fajar

FreeRADIUS Version 2.1.3, for host x86_64-redhat-linux-gnu, built on Feb 12 2009 at 17:33:29
Copyright (C) 1999-2008 The FreeRADIUS server project and contributors.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
You may redistribute copies of FreeRADIUS under the terms of the
GNU General Public License v2.
Starting - reading configuration files ...
including configuration file /etc/raddb/radiusd.conf
including configuration file /etc/raddb/proxy.conf
including configuration file /etc/raddb/clients.conf
including files in directory /etc/raddb/modules/
including configuration file /etc/raddb/modules/checkval
including configuration file /etc/raddb/modules/always
including configuration file /etc/raddb/modules/mac2ip
including configuration file /etc/raddb/modules/pap
including configuration file /etc/raddb/modules/ippool
including configuration file /etc/raddb/modules/sql_log
including configuration file /etc/raddb/modules/realm
including configuration file /etc/raddb/modules/sqlcounter_expire_on_login
including configuration file /etc/raddb/modules/mschap
including configuration file /etc/raddb/modules/digest
including configuration file /etc/raddb/modules/echo
including configuration file /etc/raddb/modules/smbpasswd
including configuration file /etc/raddb/modules/perl
including configuration file /etc/raddb/modules/passwd
including configuration file /etc/raddb/modules/preprocess
including configuration file /etc/raddb/modules/detail.log
including configuration file /etc/raddb/modules/exec
including configuration file /etc/raddb/modules/policy
including configuration file /etc/raddb/modules/radutmp
including configuration file /etc/raddb/modules/files
including configuration file /etc/raddb/modules/detail
including configuration file /etc/raddb/modules/sradutmp
including configuration file /etc/raddb/modules/pam
including configuration file /etc/raddb/modules/attr_filter
including configuration file /etc/raddb/modules/expr
including configuration file /etc/raddb/modules/mac2vlan
including configuration file /etc/raddb/modules/acct_unique
including configuration file /etc/raddb/modules/inner-eap
including configuration file /etc/raddb/modules/detail.example.com
including configuration file /etc/raddb/modules/wimax
including configuration file /etc/raddb/modules/chap
including configuration file /etc/raddb/modules/ldap
including configuration file /etc/raddb/modules/unix
including configuration file /etc/raddb/modules/attr_rewrite
including configuration file /etc/raddb/modules/counter
including configuration file /etc/raddb/modules/logintime
including configuration file /etc/raddb/modules/expiration
including configuration file /etc/raddb/modules/linelog
including configuration file /etc/raddb/modules/etc_group
including configuration file /etc/raddb/eap.conf
including configuration file /etc/raddb/policy.conf
including files in directory /etc/raddb/sites-enabled/
including configuration file /etc/raddb/sites-enabled/control-socket
including configuration file /etc/raddb/sites-enabled/inner-tunnel
including configuration file /etc/raddb/sites-enabled/default
group = root
user = root
including dictionary file /etc/raddb/dictionary
main {
        prefix = "/usr"
        localstatedir = "/var"
        logdir = "/var/log/radius"
        libdir = "/usr/lib64/freeradius"
        radacctdir = "/var/log/radius/radacct"
        hostname_lookups = no
        max_request_time = 30
        cleanup_delay = 5
        max_requests = 1024
        allow_core_dumps = no
        pidfile = "/var/run/radiusd/radiusd.pid"
        checkrad = "/usr/sbin/checkrad"
        debug_level = 0
        proxy_requests = yes
 log {
        stripped_names = no
        auth = yes
        auth_badpass = no
        auth_goodpass = no
 }
 security {
        max_attributes = 200
        reject_delay = 0
        status_server = yes
 }
}
 client localhost {
        ipaddr = 127.0.0.1
        require_message_authenticator = no
        secret = "testing123"
        nastype = "other"
 }
 client 10.11.23.57 {
        require_message_authenticator = no
        secret = "testing123"
        shortname = "<CLIENT>"
 }
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
        retry_delay = 5
        retry_count = 3
        default_fallback = no
        dead_time = 120
        wake_all_if_all_dead = no
 }
 home_server localhost {
        ipaddr = 127.0.0.1
        port = 1812
        type = "auth"
        secret = "testing123"
        response_window = 20
        max_outstanding = 65536
        zombie_period = 40
        status_check = "status-server"
        ping_interval = 30
        check_interval = 30
        num_answers_to_alive = 3
