /\.\./ )  -> FALSE
(8)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(8)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(8)           if (&User-Name =~ /\.$/)  {
(8)           if (&User-Name =~ /\.$/)   -> FALSE
(8)           if (&User-Name =~ /@\./)  {
(8)           if (&User-Name =~ /@\./)   -> FALSE
(8)         } # if (&User-Name)  = notfound
(8)       } # policy filter_username = notfound
(8)       [chap] = noop
(8)       [mschap] = noop
(8) suffix: Checking for suffix after "@"
(8) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(8) suffix: No such realm "NULL"
(8)       [suffix] = noop
(8)       update control {
(8)         &Proxy-To-Realm := LOCAL
(8)       } # update control = noop
(8) eap: Peer sent EAP Response (code 2) ID 9 length 75
(8) eap: No EAP Start, assuming it's an on-going EAP conversation
(8)       [eap] = updated
(8)       [files] = noop
(8)       [expiration] = noop
(8)       [logintime] = noop
(8)       [pap] = noop
(8)     } # authorize = updated
(8)   Found Auth-Type = eap
(8)   # Executing group from file /etc/freeradius/3.0/sites-
enabled/inner-tunnel
(8)     authenticate {
(8) eap: Expiring EAP session with state 0x32d4275432dd3d85
(8) eap: Finished EAP session with state 0x32d4275432dd3d85
(8) eap: Previous EAP request found for state 0x32d4275432dd3d85,
released from the list
(8) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(8) eap: Calling submodule eap_mschapv2 to process data
(8) eap_mschapv2: # Executing group from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(8) eap_mschapv2:   authenticate {
(8) mschap: Creating challenge hash with username: client-test-user
(8) mschap: Client is using MS-CHAPv2
(8) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --
username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-
client-nt-domain} --challenge=%{mschap:Challenge:-00} --nt-
response=%{mschap:NT-Response:-00}:
(8) mschap: EXPAND --username=%{mschap:User-Name:-None}
(8) mschap:    --> --username=client-test-user
(8) mschap: ERROR: No NT-Domain was found in the User-Name
(8) mschap: EXPAND --domain=%{%{mschap:NT-Domain}:-client-nt-domain}
(8) mschap:    --> --domain=client-nt-domain
(8) mschap: Creating challenge hash with username: client-test-user
(8) mschap: EXPAND --challenge=%{mschap:Challenge:-00}
(8) mschap:    --> --challenge=cea5e5da3645ab46
(8) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
(8) mschap:    --> --nt-
response=a20199d770bfa5ae6ce9dc15d8b110f21b9029130ca84bc6
(8) mschap: Program returned code (0) and output 'NT_KEY:
0DF2778ED7F65BC492752683ED79B290'
(8) mschap: Adding MS-CHAPv2 MPPE keys
(8)     [mschap] = ok
(8)   } # authenticate = ok
(8) MSCHAP Success
(8) eap: Sending EAP Request (code 1) ID 10 length 51
(8) eap: EAP session adding &reply:State = 0x32d4275433de3d85
(8)       [eap] = handled
(8)     } # authenticate = handled
(8) } # server inner-tunnel
(8) Virtual server sending reply
(8)   EAP-Message =
0x010a00331a0309002e533d42434239374144444530463536344642463337434238303
342353846424535363643424246413744
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x32d4275433de3d857188142e16d38f62
(8) eap_peap: Got tunneled reply code 11
(8) eap_peap:   EAP-Message =
0x010a00331a0309002e533d42434239374144444530463536344642463337434238303
342353846424535363643424246413744
(8) eap_peap:   Message-Authenticator =
0x00000000000000000000000000000000
(8) eap_peap:   State = 0x32d4275433de3d857188142e16d38f62
(8) eap_peap: Got tunneled reply RADIUS code 11
(8) eap_peap:   EAP-Message =
0x010a00331a0309002e533d42434239374144444530463536344642463337434238303
342353846424535363643424246413744
(8) eap_peap:   Message-Authenticator =
0x00000000000000000000000000000000
(8) eap_peap:   State = 0x32d4275433de3d857188142e16d38f62
(8) eap_peap: Got tunneled Access-Challenge
(8) eap: Sending EAP Request (code 1) ID 10 length 82
(8) eap: EAP session adding &reply:State = 0x2f19408c271359c6
(8)     [eap] = handled
(8)   } # authenticate = handled
(8) Using Post-Auth-Type Challenge
(8) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(8)   Challenge { ... } # empty sub-section is ignored
(8) Sent Access-Challenge Id 195 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(8)   EAP-Message =
