API tools faq
paste
Guest User

Untitled

a guest
Mar 15th, 2018
622
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 65.59 KB | None | 0 0
raw download clone embed print report
  1. FreeRADIUS Version 3.0.12
  2. Copyright (C) 1999-2016 The FreeRADIUS server project and contributors
  3. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
  4. PARTICULAR PURPOSE
  5. You may redistribute copies of FreeRADIUS under the terms of the
  6. GNU General Public License
  7. For more information about these matters, see the file named COPYRIGHT
  8. Starting - reading configuration files ...
  9. including dictionary file /usr/share/freeradius/dictionary
  10. including dictionary file /usr/share/freeradius/dictionary.dhcp
  11. including dictionary file /usr/share/freeradius/dictionary.vqp
  12. including dictionary file /etc/freeradius/3.0/dictionary
  13. including configuration file /etc/freeradius/3.0/radiusd.conf
  14. including configuration file /etc/freeradius/3.0/proxy.conf
  15. including configuration file /etc/freeradius/3.0/clients.conf
  16. including files in directory /etc/freeradius/3.0/mods-enabled/
  17. including configuration file /etc/freeradius/3.0/mods-enabled/dynamic_clients
  18. including configuration file /etc/freeradius/3.0/mods-enabled/preprocess
  19. including configuration file /etc/freeradius/3.0/mods-enabled/sradutmp
  20. including configuration file /etc/freeradius/3.0/mods-enabled/chap
  21. including configuration file /etc/freeradius/3.0/mods-enabled/always
  22. including configuration file /etc/freeradius/3.0/mods-enabled/logintime
  23. including configuration file /etc/freeradius/3.0/mods-enabled/soh
  24. including configuration file /etc/freeradius/3.0/mods-enabled/files
  25. including configuration file /etc/freeradius/3.0/mods-enabled/detail
  26. including configuration file /etc/freeradius/3.0/mods-enabled/exec
  27. including configuration file /etc/freeradius/3.0/mods-enabled/detail.log
  28. including configuration file /etc/freeradius/3.0/mods-enabled/unix
  29. including configuration file /etc/freeradius/3.0/mods-enabled/pap
  30. including configuration file /etc/freeradius/3.0/mods-enabled/passwd
  31. including configuration file /etc/freeradius/3.0/mods-enabled/mschap
  32. including configuration file /etc/freeradius/3.0/mods-enabled/echo
  33. including configuration file /etc/freeradius/3.0/mods-enabled/unpack
  34. including configuration file /etc/freeradius/3.0/mods-enabled/radutmp
  35. including configuration file /etc/freeradius/3.0/mods-enabled/ntlm_auth
  36. including configuration file /etc/freeradius/3.0/mods-enabled/cache_eap
  37. including configuration file /etc/freeradius/3.0/mods-enabled/expiration
  38. including configuration file /etc/freeradius/3.0/mods-enabled/utf8
  39. including configuration file /etc/freeradius/3.0/mods-enabled/eap
  40. including configuration file /etc/freeradius/3.0/mods-enabled/expr
  41. including configuration file /etc/freeradius/3.0/mods-enabled/realm
  42. including configuration file /etc/freeradius/3.0/mods-enabled/attr_filter
  43. including configuration file /etc/freeradius/3.0/mods-enabled/php
  44. including configuration file /etc/freeradius/3.0/mods-enabled/digest
  45. including configuration file /etc/freeradius/3.0/mods-enabled/linelog
  46. including configuration file /etc/freeradius/3.0/mods-enabled/replicate
  47. including files in directory /etc/freeradius/3.0/policy.d/
  48. including configuration file /etc/freeradius/3.0/policy.d/operator-name
  49. including configuration file /etc/freeradius/3.0/policy.d/dhcp
  50. including configuration file /etc/freeradius/3.0/policy.d/debug
  51. including configuration file /etc/freeradius/3.0/policy.d/accounting
  52. including configuration file /etc/freeradius/3.0/policy.d/moonshot-targeted-ids
  53. including configuration file /etc/freeradius/3.0/policy.d/control
  54. including configuration file /etc/freeradius/3.0/policy.d/abfab-tr
  55. including configuration file /etc/freeradius/3.0/policy.d/filter
  56. including configuration file /etc/freeradius/3.0/policy.d/canonicalization
  57. including configuration file /etc/freeradius/3.0/policy.d/cui
  58. including configuration file /etc/freeradius/3.0/policy.d/eap
  59. including files in directory /etc/freeradius/3.0/sites-enabled/
  60. including configuration file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  61. including configuration file /etc/freeradius/3.0/sites-enabled/default
  62. main {
  63.  security {
  64.         user = "freerad"
  65.         group = "freerad"
  66.         allow_core_dumps = no
  67.  }
  68.         name = "freeradius"
  69.         prefix = "/usr"
  70.         localstatedir = "/var"
  71.         logdir = "/var/log/freeradius"
  72.         run_dir = "/var/run/freeradius"
  73. }
  74. main {
  75.         name = "freeradius"
  76.         prefix = "/usr"
  77.         localstatedir = "/var"
  78.         sbindir = "/usr/sbin"
  79.         logdir = "/var/log/freeradius"
  80.         run_dir = "/var/run/freeradius"
  81.         libdir = "/usr/lib/freeradius"
  82.         radacctdir = "/var/log/freeradius/radacct"
  83.         hostname_lookups = no
  84.         max_request_time = 30
  85.         cleanup_delay = 5
  86.         max_requests = 16384
  87.         pidfile = "/var/run/freeradius/freeradius.pid"
  88.         checkrad = "/usr/sbin/checkrad"
  89.         debug_level = 0
  90.         proxy_requests = yes
  91.  log {
  92.         stripped_names = no
  93.         auth = no
  94.         auth_badpass = no
  95.         auth_goodpass = no
  96.         colourise = yes
  97.         msg_denied = "You are already logged in - access denied"
  98.  }
  99.  resources {
  100.  }
  101.  security {
  102.         max_attributes = 200
  103.         reject_delay = 1.000000
  104.         status_server = yes
  105.  }
  106. }
  107. radiusd: #### Loading Realms and Home Servers ####
  108.  proxy server {
  109.         retry_delay = 5
  110.         retry_count = 3
  111.         default_fallback = no
  112.         dead_time = 120
  113.         wake_all_if_all_dead = no
  114.  }
  115.  home_server localhost {
  116.         ipaddr = 127.0.0.1
  117.         port = 1812
  118.         type = "auth"
  119.         secret = <<< secret >>>
  120.         response_window = 20.000000
  121.         response_timeouts = 1
  122.         max_outstanding = 65536
  123.         zombie_period = 40
  124.         status_check = "status-server"
  125.         ping_interval = 30
  126.         check_interval = 30
  127.         check_timeout = 4
  128.         num_answers_to_alive = 3
  129.         revive_interval = 120
  130.   limit {
  131.         max_connections = 16
  132.         max_requests = 0
  133.         lifetime = 0
  134.         idle_timeout = 0
  135.   }
  136.   coa {
  137.         irt = 2
  138.         mrt = 16
  139.         mrc = 5
  140.         mrd = 30
  141.   }
  142.  }
  143.  home_server_pool my_auth_failover {
  144.         type = fail-over
  145.         home_server = localhost
  146.  }
  147.  realm example.com {
  148.         auth_pool = my_auth_failover
  149.  }
  150.  realm LOCAL {
  151.  }
  152. radiusd: #### Loading Clients ####
  153.  client localhost {
  154.         ipaddr = 127.0.0.1
  155.         require_message_authenticator = no
  156.         secret = <<< secret >>>
  157.         nas_type = "other"
  158.         proto = "*"
  159.   limit {
  160.         max_connections = 16
  161.         lifetime = 0
  162.         idle_timeout = 30
  163.   }
  164.  }
  165.  client localhost_ipv6 {
  166.         ipv6addr = ::1
  167.         require_message_authenticator = no
  168.         secret = <<< secret >>>
  169.   limit {
  170.         max_connections = 16
  171.         lifetime = 0
  172.         idle_timeout = 30
  173.   }
  174.  }
  175.  client wifiVRN {
  176.         ipaddr = 192.168.5.2
  177.         require_message_authenticator = no
  178.         secret = <<< secret >>>
  179.         proto = "*"
  180.   limit {
  181.         max_connections = 16
  182.         lifetime = 0
  183.         idle_timeout = 30
  184.   }
  185.  }
  186. Debugger not attached
  187.  # Creating Auth-Type = mschap
  188.  # Creating Auth-Type = eap
  189.  # Creating Auth-Type = PAP
  190.  # Creating Auth-Type = CHAP
  191.  # Creating Auth-Type = MS-CHAP
  192.  # Creating Auth-Type = digest
  193. radiusd: #### Instantiating modules ####
  194.  modules {
  195.   # Loaded module rlm_dynamic_clients
  196.   # Loading module "dynamic_clients" from file /etc/freeradius/3.0/mods-enabled/dynamic_clients
  197.   # Loaded module rlm_preprocess
  198.   # Loading module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess
  199.   preprocess {
  200.         huntgroups = "/etc/freeradius/3.0/mods-config/preprocess/huntgroups"
  201.         hints = "/etc/freeradius/3.0/mods-config/preprocess/hints"
  202.         with_ascend_hack = no
  203.         ascend_channels_per_line = 23
  204.         with_ntdomain_hack = no
  205.         with_specialix_jetstream_hack = no
  206.         with_cisco_vsa_hack = no
  207.         with_alvarion_vsa_hack = no
  208.   }
  209.   # Loaded module rlm_radutmp
  210.   # Loading module "sradutmp" from file /etc/freeradius/3.0/mods-enabled/sradutmp