        num_pings_to_alive = 3
        revive_interval = 120
        status_check_timeout = 4
 }
 home_server_pool my_auth_failover {
        type = fail-over
        home_server = localhost
 }
 realm example.com {
        auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating exec
  exec {
        wait = no
        input_pairs = "request"
        shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating expr
 Module: Linked to module rlm_expiration
 Module: Instantiating expiration
  expiration {
        reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating logintime
  logintime {
        reply-message = "You are calling outside your allowed timespan  "
        minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel {
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating pap
  pap {
        encryption_scheme = "auto"
        auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating chap
 Module: Linked to module rlm_mschap
 Module: Instantiating mschap
  mschap {
        use_mppe = yes
        require_encryption = no
        require_strong = no
        with_ntdomain_hack = no
  }
 Module: Linked to module rlm_unix
 Module: Instantiating unix
  unix {
        radwtmp = "/var/log/radius/radwtmp"
  }
 Module: Linked to module rlm_eap
 Module: Instantiating eap
  eap {
        default_eap_type = "peap"
        timer_expire = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 2048
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
        challenge = "Password: "
        auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
        rsa_key_exchange = no
        dh_key_exchange = yes
        rsa_key_length = 512
        dh_key_length = 512
        verify_depth = 0
        pem_file_type = yes
        private_key_file = "/etc/raddb/certs/server.pem"
        certificate_file = "/etc/raddb/certs/server.pem"
        CA_file = "/etc/raddb/certs/ca.pem"
        private_key_password = "whatever"
        dh_file = "/etc/raddb/certs/dh"
        random_file = "/etc/raddb/certs/random"
        fragment_size = 1024
        include_length = yes
        check_crl = no
        cipher_list = "DEFAULT"
        make_cert_command = "/etc/raddb/certs/bootstrap"
    cache {
        enable = no
        lifetime = 24
        max_entries = 255
    }
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
        default_eap_type = "gtc"
        copy_request_to_tunnel = no
        use_tunneled_reply = no
        proxy_tunneled_request_as_eap = yes
        virtual_server = "inner-tunnel"
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
        with_ntdomain_hack = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_realm
 Module: Instantiating suffix
  realm suffix {
        format = "suffix"
        delimiter = "@"
        ignore_default = no
        ignore_null = no
  }
 Module: Linked to module rlm_files
 Module: Instantiating files
  files {
        usersfile = "/etc/raddb/users"
        acctusersfile = "/etc/raddb/acct_users"
        preproxy_usersfile = "/etc/raddb/preproxy_users"
        compat = "no"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating radutmp
  radutmp {
        filename = "/var/log/radius/radutmp"
        username = "%{User-Name}"
        case_sensitive = yes
        check_with_nas = yes
        perm = 384
        callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Linked to module rlm_attr_filter
 Module: Instantiating attr_filter.access_reject
  attr_filter attr_filter.access_reject {
        attrsfile = "/etc/raddb/attrs.access_reject"
        key = "%{User-Name}"
  }
 }
}
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pam
 Module: Instantiating pam
  pam {
        pam_auth = "radiusd"
  }
 Module: Linked to module rlm_ldap
 Module: Instantiating ldap
  ldap {
        server = "<LDAP_SERVER>"
        port = 389
        password = ""
        identity = ""
        net_timeout = 1
        timeout = 4
        timelimit = 3
        tls_mode = no
        start_tls = no
        tls_require_cert = "allow"
   tls {
        start_tls = no
        require_cert = "allow"
   }
        basedn = "o=Telkom"
        filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
        base_filter = "(objectclass=radiusprofile)"
        auto_header = no
        access_attr_used_for_allow = yes
        groupname_attribute = "cn"
        groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))"
        dictionary_mapping = "/etc/raddb/ldap.attrmap"
        ldap_debug = 0
        ldap_connections_number = 5
        compare_check_items = no
        do_xlat = yes
        set_auth_type = yes
  }
rlm_ldap: Registering ldap_groupcmp for Ldap-Group
rlm_ldap: Registering ldap_xlat with xlat_name ldap
rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap
rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$
rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type
rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use
rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id
rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id
rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password
rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password
rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password
rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT
rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration
rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address
rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type
rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol
rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address
rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask
rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route
rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing
rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id
rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU
rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression
rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host
rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service
rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port
rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number
rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id
rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network
rlm_ldap: LDAP radiusClass mapped to RADIUS Class
rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout
rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout
rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action
rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service
rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node
rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group
rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link
rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network
rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone
rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit
rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port
rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message
conns: 0x1b807470
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating preprocess
  preprocess {
        huntgroups = "/etc/raddb/huntgroups"
        hints = "/etc/raddb/hints"
        with_ascend_hack = no
        ascend_channels_per_line = 23
        with_ntdomain_hack = no
        with_specialix_jetstream_hack = no
        with_cisco_vsa_hack = no
        with_alvarion_vsa_hack = no
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating acct_unique
  acct_unique {
        key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating detail
  detail {
        detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
        header = "%t"
        detailperm = 384
        dirperm = 493
        locking = no
        log_packet_header = no
  }
 Module: Instantiating attr_filter.accounting_response
  attr_filter attr_filter.accounting_response {
        attrsfile = "/etc/raddb/attrs.accounting_response"
        key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 }
radiusd: #### Opening IP addresses and Ports ####
listen {
        type = "auth"
        ipaddr = *
        port = 0
}
listen {
        type = "acct"
        ipaddr = *
        port = 0
}
listen {
        type = "control"
 listen {
        socket = "/var/run/radiusd/radiusd.sock"
 }
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=125
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x0200000b01383030303432
        Message-Authenticator = 0x2b7f25c453eb1c0303454b95c1b44d71
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 11
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[unix] returns notfound
++[files] returns noop
[ldap] performing user authorization for <USER>
[ldap] WARNING: Deprecated conditional expansion ":-".  See "man unlang" for details
[ldap]  expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=<USER>)
[ldap]  expand: o=Telkom -> o=Telkom
rlm_ldap: ldap_get_conn: Checking Id: 0
rlm_ldap: ldap_get_conn: Got Id: 0
rlm_ldap: attempting LDAP reconnection
rlm_ldap: (re)connect to <LDAP_SERVER>:389, authentication 0
rlm_ldap: bind as / to <LDAP_SERVER>:389
rlm_ldap: waiting for bind result ...
rlm_ldap: Bind was successful
rlm_ldap: performing search in o=Telkom, with filter (uid=<USER>)
[ldap] looking for check items in directory...
[ldap] looking for reply items in directory...