0x010a0052190017030300473fd988a4113089e1f9f6e801a5317a6a411a60513de98ee
1b93c8b86213418c35b5d92e7d7dca3fe7924a4cec84e2b87b64713da08236896f7bfc0
c582f082500a6baaf1128a76
(8)   Message-Authenticator = 0x00000000000000000000000000000000
(8)   State = 0x2f19408c271359c676c2fe7afaf965a8
(8) Finished request
Waking up in 4.8 seconds.
(9) Received Access-Request Id 196 from 10.0.1.241:32768 to
192.168.1.241:1812 length 175
(9)   User-Name = "client-test-user"
(9)   NAS-IP-Address = 10.0.1.241
(9)   NAS-Port = 0
(9)   Called-Station-Id = "60-03-47-12-C5-7F"
(9)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(9)   Framed-MTU = 1400
(9)   NAS-Port-Type = Wireless-802.11
(9)   EAP-Message =
0x020a00251900170303001a00000000000000030c34ff09938824e8775cca0ecc692a9
cad18
(9)   State = 0x2f19408c271359c676c2fe7afaf965a8
(9)   Message-Authenticator = 0xcdb8b982178bc3a0765a18b33f4f06d4
(9) session-state: No cached attributes
(9) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(9)   authorize {
(9)     policy filter_username {
(9)       if (&User-Name) {
(9)       if (&User-Name)  -> TRUE
(9)       if (&User-Name)  {
(9)         if (&User-Name =~ / /) {
(9)         if (&User-Name =~ / /)  -> FALSE
(9)         if (&User-Name =~ /@[^@]*@/ ) {
(9)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(9)         if (&User-Name =~ /\.\./ ) {
(9)         if (&User-Name =~ /\.\./ )  -> FALSE
(9)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(9)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(9)         if (&User-Name =~ /\.$/)  {
(9)         if (&User-Name =~ /\.$/)   -> FALSE
(9)         if (&User-Name =~ /@\./)  {
(9)         if (&User-Name =~ /@\./)   -> FALSE
(9)       } # if (&User-Name)  = notfound
(9)     } # policy filter_username = notfound
(9)     [preprocess] = ok
(9)     [chap] = noop
(9)     [mschap] = noop
(9)     [digest] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(9) suffix: No such realm "NULL"
(9)     [suffix] = noop
(9) eap: Peer sent EAP Response (code 2) ID 10 length 37
(9) eap: Continuing tunnel setup
(9)     [eap] = ok
(9)   } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(9)   authenticate {
(9) eap: Expiring EAP session with state 0x32d4275433de3d85
(9) eap: Finished EAP session with state 0x2f19408c271359c6
(9) eap: Previous EAP request found for state 0x2f19408c271359c6,
released from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: Continuing EAP-TLS
(9) eap_peap: [eaptls verify] = ok
(9) eap_peap: Done initial handshake
(9) eap_peap: [eaptls process] = ok
(9) eap_peap: Session established.  Decoding tunneled attributes
(9) eap_peap: PEAP state phase2
(9) eap_peap: EAP method MSCHAPv2 (26)
(9) eap_peap: Got tunneled request
(9) eap_peap:   EAP-Message = 0x020a00061a03
(9) eap_peap: Setting User-Name to client-test-user
(9) eap_peap: Sending tunneled request to inner-tunnel
(9) eap_peap:   EAP-Message = 0x020a00061a03
(9) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
(9) eap_peap:   User-Name = "client-test-user"
(9) eap_peap:   State = 0x32d4275433de3d857188142e16d38f62
(9) Virtual server inner-tunnel received request
(9)   EAP-Message = 0x020a00061a03
(9)   FreeRADIUS-Proxied-To = 127.0.0.1
(9)   User-Name = "client-test-user"
(9)   State = 0x32d4275433de3d857188142e16d38f62
(9) WARNING: Outer and inner identities are the same.  User privacy is
compromised.
(9) server inner-tunnel {
(9)   session-state: No cached attributes
(9)   # Executing section authorize from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9)     authorize {
(9)       policy filter_username {
(9)         if (&User-Name) {
(9)         if (&User-Name)  -> TRUE
(9)         if (&User-Name)  {
(9)           if (&User-Name =~ / /) {
(9)           if (&User-Name =~ / /)  -> FALSE
(9)           if (&User-Name =~ /@[^@]*@/ ) {
(9)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(9)           if (&User-Name =~ /\.\./ ) {
(9)           if (&User-Name =~ /\.\./ )  -> FALSE
(9)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(9)           if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(9)           if (&User-Name =~ /\.$/)  {
(9)           if (&User-Name =~ /\.$/)   -> FALSE