  211.   radutmp sradutmp {
  212.         filename = "/var/log/freeradius/sradutmp"
  213.         username = "%{User-Name}"
  214.         case_sensitive = yes
  215.         check_with_nas = yes
  216.         permissions = 420
  217.         caller_id = no
  218.   }
  219.   # Loaded module rlm_chap
  220.   # Loading module "chap" from file /etc/freeradius/3.0/mods-enabled/chap
  221.   # Loaded module rlm_always
  222.   # Loading module "reject" from file /etc/freeradius/3.0/mods-enabled/always
  223.   always reject {
  224.         rcode = "reject"
  225.         simulcount = 0
  226.         mpp = no
  227.   }
  228.   # Loading module "fail" from file /etc/freeradius/3.0/mods-enabled/always
  229.   always fail {
  230.         rcode = "fail"
  231.         simulcount = 0
  232.         mpp = no
  233.   }
  234.   # Loading module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  235.   always ok {
  236.         rcode = "ok"
  237.         simulcount = 0
  238.         mpp = no
  239.   }
  240.   # Loading module "handled" from file /etc/freeradius/3.0/mods-enabled/always
  241.   always handled {
  242.         rcode = "handled"
  243.         simulcount = 0
  244.         mpp = no
  245.   }
  246.   # Loading module "invalid" from file /etc/freeradius/3.0/mods-enabled/always
  247.   always invalid {
  248.         rcode = "invalid"
  249.         simulcount = 0
  250.         mpp = no
  251.   }
  252.   # Loading module "userlock" from file /etc/freeradius/3.0/mods-enabled/always
  253.   always userlock {
  254.         rcode = "userlock"
  255.         simulcount = 0
  256.         mpp = no
  257.   }
  258.   # Loading module "notfound" from file /etc/freeradius/3.0/mods-enabled/always
  259.   always notfound {
  260.         rcode = "notfound"
  261.         simulcount = 0
  262.         mpp = no
  263.   }
  264.   # Loading module "noop" from file /etc/freeradius/3.0/mods-enabled/always
  265.   always noop {
  266.         rcode = "noop"
  267.         simulcount = 0
  268.         mpp = no
  269.   }
  270.   # Loading module "updated" from file /etc/freeradius/3.0/mods-enabled/always
  271.   always updated {
  272.         rcode = "updated"
  273.         simulcount = 0
  274.         mpp = no
  275.   }
  276.   # Loaded module rlm_logintime
  277.   # Loading module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime
  278.   logintime {
  279.         minimum_timeout = 60
  280.   }
  281.   # Loaded module rlm_soh
  282.   # Loading module "soh" from file /etc/freeradius/3.0/mods-enabled/soh
  283.   soh {
  284.         dhcp = yes
  285.   }
  286.   # Loaded module rlm_files
  287.   # Loading module "files" from file /etc/freeradius/3.0/mods-enabled/files
  288.   files {
  289.         filename = "/etc/freeradius/3.0/mods-config/files/authorize"
  290.         acctusersfile = "/etc/freeradius/3.0/mods-config/files/accounting"
  291.         preproxy_usersfile = "/etc/freeradius/3.0/mods-config/files/pre-proxy"
  292.   }
  293.   # Loaded module rlm_detail
  294.   # Loading module "detail" from file /etc/freeradius/3.0/mods-enabled/detail
  295.   detail {
  296.         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d"
  297.         header = "%t"
  298.         permissions = 384
  299.         locking = no
  300.         escape_filenames = no
  301.         log_packet_header = no
  302.   }
  303.   # Loaded module rlm_exec
  304.   # Loading module "exec" from file /etc/freeradius/3.0/mods-enabled/exec
  305.   exec {
  306.         wait = no
  307.         input_pairs = "request"
  308.         shell_escape = yes
  309.         timeout = 10
  310.   }
  311.   # Loading module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  312.   detail auth_log {
  313.         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d"
  314.         header = "%t"
  315.         permissions = 384
  316.         locking = no
  317.         escape_filenames = no
  318.         log_packet_header = no
  319.   }
  320.   # Loading module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  321.   detail reply_log {
  322.         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d"
  323.         header = "%t"
  324.         permissions = 384
  325.         locking = no
  326.         escape_filenames = no
  327.         log_packet_header = no
  328.   }
  329.   # Loading module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  330.   detail pre_proxy_log {
  331.         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d"
  332.         header = "%t"
  333.         permissions = 384
  334.         locking = no
  335.         escape_filenames = no
  336.         log_packet_header = no
  337.   }
  338.   # Loading module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  339.   detail post_proxy_log {
  340.         filename = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d"
  341.         header = "%t"
  342.         permissions = 384
  343.         locking = no
  344.         escape_filenames = no
  345.         log_packet_header = no
  346.   }
  347.   # Loaded module rlm_unix
  348.   # Loading module "unix" from file /etc/freeradius/3.0/mods-enabled/unix
  349.   unix {
  350.         radwtmp = "/var/log/freeradius/radwtmp"
  351.   }
  352. Creating attribute Unix-Group
  353.   # Loaded module rlm_pap
  354.   # Loading module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  355.   pap {
  356.         normalise = yes
  357.   }
  358.   # Loaded module rlm_passwd
  359.   # Loading module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd
  360.   passwd etc_passwd {
  361.         filename = "/etc/passwd"
  362.         format = "*User-Name:Crypt-Password:"
  363.         delimiter = ":"
  364.         ignore_nislike = no
  365.         ignore_empty = yes
  366.         allow_multiple_keys = no
  367.         hash_size = 100
  368.   }
  369.   # Loaded module rlm_mschap
  370.   # Loading module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap
  371.   mschap {
  372.         use_mppe = yes
  373.         require_encryption = no
  374.         require_strong = no
  375.         with_ntdomain_hack = yes
  376.    passchange {
  377.    }
  378.         allow_retry = yes
  379.   }
  380.   # Loading module "echo" from file /etc/freeradius/3.0/mods-enabled/echo
  381.   exec echo {
  382.         wait = yes
  383.         program = "/bin/echo %{User-Name}"
  384.         input_pairs = "request"
  385.         output_pairs = "reply"
  386.         shell_escape = yes
  387.   }
  388.   # Loaded module rlm_unpack
  389.   # Loading module "unpack" from file /etc/freeradius/3.0/mods-enabled/unpack
  390.   # Loading module "radutmp" from file /etc/freeradius/3.0/mods-enabled/radutmp
  391.   radutmp {
  392.         filename = "/var/log/freeradius/radutmp"
  393.         username = "%{User-Name}"
  394.         case_sensitive = yes
  395.         check_with_nas = yes
  396.         permissions = 384
  397.         caller_id = yes
  398.   }
  399.   # Loading module "ntlm_auth" from file /etc/freeradius/3.0/mods-enabled/ntlm_auth
  400.   exec ntlm_auth {
  401.         wait = yes
  402.         program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
  403.         shell_escape = yes
  404.   }
  405.   # Loaded module rlm_cache
  406.   # Loading module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap
  407.   cache cache_eap {
  408.         driver = "rlm_cache_rbtree"
  409.         key = "%{%{control:State}:-%{%{reply:State}:-%{State}}}"
  410.         ttl = 15
  411.         max_entries = 0
  412.         epoch = 0
  413.         add_stats = no
  414.   }
  415.   # Loaded module rlm_expiration
  416.   # Loading module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration
  417.   # Loaded module rlm_utf8
  418.   # Loading module "utf8" from file /etc/freeradius/3.0/mods-enabled/utf8
  419.   # Loaded module rlm_eap
  420.   # Loading module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  421.   eap {
  422.         default_eap_type = "md5"
  423.         timer_expire = 60
  424.         ignore_unknown_eap_types = no
  425.         cisco_accounting_username_bug = no
  426.         max_sessions = 16384
  427.   }
  428.   # Loaded module rlm_expr
  429.   # Loading module "expr" from file /etc/freeradius/3.0/mods-enabled/expr
  430.   expr {
  431.         safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ"
  432.   }
  433.   # Loaded module rlm_realm
  434.   # Loading module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
  435.   realm IPASS {
  436.         format = "prefix"
  437.         delimiter = "/"
  438.         ignore_default = no
  439.         ignore_null = no
  440.   }
  441.   # Loading module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm
  442.   realm suffix {
  443.         format = "suffix"
  444.         delimiter = "@"
  445.         ignore_default = no
  446.         ignore_null = no
  447.   }
  448.   # Loading module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm
  449.   realm realmpercent {
  450.         format = "suffix"
  451.         delimiter = "%"
  452.         ignore_default = no
  453.         ignore_null = no
  454.   }
  455.   # Loading module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm
  456.   realm ntdomain {
  457.         format = "prefix"
  458.         delimiter = "\\"
  459.        ignore_default = no
  460.        ignore_null = no
  461.  }
  462.  # Loaded module rlm_attr_filter
  463.  # Loading module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  464.  attr_filter attr_filter.post-proxy {
  465.        filename = "/etc/freeradius/3.0/mods-config/attr_filter/post-proxy"
  466.        key = "%{Realm}"
  467.        relaxed = no
  468.  }
  469.  # Loading module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  470.  attr_filter attr_filter.pre-proxy {
  471.        filename = "/etc/freeradius/3.0/mods-config/attr_filter/pre-proxy"
  472.        key = "%{Realm}"
  473.        relaxed = no
  474.  }
  475.  # Loading module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  476.  attr_filter attr_filter.access_reject {
  477.        filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_reject"
  478.        key = "%{User-Name}"
  479.        relaxed = no
  480.  }
  481.  # Loading module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  482.  attr_filter attr_filter.access_challenge {
  483.        filename = "/etc/freeradius/3.0/mods-config/attr_filter/access_challenge"
  484.        key = "%{User-Name}"
  485.        relaxed = no
  486.  }
  487.  # Loading module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  488.  attr_filter attr_filter.accounting_response {
  489.        filename = "/etc/freeradius/3.0/mods-config/attr_filter/accounting_response"
  490.        key = "%{User-Name}"
  491.        relaxed = no
  492.  }
  493.  # Loading module "php" from file /etc/freeradius/3.0/mods-enabled/php
  494.  exec php {
  495.        wait = yes
  496.        program = "/usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php"
  497.        input_pairs = "request"
  498.        output_pairs = "reply"
  499.        shell_escape = yes
  500.  }
  501.  # Loaded module rlm_digest
  502.  # Loading module "digest" from file /etc/freeradius/3.0/mods-enabled/digest
  503.  # Loaded module rlm_linelog
  504.  # Loading module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog
  505.  linelog {
  506.        filename = "/var/log/freeradius/linelog"
  507.        escape_filenames = no
  508.        syslog_severity = "info"
  509.        permissions = 384
  510.        format = "This is a log message for %{User-Name}"
  511.        reference = "messages.%{%{reply:Packet-Type}:-default}"
  512.  }
  513.  # Loading module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog
  514.  linelog log_accounting {
  515.        filename = "/var/log/freeradius/linelog-accounting"
  516.        escape_filenames = no
  517.        syslog_severity = "info"
  518.        permissions = 384
  519.        format = ""
  520.        reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}"
  521.  }
  522.  # Loaded module rlm_replicate
  523.  # Loading module "replicate" from file /etc/freeradius/3.0/mods-enabled/replicate
  524.  instantiate {
  525.  }
  526.  # Instantiating module "preprocess" from file /etc/freeradius/3.0/mods-enabled/preprocess
  527. reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/huntgroups
  528. reading pairlist file /etc/freeradius/3.0/mods-config/preprocess/hints
  529.  # Instantiating module "reject" from file /etc/freeradius/3.0/mods-enabled/always
  530.  # Instantiating module "fail" from file /etc/freeradius/3.0/mods-enabled/always
  531.  # Instantiating module "ok" from file /etc/freeradius/3.0/mods-enabled/always
  532.  # Instantiating module "handled" from file /etc/freeradius/3.0/mods-enabled/always
  533.  # Instantiating module "invalid" from file /etc/freeradius/3.0/mods-enabled/always
  534.  # Instantiating module "userlock" from file /etc/freeradius/3.0/mods-enabled/always
  535.  # Instantiating module "notfound" from file /etc/freeradius/3.0/mods-enabled/always
  536.  # Instantiating module "noop" from file /etc/freeradius/3.0/mods-enabled/always
  537.  # Instantiating module "updated" from file /etc/freeradius/3.0/mods-enabled/always
  538.  # Instantiating module "logintime" from file /etc/freeradius/3.0/mods-enabled/logintime
  539.  # Instantiating module "files" from file /etc/freeradius/3.0/mods-enabled/files
  540. reading pairlist file /etc/freeradius/3.0/mods-config/files/authorize
  541. reading pairlist file /etc/freeradius/3.0/mods-config/files/accounting
  542. reading pairlist file /etc/freeradius/3.0/mods-config/files/pre-proxy
  543.  # Instantiating module "detail" from file /etc/freeradius/3.0/mods-enabled/detail
  544.  # Instantiating module "auth_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  545. rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output
  546.  # Instantiating module "reply_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  547.  # Instantiating module "pre_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  548.  # Instantiating module "post_proxy_log" from file /etc/freeradius/3.0/mods-enabled/detail.log
  549.  # Instantiating module "pap" from file /etc/freeradius/3.0/mods-enabled/pap
  550.  # Instantiating module "etc_passwd" from file /etc/freeradius/3.0/mods-enabled/passwd
  551. rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no
  552.  # Instantiating module "mschap" from file /etc/freeradius/3.0/mods-enabled/mschap
  553. rlm_mschap (mschap): using internal authentication
  554.  # Instantiating module "cache_eap" from file /etc/freeradius/3.0/mods-enabled/cache_eap
  555. rlm_cache (cache_eap): Driver rlm_cache_rbtree (module rlm_cache_rbtree) loaded and linked
  556.  # Instantiating module "expiration" from file /etc/freeradius/3.0/mods-enabled/expiration
  557.  # Instantiating module "eap" from file /etc/freeradius/3.0/mods-enabled/eap
  558.   # Linked to sub-module rlm_eap_md5
  559.   # Linked to sub-module rlm_eap_leap
  560.   # Linked to sub-module rlm_eap_gtc
  561.   gtc {
  562.        challenge = "Password: "
  563.        auth_type = "PAP"
  564.   }
  565.   # Linked to sub-module rlm_eap_tls
  566.   tls {
  567.        tls = "tls-common"
  568.   }
  569.   tls-config tls-common {
  570.        verify_depth = 0
  571.        ca_path = "/etc/freeradius/3.0/certs"
  572.        pem_file_type = yes
  573.        private_key_file = "/etc/ssl/private/ssl-cert-snakeoil.key"
  574.        certificate_file = "/etc/ssl/certs/ssl-cert-snakeoil.pem"
  575.        ca_file = "/etc/ssl/certs/ca-certificates.crt"
  576.        private_key_password = <<< secret >>>
  577.        dh_file = "/etc/freeradius/3.0/certs/dh"
  578.        fragment_size = 1024
  579.        include_length = yes
  580.        auto_chain = yes
  581.        check_crl = no
  582.        check_all_crl = no
  583.        cipher_list = "DEFAULT"
  584.        ecdh_curve = "prime256v1"
  585.    cache {
  586.        enable = yes
  587.        lifetime = 24
  588.        max_entries = 255
  589.    }
  590.    verify {
  591.        skip_if_ocsp_ok = no
  592.    }
  593.    ocsp {
  594.        enable = no
  595.        override_cert_url = yes
  596.        url = "http://127.0.0.1/ocsp/"
  597.        use_nonce = yes
  598.        timeout = 0
  599.        softfail = no
  600.    }
  601.   }
  602.   # Linked to sub-module rlm_eap_ttls
  603.   ttls {
  604.        tls = "tls-common"
  605.        default_eap_type = "md5"
  606.        copy_request_to_tunnel = no
  607.        use_tunneled_reply = no
  608.        virtual_server = "inner-tunnel"
  609.        include_length = yes
  610.        require_client_cert = no
  611.   }
  612. tls: Using cached TLS configuration from previous invocation
  613.   # Linked to sub-module rlm_eap_peap
  614.   peap {
  615.        tls = "tls-common"
  616.        default_eap_type = "mschapv2"
  617.        copy_request_to_tunnel = no
  618.        use_tunneled_reply = no
  619.        proxy_tunneled_request_as_eap = yes
  620.        virtual_server = "inner-tunnel"
  621.        soh = no
  622.        require_client_cert = no
  623.   }
  624. tls: Using cached TLS configuration from previous invocation
  625.   # Linked to sub-module rlm_eap_mschapv2
  626.   mschapv2 {
  627.        with_ntdomain_hack = no
  628.        send_error = no
  629.   }
  630.  # Instantiating module "IPASS" from file /etc/freeradius/3.0/mods-enabled/realm
  631.  # Instantiating module "suffix" from file /etc/freeradius/3.0/mods-enabled/realm
  632.  # Instantiating module "realmpercent" from file /etc/freeradius/3.0/mods-enabled/realm
  633.  # Instantiating module "ntdomain" from file /etc/freeradius/3.0/mods-enabled/realm
  634.  # Instantiating module "attr_filter.post-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  635. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/post-proxy
  636.  # Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  637. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/pre-proxy
  638.  # Instantiating module "attr_filter.access_reject" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  639. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_reject
  640. [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay"   found in filter list for realm "DEFAULT".
  641. [/etc/freeradius/3.0/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec"      found in filter list for realm "DEFAULT".
