Created
October 7, 2015 13:55
-
-
Save skids/17869d1a528c8134959a to your computer and use it in GitHub Desktop.
Output for a freeradius github issue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Copyright (C) 1999-2015 The FreeRADIUS server project and contributors | |
| There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A | |
| PARTICULAR PURPOSE | |
| You may redistribute copies of FreeRADIUS under the terms of the | |
| GNU General Public License | |
| For more information about these matters, see the file named COPYRIGHT | |
| Starting - reading configuration files ... | |
| including dictionary file /usr/share/freeradius/dictionary | |
| including dictionary file /usr/share/freeradius/dictionary.dhcp | |
| including dictionary file /usr/share/freeradius/dictionary.vqp | |
| including dictionary file /etc/raddb/dictionary | |
| including configuration file /etc/raddb/bug.conf | |
| including configuration file /etc/raddb/proxy-bug.conf | |
| including configuration file /etc/raddb/clients-bug.conf | |
| including files in directory /etc/raddb/mods-enabled-bug/ | |
| including configuration file /etc/raddb/mods-enabled-bug/eap | |
| including configuration file /etc/raddb/mods-enabled-bug/always | |
| including configuration file /etc/raddb/mods-enabled-bug/attr_filter | |
| including configuration file /etc/raddb/mods-enabled-bug/chap | |
| including configuration file /etc/raddb/mods-enabled-bug/detail | |
| including configuration file /etc/raddb/mods-enabled-bug/detail.log | |
| including configuration file /etc/raddb/mods-enabled-bug/dhcp | |
| including configuration file /etc/raddb/mods-enabled-bug/digest | |
| including configuration file /etc/raddb/mods-enabled-bug/dynamic_clients | |
| including configuration file /etc/raddb/mods-enabled-bug/echo | |
| including configuration file /etc/raddb/mods-enabled-bug/exec | |
| including configuration file /etc/raddb/mods-enabled-bug/expiration | |
| including configuration file /etc/raddb/mods-enabled-bug/expr | |
| including configuration file /etc/raddb/mods-enabled-bug/files | |
| including configuration file /etc/raddb/mods-enabled-bug/linelog | |
| including configuration file /etc/raddb/mods-enabled-bug/logintime | |
| including configuration file /etc/raddb/mods-enabled-bug/mschap | |
| including configuration file /etc/raddb/mods-enabled-bug/ntlm_auth | |
| including configuration file /etc/raddb/mods-enabled-bug/pap | |
| including configuration file /etc/raddb/mods-enabled-bug/passwd | |
| including configuration file /etc/raddb/mods-enabled-bug/preprocess | |
| including configuration file /etc/raddb/mods-enabled-bug/radutmp | |
| including configuration file /etc/raddb/mods-enabled-bug/realm | |
| including configuration file /etc/raddb/mods-enabled-bug/replicate | |
| including configuration file /etc/raddb/mods-enabled-bug/soh | |
| including configuration file /etc/raddb/mods-enabled-bug/sradutmp | |
| including configuration file /etc/raddb/mods-enabled-bug/unix | |
| including configuration file /etc/raddb/mods-enabled-bug/utf8 | |
| including files in directory /etc/raddb/policy.d/ | |
| including configuration file /etc/raddb/policy.d/accounting | |
| including configuration file /etc/raddb/policy.d/canonicalization | |
| including configuration file /etc/raddb/policy.d/control | |
| including configuration file /etc/raddb/policy.d/cui | |
| including configuration file /etc/raddb/policy.d/dhcp | |
| including configuration file /etc/raddb/policy.d/eap | |
| including configuration file /etc/raddb/policy.d/filter | |
| including configuration file /etc/raddb/policy.d/operator-name | |
| including files in directory /etc/raddb/sites-enabled-bug/ | |
| including configuration file /etc/raddb/sites-enabled-bug/default | |
| including configuration file /etc/raddb/sites-enabled-bug/inner-tunnel | |
| main { | |
| security { | |
| user = "radiusd" | |
| group = "radiusd" | |
| allow_core_dumps = no | |
| } | |
| name = "radiusd" | |
| prefix = "/usr" | |
| localstatedir = "/var" | |
| logdir = "/var/log/radius" | |
| run_dir = "/var/run/radiusd" | |
| } | |
| main { | |
| name = "radiusd" | |