(9)           if (&User-Name =~ /@\./)  {
(9)           if (&User-Name =~ /@\./)   -> FALSE
(9)         } # if (&User-Name)  = notfound
(9)       } # policy filter_username = notfound
(9)       [chap] = noop
(9)       [mschap] = noop
(9) suffix: Checking for suffix after "@"
(9) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(9) suffix: No such realm "NULL"
(9)       [suffix] = noop
(9)       update control {
(9)         &Proxy-To-Realm := LOCAL
(9)       } # update control = noop
(9) eap: Peer sent EAP Response (code 2) ID 10 length 6
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9)       [eap] = updated
(9)       [files] = noop
(9)       [expiration] = noop
(9)       [logintime] = noop
(9)       [pap] = noop
(9)     } # authorize = updated
(9)   Found Auth-Type = eap
(9)   # Executing group from file /etc/freeradius/3.0/sites-
enabled/inner-tunnel
(9)     authenticate {
(9) eap: Expiring EAP session with state 0x32d4275433de3d85
(9) eap: Finished EAP session with state 0x32d4275433de3d85
(9) eap: Previous EAP request found for state 0x32d4275433de3d85,
released from the list
(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(9) eap: Calling submodule eap_mschapv2 to process data
(9) eap: Sending EAP Success (code 3) ID 10 length 4
(9) eap: Freeing handler
(9)       [eap] = ok
(9)     } # authenticate = ok
(9)   # Executing section post-auth from file
/etc/freeradius/3.0/sites-enabled/inner-tunnel
(9)     post-auth {
(9)       if (0) {
(9)       if (0)  -> FALSE
(9)     } # post-auth = noop
(9)   Login OK: [client-test-user] (from client CLIENT-TEST-AP port 0
via TLS tunnel)
(9) } # server inner-tunnel
(9) Virtual server sending reply
(9)   MS-MPPE-Encryption-Policy = Encryption-Allowed
(9)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(9)   MS-MPPE-Send-Key = 0x95b3db36f265faf31f1a15ceb9266c6a
(9)   MS-MPPE-Recv-Key = 0x5a9b1ffb2b556bf199d63eecd358eb1b
(9)   EAP-Message = 0x030a0004
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9)   User-Name = "client-test-user"
(9) eap_peap: Got tunneled reply code 2
(9) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed
(9) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(9) eap_peap:   MS-MPPE-Send-Key = 0x95b3db36f265faf31f1a15ceb9266c6a
(9) eap_peap:   MS-MPPE-Recv-Key = 0x5a9b1ffb2b556bf199d63eecd358eb1b
(9) eap_peap:   EAP-Message = 0x030a0004
(9) eap_peap:   Message-Authenticator =
0x00000000000000000000000000000000
(9) eap_peap:   User-Name = "client-test-user"
(9) eap_peap: Got tunneled reply RADIUS code 2
(9) eap_peap:   MS-MPPE-Encryption-Policy = Encryption-Allowed
(9) eap_peap:   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(9) eap_peap:   MS-MPPE-Send-Key = 0x95b3db36f265faf31f1a15ceb9266c6a
(9) eap_peap:   MS-MPPE-Recv-Key = 0x5a9b1ffb2b556bf199d63eecd358eb1b
(9) eap_peap:   EAP-Message = 0x030a0004
(9) eap_peap:   Message-Authenticator =
0x00000000000000000000000000000000
(9) eap_peap:   User-Name = "client-test-user"
(9) eap_peap: Tunneled authentication was successful
(9) eap_peap: SUCCESS
(9) eap: Sending EAP Request (code 1) ID 11 length 46
(9) eap: EAP session adding &reply:State = 0x2f19408c261259c6
(9)     [eap] = handled
(9)   } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(9)   Challenge { ... } # empty sub-section is ignored
(9) Sent Access-Challenge Id 196 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(9)   EAP-Message =
0x010b002e190017030300233fd988a4113089e23fc83669abbf4ced24ed9102ba49fe8
9f70703aeccddc63de43194
(9)   Message-Authenticator = 0x00000000000000000000000000000000
(9)   State = 0x2f19408c261259c676c2fe7afaf965a8
(9) Finished request
Waking up in 4.8 seconds.
(10) Received Access-Request Id 197 from 10.0.1.241:32768 to
192.168.1.241:1812 length 184
(10)   User-Name = "client-test-user"
(10)   NAS-IP-Address = 10.0.1.241
(10)   NAS-Port = 0
(10)   Called-Station-Id = "60-03-47-12-C5-7F"
(10)   Calling-Station-Id = "F4-8C-50-2A-EA-DB"
(10)   Framed-MTU = 1400
(10)   NAS-Port-Type = Wireless-802.11
(10)   EAP-Message =
0x020b002e190017030300230000000000000004a870e166c3f508bcb23cc22d4a75ac9
91a5936d243248199c7f548
(10)   State = 0x2f19408c261259c676c2fe7afaf965a8