  642.  # Instantiating module "attr_filter.access_challenge" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  643. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/access_challenge
  644.  # Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/3.0/mods-enabled/attr_filter
  645. reading pairlist file /etc/freeradius/3.0/mods-config/attr_filter/accounting_response
  646.  # Instantiating module "linelog" from file /etc/freeradius/3.0/mods-enabled/linelog
  647.  # Instantiating module "log_accounting" from file /etc/freeradius/3.0/mods-enabled/linelog
  648. } # modules
  649. radiusd: #### Loading Virtual Servers ####
  650. server { # from file /etc/freeradius/3.0/radiusd.conf
  651. } # server
  652. server inner-tunnel { # from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  653. # Loading authenticate {...}
  654. # Loading authorize {...}
  655. Ignoring "sql" (see raddb/mods-available/README.rst)
  656. Ignoring "ldap" (see raddb/mods-available/README.rst)
  657. # Loading session {...}
  658. # Loading post-proxy {...}
  659. # Loading post-auth {...}
  660. } # server inner-tunnel
  661. server default { # from file /etc/freeradius/3.0/sites-enabled/default
  662. # Loading authenticate {...}
  663. # Loading authorize {...}
  664. # Loading preacct {...}
  665. # Loading accounting {...}
  666. # Loading post-proxy {...}
  667. # Loading post-auth {...}
  668. } # server default
  669. radiusd: #### Opening IP addresses and Ports ####
  670. listen {
  671.        type = "auth"
  672.        ipaddr = 127.0.0.1
  673.        port = 18120
  674. }
  675. listen {
  676.        type = "auth"
  677.        ipaddr = *
  678.        port = 0
  679.   limit {
  680.        max_connections = 16
  681.        lifetime = 0
  682.        idle_timeout = 30
  683.   }
  684. }
  685. listen {
  686.        type = "acct"
  687.        ipaddr = *
  688.        port = 0
  689.   limit {
  690.        max_connections = 16
  691.        lifetime = 0
  692.        idle_timeout = 30
  693.   }
  694. }
  695. listen {
  696.        type = "auth"
  697.        ipv6addr = ::
  698.        port = 0
  699.   limit {
  700.        max_connections = 16
  701.        lifetime = 0
  702.        idle_timeout = 30
  703.   }
  704. }
  705. listen {
  706.        type = "acct"
  707.        ipv6addr = ::
  708.        port = 0
  709.   limit {
  710.        max_connections = 16
  711.        lifetime = 0
  712.        idle_timeout = 30
  713.   }
  714. }
  715. Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel
  716. Listening on auth address * port 1812 bound to server default
  717. Listening on acct address * port 1813 bound to server default
  718. Listening on auth address :: port 1812 bound to server default
  719. Listening on acct address :: port 1813 bound to server default
  720. Listening on proxy address * port 46526
  721. Listening on proxy address :: port 48745
  722. Ready to process requests
  723. (0) Received Access-Request Id 22 from 192.168.5.2:46518 to 192.168.51.10:1812 length 228
  724. (0)   Service-Type = Framed-User
  725. (0)   Framed-MTU = 1400
  726. (0)   User-Name = "rixis"
  727. (0)   NAS-Port-Id = "WiFi"
  728. (0)   NAS-Port-Type = Wireless-802.11
  729. (0)   Acct-Session-Id = "8200006b"
  730. (0)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  731. (0)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  732. (0)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  733. (0)   EAP-Message = 0x0200000a017269786973
  734. (0)   Message-Authenticator = 0x0fe62b37a8f1e76d745ebeaa2ae98074
  735. (0)   NAS-Identifier = "RiXiS-router-2"
  736. (0)   NAS-IP-Address = 192.168.5.2
  737. (0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  738. (0)   authorize {
  739. (0) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  740. (0) php: Program returned code (0) and output 'Auth-Type := Accept'
  741. (0) php: Program executed successfully
  742. (0)     [php] = ok
  743. (0)     [preprocess] = ok
  744. (0)     [chap] = noop
  745. (0)     [mschap] = noop
  746. (0)     [digest] = noop
  747. (0) suffix: Checking for suffix after "@"
  748. (0) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  749. (0) suffix: No such realm "NULL"
  750. (0)     [suffix] = noop
  751. (0) eap: Peer sent EAP Response (code 2) ID 0 length 10
  752. (0) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
  753. (0)     [eap] = ok
  754. (0)   } # authorize = ok
  755. (0) Found Auth-Type = eap
  756. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  757. (0)   authenticate {
  758. (0) eap: Peer sent packet with method EAP Identity (1)
  759. (0) eap: Calling submodule eap_md5 to process data
  760. (0) eap_md5: Issuing MD5 Challenge
  761. (0) eap: Sending EAP Request (code 1) ID 1 length 22
  762. (0) eap: EAP session adding &reply:State = 0x2b4725772b4621fb
  763. (0)     [eap] = handled
  764. (0)   } # authenticate = handled
  765. (0) Using Post-Auth-Type Challenge
  766. (0) Post-Auth-Type sub-section not found.  Ignoring.
  767. (0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  768. (0) Sent Access-Challenge Id 22 from 192.168.51.10:1812 to 192.168.5.2:46518 length 0
  769. (0)   EAP-Message = 0x010100160410344c56e5f621bb2ba67cefc9f2e01a50
  770. (0)   Message-Authenticator = 0x00000000000000000000000000000000
  771. (0)   State = 0x2b4725772b4621fb7618fb051bae6e71
  772. (0) Finished request
  773. Waking up in 4.9 seconds.
  774. (1) Received Access-Request Id 23 from 192.168.5.2:47408 to 192.168.51.10:1812 length 242
  775. (1)   Service-Type = Framed-User
  776. (1)   Framed-MTU = 1400
  777. (1)   User-Name = "rixis"
  778. (1)   State = 0x2b4725772b4621fb7618fb051bae6e71
  779. (1)   NAS-Port-Id = "WiFi"
  780. (1)   NAS-Port-Type = Wireless-802.11
  781. (1)   Acct-Session-Id = "8200006b"
  782. (1)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  783. (1)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  784. (1)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  785. (1)   EAP-Message = 0x020100060319
  786. (1)   Message-Authenticator = 0x11ff1c1545804b1db4443a04537569c1
  787. (1)   NAS-Identifier = "RiXiS-router-2"
  788. (1)   NAS-IP-Address = 192.168.5.2
  789. (1) session-state: No cached attributes
  790. (1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  791. (1)   authorize {
  792. (1) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  793. (1) php: Program returned code (0) and output 'Auth-Type := Accept'
  794. (1) php: Program executed successfully
  795. (1)     [php] = ok
  796. (1)     [preprocess] = ok
  797. (1)     [chap] = noop
  798. (1)     [mschap] = noop
  799. (1)     [digest] = noop
  800. (1) suffix: Checking for suffix after "@"
  801. (1) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  802. (1) suffix: No such realm "NULL"
  803. (1)     [suffix] = noop
  804. (1) eap: Peer sent EAP Response (code 2) ID 1 length 6
  805. (1) eap: No EAP Start, assuming it's an on-going EAP conversation
  806. (1)     [eap] = updated
  807. (1)     [files] = noop
  808. (1)     [expiration] = noop
  809. (1)     [logintime] = noop
  810. (1) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type
  811. (1) pap: WARNING: Authentication will fail unless a "known good" password is available
  812. (1)     [pap] = noop
  813. (1)   } # authorize = updated
  814. (1) Found Auth-Type = eap
  815. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  816. (1)   authenticate {
  817. (1) eap: Expiring EAP session with state 0x2b4725772b4621fb
  818. (1) eap: Finished EAP session with state 0x2b4725772b4621fb
  819. (1) eap: Previous EAP request found for state 0x2b4725772b4621fb, released from the list
  820. (1) eap: Peer sent packet with method EAP NAK (3)
  821. (1) eap: Found mutually acceptable type PEAP (25)
  822. (1) eap: Calling submodule eap_peap to process data
  823. (1) eap_peap: Initiating new EAP-TLS session
  824. (1) eap_peap: [eaptls start] = request
  825. (1) eap: Sending EAP Request (code 1) ID 2 length 6
  826. (1) eap: EAP session adding &reply:State = 0x2b4725772a453cfb
  827. (1)     [eap] = handled
  828. (1)   } # authenticate = handled
  829. (1) Using Post-Auth-Type Challenge
  830. (1) Post-Auth-Type sub-section not found.  Ignoring.
  831. (1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  832. (1) Sent Access-Challenge Id 23 from 192.168.51.10:1812 to 192.168.5.2:47408 length 0
  833. (1)   EAP-Message = 0x010200061920
  834. (1)   Message-Authenticator = 0x00000000000000000000000000000000
  835. (1)   State = 0x2b4725772a453cfb7618fb051bae6e71
  836. (1) Finished request
  837. Waking up in 4.9 seconds.
  838. (2) Received Access-Request Id 24 from 192.168.5.2:37790 to 192.168.51.10:1812 length 411
  839. (2)   Service-Type = Framed-User
  840. (2)   Framed-MTU = 1400
  841. (2)   User-Name = "rixis"
  842. (2)   State = 0x2b4725772a453cfb7618fb051bae6e71
  843. (2)   NAS-Port-Id = "WiFi"
  844. (2)   NAS-Port-Type = Wireless-802.11
  845. (2)   Acct-Session-Id = "8200006b"
  846. (2)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  847. (2)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  848. (2)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  849. (2)   EAP-Message = 0x020200af1980000000a516030100a00100009c0303a6f14a37fc1380f0f2b8a166b7535172b6677b05050aee1fdaaa40c25063b04800003ec02cc030009fc02bc02f009ecca9cca8c00ac024c014c0280039006bc009c023c013c02700330067c007c011009d009c0035003d002f003c00050004000a01
  850. (2)   Message-Authenticator = 0xbf25aafc4288c32edd730563c8114be5
  851. (2)   NAS-Identifier = "RiXiS-router-2"
  852. (2)   NAS-IP-Address = 192.168.5.2
  853. (2) session-state: No cached attributes
  854. (2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  855. (2)   authorize {
  856. (2) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  857. (2) php: Program returned code (0) and output 'Auth-Type := Accept'
  858. (2) php: Program executed successfully
  859. (2)     [php] = ok
  860. (2)     [preprocess] = ok
  861. (2)     [chap] = noop
  862. (2)     [mschap] = noop
  863. (2)     [digest] = noop
  864. (2) suffix: Checking for suffix after "@"
  865. (2) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  866. (2) suffix: No such realm "NULL"
  867. (2)     [suffix] = noop
  868. (2) eap: Peer sent EAP Response (code 2) ID 2 length 175
  869. (2) eap: Continuing tunnel setup
  870. (2)     [eap] = ok
  871. (2)   } # authorize = ok
  872. (2) Found Auth-Type = eap
  873. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  874. (2)   authenticate {
  875. (2) eap: Expiring EAP session with state 0x2b4725772a453cfb
  876. (2) eap: Finished EAP session with state 0x2b4725772a453cfb
  877. (2) eap: Previous EAP request found for state 0x2b4725772a453cfb, released from the list
  878. (2) eap: Peer sent packet with method EAP PEAP (25)
  879. (2) eap: Calling submodule eap_peap to process data
  880. (2) eap_peap: Continuing EAP-TLS
  881. (2) eap_peap: Peer indicated complete TLS record size will be 165 bytes
  882. (2) eap_peap: Got complete TLS record (165 bytes)
  883. (2) eap_peap: [eaptls verify] = length included
  884. (2) eap_peap: (other): before SSL initialization
  885. (2) eap_peap: TLS_accept: before SSL initialization
  886. (2) eap_peap: TLS_accept: before SSL initialization
  887. (2) eap_peap: <<< recv TLS 1.2  [length 00a0]
  888. (2) eap_peap: TLS_accept: SSLv3/TLS read client hello
  889. (2) eap_peap: >>> send TLS 1.2  [length 003d]
  890. (2) eap_peap: TLS_accept: SSLv3/TLS write server hello
  891. (2) eap_peap: >>> send TLS 1.2  [length 02fd]
  892. (2) eap_peap: TLS_accept: SSLv3/TLS write certificate
  893. (2) eap_peap: >>> send TLS 1.2  [length 014d]
  894. (2) eap_peap: TLS_accept: SSLv3/TLS write key exchange
  895. (2) eap_peap: >>> send TLS 1.2  [length 0004]
  896. (2) eap_peap: TLS_accept: SSLv3/TLS write server done
  897. (2) eap_peap: TLS_accept: Need to read more data: SSLv3/TLS write server done
  898. (2) eap_peap: In SSL Handshake Phase
  899. (2) eap_peap: In SSL Accept mode
  900. (2) eap_peap: [eaptls process] = handled
  901. (2) eap: Sending EAP Request (code 1) ID 3 length 1004
  902. (2) eap: EAP session adding &reply:State = 0x2b47257729443cfb
  903. (2)     [eap] = handled
  904. (2)   } # authenticate = handled
  905. (2) Using Post-Auth-Type Challenge
  906. (2) Post-Auth-Type sub-section not found.  Ignoring.