WARNING: No "known good" password was found in LDAP.  Are you sure that the user is configured correctly?
[ldap] user <USER> authorized to use remote access
rlm_ldap: ldap_release_conn: Release Id: 0
++[ldap] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication may fail because of this.
++[pap] returns noop
++? if (!control:Auth-Type)
? Evaluating !(control:Auth-Type) -> TRUE
++? if (!control:Auth-Type) -> FALSE
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x010100061920
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053b33a1597e93aeb15ced1048
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=231
Cleaning up request 0 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053b33a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x020100631900160301005801000054030149a51ef25d50f2d8c4ad1483556c5d7b7e5d0d5c9ccd10f35c267455a5bd757f00002600390038003500160013000a00330032002f0005000400150012000900140011000800060003020100000400230000
        Message-Authenticator = 0x6f60bb34657fc39b3da28becbbfebc66
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 99
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 0058], ClientHello
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 002a], ServerHello
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 085e], Certificate
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange
[peap]     TLS_accept: SSLv3 write key exchange A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase
In SSL Accept mode
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x0102040019c000000aad160301002a02000026030149a51ef2bef7d82df13691208c39fc57f314217c3553a8d0421f41bc079defa200003901160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479
        EAP-Message = 0x301e170d3039303232353037343535315a170d3130303232353037343535315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100b88e250c6b203f28fe99acbc8b0183df2612e3fe504e509143256e6b2c9dfeb40e23b089d0f6e9a0a18998376e337ed911b3add9aff3929a70b10c826945
        EAP-Message = 0xc83934df4d491fba58d26f24ea48c8370152b82ac342ef518b5eb3b09f8c7e9c596cf62d5d8c50533bb196478e51546513310aec86f3492be772942656c04b642e077dab15101471a9fe09997817f404743d0a52f22c720b9f26496ba49529476ea71626afe98a6d2ee60a2b954634011260998202225da4c7207335e0aa053cff72080bfaa2cad44d4a792b8e5cb823658f1ba87aef1a903eaf91af6ef7380da8f6b98cb8df22f0b53545dc32aae30c9d07f5adbb72648b629d0c6623269dc79ab10203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100c883a8f493e9746e73
        EAP-Message = 0x3b2f6df490b8b094e05d26705d903912bec8cc89b71464ba0ce346e362eff823fa1cfd999fa4c092bfe2f041b4bf494563d530dc388cc3d62db05a645c47baf1783470cf81607736be78d680173f32b2493631d8df6ab0d0f8fdc2a5faa9a8960bf9d82f9ee93805b720f4a8c0b281c046756baf2876a3f906fca579b280ccd2ba145df44c4b27d94f510e4d61f80470489d2ecdf9af5ff3e2311c2082c78645bacb05fbf62c026f59afd126a476b8aa8f9e52327ed1dd33e86e974271904cad0e0754551ec67bb0ec0ab589c91398f337063b1e7595a51294e4966229999c8278ca562eaa6a2ce44c6999594f5ff9030119f2743985e60004ab308204
        EAP-Message = 0xa73082038fa0030201020209
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053a30a1597e93aeb15ced1048
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=138
Cleaning up request 1 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053a30a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x020200061900
        Message-Authenticator = 0x14a5a1570fe1230590cdaad8c5b606d3
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x010303fc194000d462167527c1c1af300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3039303232353037343535315a170d3130303232353037343535315a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504
        EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100ca1e14f6797ed0f6ed9eac1d441662147f1e07dc70ede42a0512810ba9662bede309fa4d74654b85fa47c57f3867ef41ee24981ab55530df8cbb992ddca00fd7f741918f8dd529d6182443bb6162424238bbdb12f6f4a362ac5e3573782e4df2fd5db7b2033eddaca7c036ae670411
        EAP-Message = 0xc267bc353de1ca9107d2069bf5e4bf4b3950957fd1af4f2bd99b82eb7f8209df8140d8a92abff4f8471bdb441e4fcd2112cd455737cd995785e3469638dc2731ff09d7f2916e8c26b824de8504e0d7d47e4bb897c9e8c091cc93314e60751fa7806579a3101213aaa291ca6f5cd9b70c343a4607b863aae82e82a15465c7934ecd5bb2569867170adfc19ce69f8358a3fb0203010001a381fb3081f8301d0603551d0e04160414ed23222159f52c449662870ecef10140254552333081c80603551d230481c03081bd8014ed23222159f52c449662870ecef1014025455233a18199a48196308193310b3009060355040613024652310f300d06035504
        EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900d462167527c1c1af300c0603551d13040530030101ff300d06092a864886f70d010105050003820101002e94a4725f3433215f111d93c267ba1af192af0e5636c5109d2e17ac607a48edfc7634d7daf0e7e9cde494ca03f8ee050058d004ae34fd9ed31ed09c3c50811f0844cca46e9377719d42b6d49869aa932c72