(10)   Message-Authenticator = 0xcef94b00ae921e41ff8c71ef42622808
(10) session-state: No cached attributes
(10) # Executing section authorize from file /etc/freeradius/3.0/sites-
enabled/default
(10)   authorize {
(10)     policy filter_username {
(10)       if (&User-Name) {
(10)       if (&User-Name)  -> TRUE
(10)       if (&User-Name)  {
(10)         if (&User-Name =~ / /) {
(10)         if (&User-Name =~ / /)  -> FALSE
(10)         if (&User-Name =~ /@[^@]*@/ ) {
(10)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(10)         if (&User-Name =~ /\.\./ ) {
(10)         if (&User-Name =~ /\.\./ )  -> FALSE
(10)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))  {
(10)         if ((&User-Name =~ /@/) && (&User-Name !~
/@(.+)\.(.+)$/))   -> FALSE
(10)         if (&User-Name =~ /\.$/)  {
(10)         if (&User-Name =~ /\.$/)   -> FALSE
(10)         if (&User-Name =~ /@\./)  {
(10)         if (&User-Name =~ /@\./)   -> FALSE
(10)       } # if (&User-Name)  = notfound
(10)     } # policy filter_username = notfound
(10)     [preprocess] = ok
(10)     [chap] = noop
(10)     [mschap] = noop
(10)     [digest] = noop
(10) suffix: Checking for suffix after "@"
(10) suffix: No '@' in User-Name = "client-test-user", looking up realm
NULL
(10) suffix: No such realm "NULL"
(10)     [suffix] = noop
(10) eap: Peer sent EAP Response (code 2) ID 11 length 46
(10) eap: Continuing tunnel setup
(10)     [eap] = ok
(10)   } # authorize = ok
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/freeradius/3.0/sites-
enabled/default
(10)   authenticate {
(10) eap: Expiring EAP session with state 0x2f19408c261259c6
(10) eap: Finished EAP session with state 0x2f19408c261259c6
(10) eap: Previous EAP request found for state 0x2f19408c261259c6,
released from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: Continuing EAP-TLS
(10) eap_peap: [eaptls verify] = ok
(10) eap_peap: Done initial handshake
(10) eap_peap: [eaptls process] = ok
(10) eap_peap: Session established.  Decoding tunneled attributes
(10) eap_peap: PEAP state send tlv success
(10) eap_peap: Received EAP-TLV response
(10) eap_peap: Success
(10) eap: Sending EAP Success (code 3) ID 11 length 4
(10) eap: Freeing handler
(10)     [eap] = ok
(10)   } # authenticate = ok
(10) # Executing section post-auth from file /etc/freeradius/3.0/sites-
enabled/default
(10)   post-auth {
(10)     if (session-state:User-Name && reply:User-Name &&
request:User-Name && (reply:User-Name == request:User-Name)) {
(10)     if (session-state:User-Name && reply:User-Name &&
request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(10)     update {
(10)       No attributes updated
(10)     } # update = noop
(10)     [exec] = noop
(10)     policy remove_reply_message_if_eap {
(10)       if (&reply:EAP-Message && &reply:Reply-Message) {
(10)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(10)       else {
(10)         [noop] = noop
(10)       } # else = noop
(10)     } # policy remove_reply_message_if_eap = noop
(10)   } # post-auth = noop
(10) Login OK: [client-test-user] (from client CLIENT-TEST-AP port 0
cli F4-8C-50-2A-EA-DB)
(10) Sent Access-Accept Id 197 from 192.168.1.241:1812 to
10.0.1.241:32768 length 0
(10)   MS-MPPE-Recv-Key =
0xe717c46c5b3cf37ed3b79c977f825f317523daeda6f5c3934c4abcf0658b9ff5
(10)   MS-MPPE-Send-Key =
0x5207a25678621578604f44a475370863d742cb445cb6a9e93b5f9eb5aa484c37
(10)   EAP-Message = 0x030b0004
(10)   Message-Authenticator = 0x00000000000000000000000000000000
(10)   User-Name = "client-test-user"
(10) Finished request
Waking up in 4.8 seconds.
(0) Cleaning up request packet ID 187 with timestamp +7
(1) Cleaning up request packet ID 188 with timestamp +7
(2) Cleaning up request packet ID 189 with timestamp +7
(3) Cleaning up request packet ID 190 with timestamp +7
(4) Cleaning up request packet ID 191 with timestamp +7
(5) Cleaning up request packet ID 192 with timestamp +7
(6) Cleaning up request packet ID 193 with timestamp +7
(7) Cleaning up request packet ID 194 with timestamp +7
(8) Cleaning up request packet ID 195 with timestamp +7
(9) Cleaning up request packet ID 196 with timestamp +7
(10) Cleaning up request packet ID 197 with timestamp +7
Ready to process requests