  907. (2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  908. (2) Sent Access-Challenge Id 24 from 192.168.51.10:1812 to 192.168.5.2:37790 length 0
  909. (2)   EAP-Message = 0x010303ec19c00000049f160303003d020000390303e4eb316a4837fa7ba73297a73e9b55f40d3f05a5494006b8dd4b6a9e4e43d20500c030000011ff01000100000b0004030001020017000016030302fd0b0002f90002f60002f3308202ef308201d7a003020102020900ae326caca5096944300d0609
  910. (2)   Message-Authenticator = 0x00000000000000000000000000000000
  911. (2)   State = 0x2b47257729443cfb7618fb051bae6e71
  912. (2) Finished request
  913. Waking up in 4.8 seconds.
  914. (3) Received Access-Request Id 25 from 192.168.5.2:33963 to 192.168.51.10:1812 length 242
  915. (3)   Service-Type = Framed-User
  916. (3)   Framed-MTU = 1400
  917. (3)   User-Name = "rixis"
  918. (3)   State = 0x2b47257729443cfb7618fb051bae6e71
  919. (3)   NAS-Port-Id = "WiFi"
  920. (3)   NAS-Port-Type = Wireless-802.11
  921. (3)   Acct-Session-Id = "8200006b"
  922. (3)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  923. (3)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  924. (3)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  925. (3)   EAP-Message = 0x020300061900
  926. (3)   Message-Authenticator = 0xca03b869961c6f17dcea5d408932fc99
  927. (3)   NAS-Identifier = "RiXiS-router-2"
  928. (3)   NAS-IP-Address = 192.168.5.2
  929. (3) session-state: No cached attributes
  930. (3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  931. (3)   authorize {
  932. (3) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  933. (3) php: Program returned code (0) and output 'Auth-Type := Accept'
  934. (3) php: Program executed successfully
  935. (3)     [php] = ok
  936. (3)     [preprocess] = ok
  937. (3)     [chap] = noop
  938. (3)     [mschap] = noop
  939. (3)     [digest] = noop
  940. (3) suffix: Checking for suffix after "@"
  941. (3) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  942. (3) suffix: No such realm "NULL"
  943. (3)     [suffix] = noop
  944. (3) eap: Peer sent EAP Response (code 2) ID 3 length 6
  945. (3) eap: Continuing tunnel setup
  946. (3)     [eap] = ok
  947. (3)   } # authorize = ok
  948. (3) Found Auth-Type = eap
  949. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  950. (3)   authenticate {
  951. (3) eap: Expiring EAP session with state 0x2b47257729443cfb
  952. (3) eap: Finished EAP session with state 0x2b47257729443cfb
  953. (3) eap: Previous EAP request found for state 0x2b47257729443cfb, released from the list
  954. (3) eap: Peer sent packet with method EAP PEAP (25)
  955. (3) eap: Calling submodule eap_peap to process data
  956. (3) eap_peap: Continuing EAP-TLS
  957. (3) eap_peap: Peer ACKed our handshake fragment
  958. (3) eap_peap: [eaptls verify] = request
  959. (3) eap_peap: [eaptls process] = handled
  960. (3) eap: Sending EAP Request (code 1) ID 4 length 195
  961. (3) eap: EAP session adding &reply:State = 0x2b47257728433cfb
  962. (3)     [eap] = handled
  963. (3)   } # authenticate = handled
  964. (3) Using Post-Auth-Type Challenge
  965. (3) Post-Auth-Type sub-section not found.  Ignoring.
  966. (3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  967. (3) Sent Access-Challenge Id 25 from 192.168.51.10:1812 to 192.168.5.2:33963 length 0
  968. (3)   EAP-Message = 0x010400c31900a8bfbdb3b81aeb6071aa5458468cc6384698fe39e3ee747c40f557d01ee9f841f2263a6a0e1b9928c9b52404527686f078e169c57f840557f58c771e58cf49bcbe0f1d584b00e16b7064ae337ab40c2eda290f269bda4a1fd423ba2585cc0ce740a975b6b1ed1732cf8567277d3e0ff80c
  969. (3)   Message-Authenticator = 0x00000000000000000000000000000000
  970. (3)   State = 0x2b47257728433cfb7618fb051bae6e71
  971. (3) Finished request
  972. Waking up in 4.8 seconds.
  973. (4) Received Access-Request Id 26 from 192.168.5.2:54934 to 192.168.51.10:1812 length 372
  974. (4)   Service-Type = Framed-User
  975. (4)   Framed-MTU = 1400
  976. (4)   User-Name = "rixis"
  977. (4)   State = 0x2b47257728433cfb7618fb051bae6e71
  978. (4)   NAS-Port-Id = "WiFi"
  979. (4)   NAS-Port-Type = Wireless-802.11
  980. (4)   Acct-Session-Id = "8200006b"
  981. (4)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  982. (4)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  983. (4)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  984. (4)   EAP-Message = 0x0204008819800000007e1603030046100000424104e13d0e86bb1a791d4caf6811318490158b25d91776af1ef60c951c6e4676ac9c92609ac5d72796f3583a5fdf058f8b5e5ee7d36b5c80a4c3a9c713f56ba4523e140303000101160303002800000000000000001c7661aecca0bdf6b826d7daad9a9b
  985. (4)   Message-Authenticator = 0x20d8f2b5796bfa409895ee4c9b897ff9
  986. (4)   NAS-Identifier = "RiXiS-router-2"
  987. (4)   NAS-IP-Address = 192.168.5.2
  988. (4) session-state: No cached attributes
  989. (4) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  990. (4)   authorize {
  991. (4) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  992. (4) php: Program returned code (0) and output 'Auth-Type := Accept'
  993. (4) php: Program executed successfully
  994. (4)     [php] = ok
  995. (4)     [preprocess] = ok
  996. (4)     [chap] = noop
  997. (4)     [mschap] = noop
  998. (4)     [digest] = noop
  999. (4) suffix: Checking for suffix after "@"
  1000. (4) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1001. (4) suffix: No such realm "NULL"
  1002. (4)     [suffix] = noop
  1003. (4) eap: Peer sent EAP Response (code 2) ID 4 length 136
  1004. (4) eap: Continuing tunnel setup
  1005. (4)     [eap] = ok
  1006. (4)   } # authorize = ok
  1007. (4) Found Auth-Type = eap
  1008. (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1009. (4)   authenticate {
  1010. (4) eap: Expiring EAP session with state 0x2b47257728433cfb
  1011. (4) eap: Finished EAP session with state 0x2b47257728433cfb
  1012. (4) eap: Previous EAP request found for state 0x2b47257728433cfb, released from the list
  1013. (4) eap: Peer sent packet with method EAP PEAP (25)
  1014. (4) eap: Calling submodule eap_peap to process data
  1015. (4) eap_peap: Continuing EAP-TLS
  1016. (4) eap_peap: Peer indicated complete TLS record size will be 126 bytes
  1017. (4) eap_peap: Got complete TLS record (126 bytes)
  1018. (4) eap_peap: [eaptls verify] = length included
  1019. (4) eap_peap: TLS_accept: SSLv3/TLS write server done
  1020. (4) eap_peap: <<< recv TLS 1.2  [length 0046]
  1021. (4) eap_peap: TLS_accept: SSLv3/TLS read client key exchange
  1022. (4) eap_peap: TLS_accept: SSLv3/TLS read change cipher spec
  1023. (4) eap_peap: <<< recv TLS 1.2  [length 0010]
  1024. (4) eap_peap: TLS_accept: SSLv3/TLS read finished
  1025. (4) eap_peap: >>> send TLS 1.2  [length 0001]
  1026. (4) eap_peap: TLS_accept: SSLv3/TLS write change cipher spec
  1027. (4) eap_peap: >>> send TLS 1.2  [length 0010]
  1028. (4) eap_peap: TLS_accept: SSLv3/TLS write finished
  1029. (4) eap_peap: (other): SSL negotiation finished successfully
  1030. (4) eap_peap: SSL Connection Established
  1031. (4) eap_peap: [eaptls process] = handled
  1032. (4) eap: Sending EAP Request (code 1) ID 5 length 57
  1033. (4) eap: EAP session adding &reply:State = 0x2b4725772f423cfb
  1034. (4)     [eap] = handled
  1035. (4)   } # authenticate = handled
  1036. (4) Using Post-Auth-Type Challenge
  1037. (4) Post-Auth-Type sub-section not found.  Ignoring.