| prefix = "/usr" | |
| localstatedir = "/var" | |
| sbindir = "/usr/sbin" | |
| logdir = "/var/log/radius" | |
| run_dir = "/var/run/radiusd" | |
| libdir = "/usr/lib64/freeradius" | |
| radacctdir = "/var/log/radius/radacct" | |
| hostname_lookups = no | |
| max_request_time = 30 | |
| cleanup_delay = 5 | |
| max_requests = 16384 | |
| pidfile = "/var/run/radiusd/radiusd.pid" | |
| checkrad = "/usr/sbin/checkrad" | |
| debug_level = 0 | |
| proxy_requests = yes | |
| log { | |
| stripped_names = no | |
| auth = no | |
| auth_badpass = no | |
| auth_goodpass = no | |
| colourise = yes | |
| msg_denied = "You are already logged in - access denied" | |
| } | |
| resources { | |
| } | |
| security { | |
| max_attributes = 200 | |
| reject_delay = 1.000000 | |
| status_server = yes | |
| allow_vulnerable_openssl = "CVE-2014-0160" | |
| } | |
| } | |
| bug: #### Loading Realms and Home Servers #### | |
| proxy server { | |
| retry_delay = 5 | |
| retry_count = 3 | |
| default_fallback = no | |
| dead_time = 120 | |
| wake_all_if_all_dead = no | |
| } | |
| home_server localhost { | |
| ipaddr = 127.0.0.1 | |
| port = 1808 | |
| type = "auth" | |
| secret = <<< secret >>> | |
| response_window = 20.000000 | |
| response_timeouts = 1 | |
| max_outstanding = 65536 | |
| zombie_period = 40 | |
| status_check = "status-server" | |
| ping_interval = 30 | |
| check_interval = 30 | |
| check_timeout = 4 | |
| num_answers_to_alive = 3 | |
| revive_interval = 120 | |
| limit { | |
| max_connections = 16 | |
| max_requests = 0 | |
| lifetime = 0 | |
| idle_timeout = 0 | |
| } | |
| coa { | |
| irt = 2 | |
| mrt = 16 | |
| mrc = 5 | |
| mrd = 30 | |
| } | |
| } | |
| home_server virtual.example.com { | |
| virtual_server = "virtual.example.com" | |
| port = 0 | |
| response_window = 30.000000 | |
| response_timeouts = 1 | |
| max_outstanding = 65536 | |
| zombie_period = 40 | |
| status_check = "none" | |
| ping_interval = 30 | |
| check_timeout = 4 | |
| num_answers_to_alive = 3 | |
| revive_interval = 300 | |
| limit { | |
| max_connections = 16 | |
| max_requests = 0 | |
| lifetime = 0 | |
| idle_timeout = 0 | |
| } | |
| coa { | |
| irt = 2 | |
| mrt = 16 | |
| mrc = 5 | |
| mrd = 30 | |
| } | |
| } | |
| home_server_pool my_auth_failover { | |
| type = fail-over | |
| home_server = localhost | |
| fallback = virtual.example.com | |
| } | |
| realm example.com { | |
| auth_pool = my_auth_failover | |
| } | |
| realm LOCAL { | |
| } | |
| bug: #### Loading Clients #### | |
| client localhost { | |
| ipaddr = 127.0.0.1 | |
| require_message_authenticator = no | |
| secret = <<< secret >>> | |
| nas_type = "other" | |
| proto = "*" | |
| limit { | |
| max_connections = 16 | |
| lifetime = 0 | |
| idle_timeout = 30 | |
| } | |
| } | |
| client localhost_ipv6 { | |
| ipv6addr = ::1 | |
| require_message_authenticator = no | |
| secret = <<< secret >>> | |
| limit { | |
| max_connections = 16 | |
| lifetime = 0 | |
| idle_timeout = 30 | |
| } | |
| } | |
| Debugger not attached | |
| # Creating Auth-Type = digest | |
| bug: #### Instantiating modules #### | |
| # Loaded module rlm_eap | |
| # Loading module "eap" from file /etc/raddb/mods-enabled-bug/eap | |
| eap { | |
| default_eap_type = "md5" | |
| timer_expire = 60 | |
| ignore_unknown_eap_types = no | |
| cisco_accounting_username_bug = no | |
| max_sessions = 16384 | |
| } | |
| # Loaded module rlm_always | |
| # Loading module "reject" from file /etc/raddb/mods-enabled-bug/always | |
| always reject { | |
| rcode = "reject" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "fail" from file /etc/raddb/mods-enabled-bug/always | |
| always fail { | |
| rcode = "fail" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "ok" from file /etc/raddb/mods-enabled-bug/always | |
| always ok { | |
| rcode = "ok" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "handled" from file /etc/raddb/mods-enabled-bug/always | |
| always handled { | |
| rcode = "handled" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "invalid" from file /etc/raddb/mods-enabled-bug/always | |
| always invalid { | |