        EAP-Message = 0xf70a1d8d93adb077
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053931a1597e93aeb15ced1048
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=138
Cleaning up request 2 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053931a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x020300061900
        Message-Authenticator = 0x567bfd86e1106c82a0a035fadba673da
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x010402c7190057fe996ed18b8e878332d5ce0dcd51027fd97500368d80ee4121b2d45380d4d9f00e7d878c722c74ffd18cb21b7ef89b47a3bbe842f2c1d76866c2f56f6a56be43717bbc96267b2ce59026a1632d29ddd54163f31633e63abcebe013db77b35b9e9587adb8b465844a08687e2976af17cbc979e68bbce29c0cfe47272d62f9cc41d3a7df162607e851655cfdeedf5244823aa49f7cd754c119b3ef675540b69cb2a7d4bd7c63160301020d0c00020900808bf80d1651af42ca0ea4042ac7a30b8888065ac42fdd8f4eee8b687bda068144c37eefa94e3f77ab828cf83b38f5f37475cd84e29dfcb71b7ff8d231703c80bbe4769a817911
        EAP-Message = 0x51668373f666cfaa0f59c5c8814d02be0f0ccdc0ce9843f9d3c6b3e93bb690d8c570218f35160892a8cc78cd4047d920b8d23516343c7f9e793b00010200801cb1ce7ae8e70263576eb27f0427d67e603c8053a50fd424c08c33f119c6610b82897d3efbe1c09482536205b3edc6f1110196dfbbb96ac64ebb02bf400d21216ab64dd5d12857257a057cd8d74dc68f1609844f5fa24c3f3288404f9deebe439f9f878606951b2a50a3710c4451bf4d78a79bbcc8922ba3677d4b9db2a186c401002953d7906c787646a44d708a99dbc9c2f1ed0123ee986f69003ac390635b7b5f9077b2100bacfaaec806aafa52188120d60729ced05d1cafbbfae280
        EAP-Message = 0x9606d13e31496e966461e54908ecdd33781e4b5926c8010d4b38b77c1d641add78f4854a62fed91943919b5aa5386b45497974664e2c2a6e9a2af7e538fb8a4dd13800bde3d258428319a15899079c65e68982738ccf2c3ad5a90b0fd428a702bd1b4b6cbdab86e7998e6fabe5dc21246f45f2b8313d0faeb24da0d7652066ae0122d1a4921ec9fc46ccb99605682859dc8b747ac358cbe6cb80137c24b48fcb07349c3c59e207e164f9801df60726425ee79edba2574ffd325a6a49722b74edc2057cba16030100040e000000
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053836a1597e93aeb15ced1048
Finished request 3.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=336
Cleaning up request 3 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053836a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x020400cc1900160301008610000082008065ada6468a1a6ca73590f0bed60e3ea9245012e10261406f5f35c1dad33f638a293e1523f874aa46f9f48525855c44c27b7456c3b862ce6dc88ab91b6f2a7191be226d7cea78b455b7e9c8285b23ce43f4e1f914fcf46d878a7ed8fb2872976cd4b8bcef8f70f49a4f1dd9d9c183799c8ebae80bb182b29fb3c6ad1a54f01f0d1403010001011603010030c7200510d067e83bedcc6a75b3483ee8724356d31fc0d6956a5392803322dd65aa50c8ddf211997e7d130f46c67cb443
        Message-Authenticator = 0x30ba21be3f1a368a78a4d8a9c1749dbc
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 204
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]
[peap] <<< TLS 1.0 Handshake [length 0010], Finished
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established
[peap] eaptls_process returned 13
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x01050041190014030100010116030100308cd7718960ec671993c4325627cd0595b80724507a38e5b451038b818382906da13a50b92fe2400e38ea74b3c3a550e6
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053f37a1597e93aeb15ced1048
Finished request 4.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=138
Cleaning up request 4 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053f37a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x020500061900
        Message-Authenticator = 0xb652caa9e83c1a46ef0c11874990be51
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3
[peap] eaptls_process returned 3
[peap] EAPTLS_SUCCESS
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x0106002b190017030100206e932ef975e63c81601fe35e85ff0061d9127fc3c76c22181d07afa7fb3f1c09
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053e34a1597e93aeb15ced1048
Finished request 5.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=228
Cleaning up request 5 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053e34a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x02060060190017030100206e2de0904f9953fc163dad932f1bd31d57371e49c42981397f84a0841172dc39170301003054074f91c21fa56f74a85a9619b1da78f830d2893cbf178d7b522be35ed287601b611f14d8f9df513cdb587195958fc1
        Message-Authenticator = 0xda78c3b48397d890ac96f563e7639dc2
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 96
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Identity - <USER>
[peap] Got tunneled request
        EAP-Message = 0x0206000b01383030303432
server  {
  PEAP: Got tunneled identity of <USER>
  PEAP: Setting default EAP type for tunneled EAP session.