  1038. (4) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1039. (4) Sent Access-Challenge Id 26 from 192.168.51.10:1812 to 192.168.5.2:54934 length 0
  1040. (4)   EAP-Message = 0x0105003919001403030001011603030028acf161cd3b212f3491f15c0c8ab6731a72083715a5edadf14ecfa0ee4ecc9262ba6d54d615a497e1
  1041. (4)   Message-Authenticator = 0x00000000000000000000000000000000
  1042. (4)   State = 0x2b4725772f423cfb7618fb051bae6e71
  1043. (4) Finished request
  1044. Waking up in 4.7 seconds.
  1045. (5) Received Access-Request Id 27 from 192.168.5.2:49585 to 192.168.51.10:1812 length 242
  1046. (5)   Service-Type = Framed-User
  1047. (5)   Framed-MTU = 1400
  1048. (5)   User-Name = "rixis"
  1049. (5)   State = 0x2b4725772f423cfb7618fb051bae6e71
  1050. (5)   NAS-Port-Id = "WiFi"
  1051. (5)   NAS-Port-Type = Wireless-802.11
  1052. (5)   Acct-Session-Id = "8200006b"
  1053. (5)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  1054. (5)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  1055. (5)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  1056. (5)   EAP-Message = 0x020500061900
  1057. (5)   Message-Authenticator = 0xc73e61bd56d22e7c9b292a6c75481f47
  1058. (5)   NAS-Identifier = "RiXiS-router-2"
  1059. (5)   NAS-IP-Address = 192.168.5.2
  1060. (5) session-state: No cached attributes
  1061. (5) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  1062. (5)   authorize {
  1063. (5) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  1064. (5) php: Program returned code (0) and output 'Auth-Type := Accept'
  1065. (5) php: Program executed successfully
  1066. (5)     [php] = ok
  1067. (5)     [preprocess] = ok
  1068. (5)     [chap] = noop
  1069. (5)     [mschap] = noop
  1070. (5)     [digest] = noop
  1071. (5) suffix: Checking for suffix after "@"
  1072. (5) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1073. (5) suffix: No such realm "NULL"
  1074. (5)     [suffix] = noop
  1075. (5) eap: Peer sent EAP Response (code 2) ID 5 length 6
  1076. (5) eap: Continuing tunnel setup
  1077. (5)     [eap] = ok
  1078. (5)   } # authorize = ok
  1079. (5) Found Auth-Type = eap
  1080. (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1081. (5)   authenticate {
  1082. (5) eap: Expiring EAP session with state 0x2b4725772f423cfb
  1083. (5) eap: Finished EAP session with state 0x2b4725772f423cfb
  1084. (5) eap: Previous EAP request found for state 0x2b4725772f423cfb, released from the list
  1085. (5) eap: Peer sent packet with method EAP PEAP (25)
  1086. (5) eap: Calling submodule eap_peap to process data
  1087. (5) eap_peap: Continuing EAP-TLS
  1088. (5) eap_peap: Peer ACKed our handshake fragment.  handshake is finished
  1089. (5) eap_peap: [eaptls verify] = success
  1090. (5) eap_peap: [eaptls process] = success
  1091. (5) eap_peap: Session established.  Decoding tunneled attributes
  1092. (5) eap_peap: PEAP state TUNNEL ESTABLISHED
  1093. (5) eap: Sending EAP Request (code 1) ID 6 length 40
  1094. (5) eap: EAP session adding &reply:State = 0x2b4725772e413cfb
  1095. (5)     [eap] = handled
  1096. (5)   } # authenticate = handled
  1097. (5) Using Post-Auth-Type Challenge
  1098. (5) Post-Auth-Type sub-section not found.  Ignoring.
  1099. (5) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1100. (5) Sent Access-Challenge Id 27 from 192.168.51.10:1812 to 192.168.5.2:49585 length 0
  1101. (5)   EAP-Message = 0x010600281900170303001dacf161cd3b212f354edd3482aef02edb71b8bac7eebddb918b0f9e7c32
  1102. (5)   Message-Authenticator = 0x00000000000000000000000000000000
  1103. (5)   State = 0x2b4725772e413cfb7618fb051bae6e71
  1104. (5) Finished request
  1105. Waking up in 4.6 seconds.
  1106. (6) Received Access-Request Id 28 from 192.168.5.2:54117 to 192.168.51.10:1812 length 277
  1107. (6)   Service-Type = Framed-User
  1108. (6)   Framed-MTU = 1400
  1109. (6)   User-Name = "rixis"
  1110. (6)   State = 0x2b4725772e413cfb7618fb051bae6e71
  1111. (6)   NAS-Port-Id = "WiFi"
  1112. (6)   NAS-Port-Type = Wireless-802.11
  1113. (6)   Acct-Session-Id = "8200006b"
  1114. (6)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  1115. (6)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  1116. (6)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  1117. (6)   EAP-Message = 0x020600291900170303001e0000000000000001dd30c3c8dc04261df1eea2944d430e0b0f8c80918d15
  1118. (6)   Message-Authenticator = 0x1b32cdfd104c54036b9457f8baeeae8d
  1119. (6)   NAS-Identifier = "RiXiS-router-2"
  1120. (6)   NAS-IP-Address = 192.168.5.2
  1121. (6) session-state: No cached attributes
  1122. (6) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  1123. (6)   authorize {
  1124. (6) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  1125. (6) php: Program returned code (0) and output 'Auth-Type := Accept'
  1126. (6) php: Program executed successfully
  1127. (6)     [php] = ok
  1128. (6)     [preprocess] = ok
  1129. (6)     [chap] = noop
  1130. (6)     [mschap] = noop
  1131. (6)     [digest] = noop
  1132. (6) suffix: Checking for suffix after "@"
  1133. (6) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1134. (6) suffix: No such realm "NULL"
  1135. (6)     [suffix] = noop
  1136. (6) eap: Peer sent EAP Response (code 2) ID 6 length 41
  1137. (6) eap: Continuing tunnel setup
  1138. (6)     [eap] = ok
  1139. (6)   } # authorize = ok
  1140. (6) Found Auth-Type = eap
  1141. (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1142. (6)   authenticate {
  1143. (6) eap: Expiring EAP session with state 0x2b4725772e413cfb
  1144. (6) eap: Finished EAP session with state 0x2b4725772e413cfb
  1145. (6) eap: Previous EAP request found for state 0x2b4725772e413cfb, released from the list
  1146. (6) eap: Peer sent packet with method EAP PEAP (25)
  1147. (6) eap: Calling submodule eap_peap to process data
  1148. (6) eap_peap: Continuing EAP-TLS
  1149. (6) eap_peap: [eaptls verify] = ok
  1150. (6) eap_peap: Done initial handshake
  1151. (6) eap_peap: [eaptls process] = ok
  1152. (6) eap_peap: Session established.  Decoding tunneled attributes
  1153. (6) eap_peap: PEAP state WAITING FOR INNER IDENTITY
  1154. (6) eap_peap: Identity - rixis
  1155. (6) eap_peap: Got inner identity 'rixis'
  1156. (6) eap_peap: Setting default EAP type for tunneled EAP session
  1157. (6) eap_peap: Got tunneled request
  1158. (6) eap_peap:   EAP-Message = 0x0206000a017269786973
  1159. (6) eap_peap: Setting User-Name to rixis
  1160. (6) eap_peap: Sending tunneled request to inner-tunnel
  1161. (6) eap_peap:   EAP-Message = 0x0206000a017269786973
  1162. (6) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
  1163. (6) eap_peap:   User-Name = "rixis"
  1164. (6) Virtual server inner-tunnel received request
  1165. (6)   EAP-Message = 0x0206000a017269786973
  1166. (6)   FreeRADIUS-Proxied-To = 127.0.0.1
  1167. (6)   User-Name = "rixis"
  1168. (6) WARNING: Outer and inner identities are the same.  User privacy is compromised.
  1169. (6) server inner-tunnel {
  1170. (6)   # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  1171. (6)     authorize {
  1172. (6)       policy filter_username {
  1173. (6)         if (&User-Name) {
  1174. (6)         if (&User-Name)  -> TRUE
  1175. (6)         if (&User-Name)  {
  1176. (6)           if (&User-Name =~ / /) {
  1177. (6)           if (&User-Name =~ / /)  -> FALSE
  1178. (6)           if (&User-Name =~ /@[^@]*@/ ) {
  1179. (6)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
  1180. (6)           if (&User-Name =~ /\.\./ ) {
  1181. (6)           if (&User-Name =~ /\.\./ )  -> FALSE
  1182. (6)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
  1183. (6)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
  1184. (6)           if (&User-Name =~ /\.$/)  {
  1185. (6)           if (&User-Name =~ /\.$/)   -> FALSE
  1186. (6)           if (&User-Name =~ /@\./)  {
  1187. (6)           if (&User-Name =~ /@\./)   -> FALSE
  1188. (6)         } # if (&User-Name)  = notfound
  1189. (6)       } # policy filter_username = notfound
  1190. (6)       [chap] = noop
  1191. (6)       [mschap] = noop
  1192. (6) suffix: Checking for suffix after "@"
  1193. (6) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1194. (6) suffix: No such realm "NULL"
  1195. (6)       [suffix] = noop
  1196. (6)       update control {
  1197. (6)         &Proxy-To-Realm := LOCAL
  1198. (6)       } # update control = noop
  1199. (6) eap: Peer sent EAP Response (code 2) ID 6 length 10
  1200. (6) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize
  1201. (6)       [eap] = ok
  1202. (6)     } # authorize = ok
  1203. (6)   Found Auth-Type = eap
  1204. (6)   # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  1205. (6)     authenticate {
  1206. (6) eap: Peer sent packet with method EAP Identity (1)
  1207. (6) eap: Calling submodule eap_mschapv2 to process data
  1208. (6) eap_mschapv2: Issuing Challenge
  1209. (6) eap: Sending EAP Request (code 1) ID 7 length 43
  1210. (6) eap: EAP session adding &reply:State = 0x75c42a0975c33084
  1211. (6)       [eap] = handled
  1212. (6)     } # authenticate = handled
  1213. (6) } # server inner-tunnel
  1214. (6) Virtual server sending reply
  1215. (6)   EAP-Message = 0x0107002b1a010700261061d46caf23abb36418e595f81f5e3098667265657261646975732d332e302e3132
  1216. (6)   Message-Authenticator = 0x00000000000000000000000000000000
  1217. (6)   State = 0x75c42a0975c330842acce0a9f40751d5
  1218. (6) eap_peap: Got tunneled reply code 11
  1219. (6) eap_peap:   EAP-Message = 0x0107002b1a010700261061d46caf23abb36418e595f81f5e3098667265657261646975732d332e302e3132
  1220. (6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
  1221. (6) eap_peap:   State = 0x75c42a0975c330842acce0a9f40751d5
  1222. (6) eap_peap: Got tunneled reply RADIUS code 11
  1223. (6) eap_peap:   EAP-Message = 0x0107002b1a010700261061d46caf23abb36418e595f81f5e3098667265657261646975732d332e302e3132
  1224. (6) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
  1225. (6) eap_peap:   State = 0x75c42a0975c330842acce0a9f40751d5
  1226. (6) eap_peap: Got tunneled Access-Challenge
  1227. (6) eap: Sending EAP Request (code 1) ID 7 length 74
  1228. (6) eap: EAP session adding &reply:State = 0x2b4725772d403cfb
  1229. (6)     [eap] = handled
  1230. (6)   } # authenticate = handled
  1231. (6) Using Post-Auth-Type Challenge
  1232. (6) Post-Auth-Type sub-section not found.  Ignoring.