Regards


On Wed, 2020-09-30 at 08:57 -0400, Alan DeKok wrote:

> > On Sep 30, 2020, at 8:31 AM, Linux Threads <[hidden email]>
> > wrote:
> >
> > for replication: the home server, home server pool and the realm
> > are
> > configured in proxy.conf
>
>   That's good.
>
> > replicate should be listed in sites-enabled/"site" either under the
> > below sections depending on requirements I am using accounting:
>
>   OK.
>
> > and control I have listed it under accounting:
> >
> >       update control {
> >        &Replicate-to-Realm := "REALM-NAME"
> >    }
> >
> > do I leave mods-enabled/replicate as is?
>
>   Yes.  That's the default configuration for the module.  The
> documentation makes it clear what you need to do.
>
> > if a user auths with username or nt-domain\username, it does not
> > replicate,
>
>   So.... where is the debug output?
>
> > the only time it send packets to home server is when I use:
> >
> > echo Message-Authenticator=0x00|radclient 127.0.0.1 acct testing123
> > Received response ID 21, code 5, length = 20
> >
> > replicate is loaded:
> >
> > Wed Sep 30 09:02:45 2020 : Debug: Loaded rlm_replicate, checking if
> > it's valid
>
>   Don't use "radiusd -Xxx".
>
> > I have no otherway of testing this exept if I auth against the AP
>
>   You can run the server in debugging mode to see the packets from
> the AP.  Then, copy the packets, and resend them using radclient.
>
>   And PLEASE read http://wiki.freeradius.org/list-help
>
>   ALL of the documentation says to run the server in debugging mode,
> and post the output to the list.  The above page also links to
> another page which explains how to read the output of "radiusd -X".
>
>   When you ignore the documentation, you're wasting your time and
> ours.  We wrote the documentation in order to help people.  If you
> want help, READ THE DOCS, and FOLLOW THE INSTRUCTIONS.
>
>   Alan DeKok.
>

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Alan DeKok-2
On Oct 1, 2020, at 5:45 AM, Linux Threads <[hidden email]> wrote:
>
> what is strange is that the radius server is sending an arp request for
> the homeserver I have configured not sure if it is related,

  That's how IPv4 works...

> as requested here is the debug output
>
> sudo freeradius -X

  Which shows Access-Request packets, but no accounting.

  How are you going to debug accounting packets by looking at Access-Request packets?

  Post the debug log WHICH SHOWS ACCOUNTING PACKETS.

  Alan DeKok.


-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
| Threaded
Open this post in threaded view
|

Re: deployingradius and send Accounting to a nother server

Linux Threads
Thanks Alan,

I understand now, and replicate is working,

edit proxy.conf add home sersers and home server pools and realm,
update sites-enabled/site-name under accounting, and then point the ap
acct to FR 1813

Regards

On Thu, 2020-10-01 at 07:35 -0400, Alan DeKok wrote:

> On Oct 1, 2020, at 5:45 AM, Linux Threads <[hidden email]>
> wrote:
> > what is strange is that the radius server is sending an arp request
> > for
> > the homeserver I have configured not sure if it is related,
>
>   That's how IPv4 works...
>
> > as requested here is the debug output
> >
> > sudo freeradius -X
>
>   Which shows Access-Request packets, but no accounting.
>
>   How are you going to debug accounting packets by looking at Access-
> Request packets?
>
>   Post the debug log WHICH SHOWS ACCOUNTING PACKETS.
>
>   Alan DeKok.
>

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html