  PEAP: Setting User-Name to <USER>
Sending tunneled request
        EAP-Message = 0x0206000b01383030303432
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "<USER>"
server inner-tunnel {
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 6 length 11
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type gtc
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
        EAP-Message = 0x0107000f0650617373776f72643a20
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x29c3aad629c4ac82cf75d1666ecdce24
[peap] Got tunneled reply RADIUS code 11
        EAP-Message = 0x0107000f0650617373776f72643a20
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x29c3aad629c4ac82cf75d1666ecdce24
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x0107003b19001703010030853027027f48b85ddc12f67ab32119f3a1d12a6c90ff12f08f388bfc10e9a148346eea000076d50d4ba48f7fe7f4ce0b
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053d35a1597e93aeb15ced1048
Finished request 6.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=228
Cleaning up request 6 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053d35a1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x020700601900170301002065498c2b66596d99eb42ff44caee54d82bfc9518bd4b9f41ead01a387aa88d1b17030100308c18f5efdbd7c9426c46cb5c4da9c4726c634b5d2f61ae8f31dd8894d2c385ff9e0d95bc014d88fa0c5ed1bb9496a14c
        Message-Authenticator = 0x3af4b2f86ed8015d344cb3724c0cb350
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 96
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] EAP type gtc
[peap] Got tunneled request
        EAP-Message = 0x0207000b067372626c6677
server  {
  PEAP: Setting User-Name to <USER>
Sending tunneled request
        EAP-Message = 0x0207000b067372626c6677
        FreeRADIUS-Proxied-To = 127.0.0.1
        User-Name = "<USER>"
        State = 0x29c3aad629c4ac82cf75d1666ecdce24
server inner-tunnel {
+- entering group authorize {...}
++[chap] returns noop
++[mschap] returns noop
++[unix] returns notfound
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
++[control] returns noop
[eap] EAP packet type response id 7 length 11
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
++[pap] returns noop
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/gtc
[eap] processing type gtc
[gtc] +- entering group PAP {...}
[pap] login attempt with password "<PASSWORD>"
[pap] No password configured for the user.  Cannot do authentication
++[pap] returns fail
[eap] Handler failed in EAP/gtc
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [<USER>] (from client <CLIENT> port 0 via TLS tunnel)
} # server inner-tunnel
[peap] Got tunneled reply code 3
        EAP-Message = 0x04070004
        Message-Authenticator = 0x00000000000000000000000000000000
[peap] Got tunneled reply RADIUS code 3
        EAP-Message = 0x04070004
        Message-Authenticator = 0x00000000000000000000000000000000
[peap] Tunneled authentication was rejected.
[peap] FAILURE
++[eap] returns handled
Sending Access-Challenge of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x0108003b19001703010030f10f471fc1902569031f1adc0d268757a118a0a985151c35493c14683827f83d086fc506b357ca1ae8b2492ddacbcd44
        Message-Authenticator = 0x00000000000000000000000000000000
        State = 0x3b32b8053c3aa1597e93aeb15ced1048
Finished request 7.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 10.11.23.57 port 2050, id=0, length=228
Cleaning up request 7 ID 0 with timestamp +43
        User-Name = "<USER>"
        NAS-IP-Address = 192.168.6.11
        Called-Station-Id = "001839edc159"
        Calling-Station-Id = "002269607a74"
        NAS-Identifier = "001839edc159"
        NAS-Port = 46
        Framed-MTU = 1400
        State = 0x3b32b8053c3aa1597e93aeb15ced1048
        NAS-Port-Type = Wireless-802.11
        EAP-Message = 0x02080060190017030100200c31161fe0df8e4d97927bd0685ad8da6e711f237632c87896c196b82f0fc5411703010030041789764ed83986a389c83fd45ccb460158bca2dcb46c24c89ad564906b2553e4003b072c84729a8c24a59914819652
        Message-Authenticator = 0xd2858994eb82c2d86eb59137b255fe38
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
[suffix] No '@' in User-Name = "<USER>", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 96
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7
[peap] Done initial handshake
[peap] eaptls_process returned 7
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Received EAP-TLV response.
[peap]  Had sent TLV failure.  User was rejected earlier in this session.
[eap] Handler failed in EAP/peap
[eap] Failed in EAP select
++[eap] returns invalid
Failed to authenticate the user.
Login incorrect: [<USER>] (from client <CLIENT> port 46 cli 002269607a74)
Using Post-Auth-Type Reject
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> <USER>
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Sending Access-Reject of id 0 to 10.11.23.57 port 2050
        EAP-Message = 0x04080004
        Message-Authenticator = 0x00000000000000000000000000000000
Finished request 8.
Going to the next request
Waking up in 4.9 seconds.
Cleaning up request 8 ID 0 with timestamp +43
Ready to process requests.