  1233. (6) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1234. (6) Sent Access-Challenge Id 28 from 192.168.51.10:1812 to 192.168.5.2:54117 length 0
  1235. (6)   EAP-Message = 0x0107004a1900170303003facf161cd3b212f3643b44b11b95833d65af70771a92561749e18522e737bffb69e14a80837aa587f78870fce8049b0d0db0d35e9f3c89b6e963345cbcce706
  1236. (6)   Message-Authenticator = 0x00000000000000000000000000000000
  1237. (6)   State = 0x2b4725772d403cfb7618fb051bae6e71
  1238. (6) Finished request
  1239. Waking up in 4.6 seconds.
  1240. (7) Received Access-Request Id 29 from 192.168.5.2:51836 to 192.168.51.10:1812 length 331
  1241. (7)   Service-Type = Framed-User
  1242. (7)   Framed-MTU = 1400
  1243. (7)   User-Name = "rixis"
  1244. (7)   State = 0x2b4725772d403cfb7618fb051bae6e71
  1245. (7)   NAS-Port-Id = "WiFi"
  1246. (7)   NAS-Port-Type = Wireless-802.11
  1247. (7)   Acct-Session-Id = "8200006b"
  1248. (7)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  1249. (7)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  1250. (7)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  1251. (7)   EAP-Message = 0x0207005f190017030300540000000000000002854bbf8ca47469561c741183338eb02ab73f781e658bd389272d6d0daf2ce7902ca2679ae0cf43105a291d1226d5316ec28ad6aae53932aab7d324abe735589ee1646c5bf859422b6b4e97ce
  1252. (7)   Message-Authenticator = 0x76856384844065a020670cc398835a99
  1253. (7)   NAS-Identifier = "RiXiS-router-2"
  1254. (7)   NAS-IP-Address = 192.168.5.2
  1255. (7) session-state: No cached attributes
  1256. (7) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  1257. (7)   authorize {
  1258. (7) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  1259. (7) php: Program returned code (0) and output 'Auth-Type := Accept'
  1260. (7) php: Program executed successfully
  1261. (7)     [php] = ok
  1262. (7)     [preprocess] = ok
  1263. (7)     [chap] = noop
  1264. (7)     [mschap] = noop
  1265. (7)     [digest] = noop
  1266. (7) suffix: Checking for suffix after "@"
  1267. (7) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1268. (7) suffix: No such realm "NULL"
  1269. (7)     [suffix] = noop
  1270. (7) eap: Peer sent EAP Response (code 2) ID 7 length 95
  1271. (7) eap: Continuing tunnel setup
  1272. (7)     [eap] = ok
  1273. (7)   } # authorize = ok
  1274. (7) Found Auth-Type = eap
  1275. (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1276. (7)   authenticate {
  1277. (7) eap: Expiring EAP session with state 0x75c42a0975c33084
  1278. (7) eap: Finished EAP session with state 0x2b4725772d403cfb
  1279. (7) eap: Previous EAP request found for state 0x2b4725772d403cfb, released from the list
  1280. (7) eap: Peer sent packet with method EAP PEAP (25)
  1281. (7) eap: Calling submodule eap_peap to process data
  1282. (7) eap_peap: Continuing EAP-TLS
  1283. (7) eap_peap: [eaptls verify] = ok
  1284. (7) eap_peap: Done initial handshake
  1285. (7) eap_peap: [eaptls process] = ok
  1286. (7) eap_peap: Session established.  Decoding tunneled attributes
  1287. (7) eap_peap: PEAP state phase2
  1288. (7) eap_peap: EAP method MSCHAPv2 (26)
  1289. (7) eap_peap: Got tunneled request
  1290. (7) eap_peap:   EAP-Message = 0x020700401a0207003b311487501ec4586c5756ba432e6a4c50170000000000000000b5c7e232a462e3fefe3e24c1c992209663e361642418d89d007269786973
  1291. (7) eap_peap: Setting User-Name to rixis
  1292. (7) eap_peap: Sending tunneled request to inner-tunnel
  1293. (7) eap_peap:   EAP-Message = 0x020700401a0207003b311487501ec4586c5756ba432e6a4c50170000000000000000b5c7e232a462e3fefe3e24c1c992209663e361642418d89d007269786973
  1294. (7) eap_peap:   FreeRADIUS-Proxied-To = 127.0.0.1
  1295. (7) eap_peap:   User-Name = "rixis"
  1296. (7) eap_peap:   State = 0x75c42a0975c330842acce0a9f40751d5
  1297. (7) Virtual server inner-tunnel received request
  1298. (7)   EAP-Message = 0x020700401a0207003b311487501ec4586c5756ba432e6a4c50170000000000000000b5c7e232a462e3fefe3e24c1c992209663e361642418d89d007269786973
  1299. (7)   FreeRADIUS-Proxied-To = 127.0.0.1
  1300. (7)   User-Name = "rixis"
  1301. (7)   State = 0x75c42a0975c330842acce0a9f40751d5
  1302. (7) WARNING: Outer and inner identities are the same.  User privacy is compromised.
  1303. (7) server inner-tunnel {
  1304. (7)   session-state: No cached attributes
  1305. (7)   # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  1306. (7)     authorize {
  1307. (7)       policy filter_username {
  1308. (7)         if (&User-Name) {
  1309. (7)         if (&User-Name)  -> TRUE
  1310. (7)         if (&User-Name)  {
  1311. (7)           if (&User-Name =~ / /) {
  1312. (7)           if (&User-Name =~ / /)  -> FALSE
  1313. (7)           if (&User-Name =~ /@[^@]*@/ ) {
  1314. (7)           if (&User-Name =~ /@[^@]*@/ )  -> FALSE
  1315. (7)           if (&User-Name =~ /\.\./ ) {
  1316. (7)           if (&User-Name =~ /\.\./ )  -> FALSE
  1317. (7)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
  1318. (7)           if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
  1319. (7)           if (&User-Name =~ /\.$/)  {
  1320. (7)           if (&User-Name =~ /\.$/)   -> FALSE
  1321. (7)           if (&User-Name =~ /@\./)  {
  1322. (7)           if (&User-Name =~ /@\./)   -> FALSE
  1323. (7)         } # if (&User-Name)  = notfound
  1324. (7)       } # policy filter_username = notfound
  1325. (7)       [chap] = noop
  1326. (7)       [mschap] = noop
  1327. (7) suffix: Checking for suffix after "@"
  1328. (7) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1329. (7) suffix: No such realm "NULL"
  1330. (7)       [suffix] = noop
  1331. (7)       update control {
  1332. (7)         &Proxy-To-Realm := LOCAL
  1333. (7)       } # update control = noop
  1334. (7) eap: Peer sent EAP Response (code 2) ID 7 length 64
  1335. (7) eap: No EAP Start, assuming it's an on-going EAP conversation
  1336. (7)       [eap] = updated
  1337. (7)       [files] = noop
  1338. (7)       [expiration] = noop
  1339. (7)       [logintime] = noop
  1340. (7)       [pap] = noop
  1341. (7)     } # authorize = updated
  1342. (7)   Found Auth-Type = eap
  1343. (7)   # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  1344. (7)     authenticate {
  1345. (7) eap: Expiring EAP session with state 0x75c42a0975c33084
  1346. (7) eap: Finished EAP session with state 0x75c42a0975c33084
  1347. (7) eap: Previous EAP request found for state 0x75c42a0975c33084, released from the list
  1348. (7) eap: Peer sent packet with method EAP MSCHAPv2 (26)
  1349. (7) eap: Calling submodule eap_mschapv2 to process data
  1350. (7) eap_mschapv2: # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  1351. (7) eap_mschapv2:   authenticate {
  1352. (7) mschap: WARNING: No Cleartext-Password configured.  Cannot create NT-Password
  1353. (7) mschap: WARNING: No Cleartext-Password configured.  Cannot create LM-Password
  1354. (7) mschap: Creating challenge hash with username: rixis
  1355. (7) mschap: Client is using MS-CHAPv2
  1356. (7) mschap: ERROR: FAILED: No NT/LM-Password.  Cannot perform authentication
  1357. (7) mschap: ERROR: MS-CHAP2-Response is incorrect
  1358. (7)     [mschap] = reject
  1359. (7)   } # authenticate = reject
  1360. (7) eap: Sending EAP Failure (code 4) ID 7 length 4
  1361. (7) eap: Freeing handler
  1362. (7)       [eap] = reject
  1363. (7)     } # authenticate = reject
  1364. (7)   Failed to authenticate the user
  1365. (7)   Using Post-Auth-Type Reject
  1366. (7)   # Executing group from file /etc/freeradius/3.0/sites-enabled/inner-tunnel
  1367. (7)     Post-Auth-Type REJECT {
  1368. (7) attr_filter.access_reject: EXPAND %{User-Name}
  1369. (7) attr_filter.access_reject:    --> rixis
  1370. (7) attr_filter.access_reject: Matched entry DEFAULT at line 11
  1371. (7)       [attr_filter.access_reject] = updated
  1372. (7)       update outer.session-state {
  1373. (7)         &Module-Failure-Message := &request:Module-Failure-Message -> 'mschap: FAILED: No NT/LM-Password.  Cannot perform authentication'
  1374. (7)       } # update outer.session-state = noop
  1375. (7)     } # Post-Auth-Type REJECT = updated
  1376. (7) } # server inner-tunnel
  1377. (7) Virtual server sending reply
  1378. (7)   MS-CHAP-Error = "\007E=691 R=1 C=c60a9bf7889ab89343c9f5ed43fe4042 V=3 M=Authentication failed"
  1379. (7)   EAP-Message = 0x04070004
  1380. (7)   Message-Authenticator = 0x00000000000000000000000000000000
  1381. (7) eap_peap: Got tunneled reply code 3
  1382. (7) eap_peap:   MS-CHAP-Error = "\007E=691 R=1 C=c60a9bf7889ab89343c9f5ed43fe4042 V=3 M=Authentication failed"
  1383. (7) eap_peap:   EAP-Message = 0x04070004
  1384. (7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
  1385. (7) eap_peap: Got tunneled reply RADIUS code 3
  1386. (7) eap_peap:   MS-CHAP-Error = "\007E=691 R=1 C=c60a9bf7889ab89343c9f5ed43fe4042 V=3 M=Authentication failed"
  1387. (7) eap_peap:   EAP-Message = 0x04070004
  1388. (7) eap_peap:   Message-Authenticator = 0x00000000000000000000000000000000
  1389. (7) eap_peap: Tunneled authentication was rejected
  1390. (7) eap_peap: FAILURE
  1391. (7) eap: Sending EAP Request (code 1) ID 8 length 46
  1392. (7) eap: EAP session adding &reply:State = 0x2b4725772c4f3cfb
  1393. (7)     [eap] = handled
  1394. (7)   } # authenticate = handled
  1395. (7) Using Post-Auth-Type Challenge
  1396. (7) Post-Auth-Type sub-section not found.  Ignoring.
  1397. (7) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1398. (7) session-state: Saving cached attributes
  1399. (7)   Module-Failure-Message := "mschap: FAILED: No NT/LM-Password.  Cannot perform authentication"
  1400. (7) Sent Access-Challenge Id 29 from 192.168.51.10:1812 to 192.168.5.2:51836 length 0
  1401. (7)   EAP-Message = 0x0108002e19001703030023acf161cd3b212f37c7a327ddceb560b80346a64c872a8bbb088fbb92168f01c8247cc7
  1402. (7)   Message-Authenticator = 0x00000000000000000000000000000000
  1403. (7)   State = 0x2b4725772c4f3cfb7618fb051bae6e71
  1404. (7) Finished request
  1405. Waking up in 4.5 seconds.
  1406. (8) Received Access-Request Id 30 from 192.168.5.2:60054 to 192.168.51.10:1812 length 282
  1407. (8)   Service-Type = Framed-User
  1408. (8)   Framed-MTU = 1400
  1409. (8)   User-Name = "rixis"
  1410. (8)   State = 0x2b4725772c4f3cfb7618fb051bae6e71
  1411. (8)   NAS-Port-Id = "WiFi"
  1412. (8)   NAS-Port-Type = Wireless-802.11
  1413. (8)   Acct-Session-Id = "8200006b"
  1414. (8)   Acct-Multi-Session-Id = "4C-5E-0C-34-83-A3-EC-9B-F3-7B-A2-3F-82-00-00-00-00-00-00-58"
  1415. (8)   Calling-Station-Id = "EC-9B-F3-7B-A2-3F"
  1416. (8)   Called-Station-Id = "4C-5E-0C-34-83-A3:Kolovatoff WiFi"
  1417. (8)   EAP-Message = 0x0208002e190017030300230000000000000003ccb527572eb12b45715bb46c59592a7e6dba59c30b284fd3c5b892
  1418. (8)   Message-Authenticator = 0xac92d6643b4c85bf7693a9860e03912d
  1419. (8)   NAS-Identifier = "RiXiS-router-2"
  1420. (8)   NAS-IP-Address = 192.168.5.2
  1421. (8) Restoring &session-state
  1422. (8)   &session-state:Module-Failure-Message := "mschap: FAILED: No NT/LM-Password.  Cannot perform authentication"
  1423. (8) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
  1424. (8)   authorize {
  1425. (8) php: Executing: /usr/bin/php -f /etc/freeradius/3.0/kAPIauth.php:
  1426. (8) php: Program returned code (0) and output 'Auth-Type := Accept'
  1427. (8) php: Program executed successfully
  1428. (8)     [php] = ok
  1429. (8)     [preprocess] = ok
  1430. (8)     [chap] = noop
  1431. (8)     [mschap] = noop
  1432. (8)     [digest] = noop
  1433. (8) suffix: Checking for suffix after "@"
  1434. (8) suffix: No '@' in User-Name = "rixis", looking up realm NULL
  1435. (8) suffix: No such realm "NULL"
  1436. (8)     [suffix] = noop
  1437. (8) eap: Peer sent EAP Response (code 2) ID 8 length 46
  1438. (8) eap: Continuing tunnel setup
  1439. (8)     [eap] = ok
  1440. (8)   } # authorize = ok
  1441. (8) Found Auth-Type = eap
  1442. (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1443. (8)   authenticate {
  1444. (8) eap: Expiring EAP session with state 0x2b4725772c4f3cfb
  1445. (8) eap: Finished EAP session with state 0x2b4725772c4f3cfb
  1446. (8) eap: Previous EAP request found for state 0x2b4725772c4f3cfb, released from the list
  1447. (8) eap: Peer sent packet with method EAP PEAP (25)
  1448. (8) eap: Calling submodule eap_peap to process data
  1449. (8) eap_peap: Continuing EAP-TLS
  1450. (8) eap_peap: [eaptls verify] = ok
  1451. (8) eap_peap: Done initial handshake
  1452. (8) eap_peap: [eaptls process] = ok
  1453. (8) eap_peap: Session established.  Decoding tunneled attributes
  1454. (8) eap_peap: PEAP state send tlv failure
  1455. (8) eap_peap: Received EAP-TLV response
  1456. (8) eap_peap:   The users session was previously rejected: returning reject (again.)
  1457. (8) eap_peap:   This means you need to read the PREVIOUS messages in the debug output
  1458. (8) eap_peap:   to find out the reason why the user was rejected
  1459. (8) eap_peap:   Look for "reject" or "fail".  Those earlier messages will tell you
  1460. (8) eap_peap:   what went wrong, and how to fix the problem
  1461. (8) eap: ERROR: Failed continuing EAP PEAP (25) session.  EAP sub-module failed
  1462. (8) eap: Sending EAP Failure (code 4) ID 8 length 4
  1463. (8) eap: Failed in EAP select
  1464. (8)     [eap] = invalid
  1465. (8)   } # authenticate = invalid
  1466. (8) Failed to authenticate the user
  1467. (8) Using Post-Auth-Type Reject
  1468. (8) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
  1469. (8)   Post-Auth-Type REJECT {
  1470. (8) attr_filter.access_reject: EXPAND %{User-Name}
  1471. (8) attr_filter.access_reject:    --> rixis
  1472. (8) attr_filter.access_reject: Matched entry DEFAULT at line 11
  1473. (8)     [attr_filter.access_reject] = updated
  1474. (8)     [eap] = noop
  1475. (8)     policy remove_reply_message_if_eap {
  1476. (8)       if (&reply:EAP-Message && &reply:Reply-Message) {
  1477. (8)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
  1478. (8)       else {
  1479. (8)         [noop] = noop
  1480. (8)       } # else = noop
  1481. (8)     } # policy remove_reply_message_if_eap = noop
  1482. (8)   } # Post-Auth-Type REJECT = updated
  1483. (8) Delaying response for 1.000000 seconds
  1484. Waking up in 0.3 seconds.
  1485. Waking up in 0.6 seconds.
  1486. (8) (8) Discarding duplicate request from client wifiVRN port 60054 - ID: 30 due to delayed response
  1487. Waking up in 0.5 seconds.
  1488. (8) (8) Discarding duplicate request from client wifiVRN port 60054 - ID: 30 due to delayed response
  1489. (8) Sending delayed response
  1490. (8) Sent Access-Reject Id 30 from 192.168.51.10:1812 to 192.168.5.2:60054 length 44
  1491. (8)   EAP-Message = 0x04080004
  1492. (8)   Message-Authenticator = 0x00000000000000000000000000000000
  1493. Waking up in 3.5 seconds.
  1494. (0) Cleaning up request packet ID 22 with timestamp +5
  1495. (1) Cleaning up request packet ID 23 with timestamp +5
  1496. (2) Cleaning up request packet ID 24 with timestamp +5
  1497. (3) Cleaning up request packet ID 25 with timestamp +5
  1498. (4) Cleaning up request packet ID 26 with timestamp +5
  1499. (5) Cleaning up request packet ID 27 with timestamp +5
  1500. (6) Cleaning up request packet ID 28 with timestamp +5
  1501. (7) Cleaning up request packet ID 29 with timestamp +5
  1502. (8) Cleaning up request packet ID 30 with timestamp +5
  1503. Ready to process requests
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!