| rcode = "invalid" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "userlock" from file /etc/raddb/mods-enabled-bug/always | |
| always userlock { | |
| rcode = "userlock" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "notfound" from file /etc/raddb/mods-enabled-bug/always | |
| always notfound { | |
| rcode = "notfound" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "noop" from file /etc/raddb/mods-enabled-bug/always | |
| always noop { | |
| rcode = "noop" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loading module "updated" from file /etc/raddb/mods-enabled-bug/always | |
| always updated { | |
| rcode = "updated" | |
| simulcount = 0 | |
| mpp = no | |
| } | |
| # Loaded module rlm_attr_filter | |
| # Loading module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| attr_filter attr_filter.post-proxy { | |
| filename = "/etc/raddb/mods-config/attr_filter/post-proxy" | |
| key = "%{Realm}" | |
| relaxed = no | |
| } | |
| # Loading module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| attr_filter attr_filter.pre-proxy { | |
| filename = "/etc/raddb/mods-config/attr_filter/pre-proxy" | |
| key = "%{Realm}" | |
| relaxed = no | |
| } | |
| # Loading module "attr_filter.access_reject" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| attr_filter attr_filter.access_reject { | |
| filename = "/etc/raddb/mods-config/attr_filter/access_reject" | |
| key = "%{User-Name}" | |
| relaxed = no | |
| } | |
| # Loading module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| attr_filter attr_filter.access_challenge { | |
| filename = "/etc/raddb/mods-config/attr_filter/access_challenge" | |
| key = "%{User-Name}" | |
| relaxed = no | |
| } | |
| # Loading module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| attr_filter attr_filter.accounting_response { | |
| filename = "/etc/raddb/mods-config/attr_filter/accounting_response" | |
| key = "%{User-Name}" | |
| relaxed = no | |
| } | |
| # Loaded module rlm_chap | |
| # Loading module "chap" from file /etc/raddb/mods-enabled-bug/chap | |
| # Loaded module rlm_detail | |
| # Loading module "detail" from file /etc/raddb/mods-enabled-bug/detail | |
| detail { | |
| filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" | |
| header = "%t" | |
| permissions = 384 | |
| locking = no | |
| escape_filenames = no | |
| log_packet_header = no | |
| } | |
| # Loading module "auth_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| detail auth_log { | |
| filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" | |
| header = "%t" | |
| permissions = 384 | |
| locking = no | |
| escape_filenames = no | |
| log_packet_header = no | |
| } | |
| # Loading module "reply_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| detail reply_log { | |
| filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" | |
| header = "%t" | |
| permissions = 384 | |
| locking = no | |
| escape_filenames = no | |
| log_packet_header = no | |
| } | |
| # Loading module "pre_proxy_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| detail pre_proxy_log { | |
| filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" | |
| header = "%t" | |
| permissions = 384 | |
| locking = no | |
| escape_filenames = no | |
| log_packet_header = no | |
| } | |
| # Loading module "post_proxy_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| detail post_proxy_log { | |
| filename = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" | |
| header = "%t" | |
| permissions = 384 | |
| locking = no | |
| escape_filenames = no | |
| log_packet_header = no | |
| } | |
| # Loaded module rlm_dhcp | |
| # Loading module "dhcp" from file /etc/raddb/mods-enabled-bug/dhcp | |
| # Loaded module rlm_digest | |
| # Loading module "digest" from file /etc/raddb/mods-enabled-bug/digest | |
| # Loaded module rlm_dynamic_clients | |
| # Loading module "dynamic_clients" from file /etc/raddb/mods-enabled-bug/dynamic_clients | |
| # Loaded module rlm_exec | |
| # Loading module "echo" from file /etc/raddb/mods-enabled-bug/echo | |
| exec echo { | |
| wait = yes | |
| program = "/bin/echo %{User-Name}" | |
| input_pairs = "request" | |
| output_pairs = "reply" | |
| shell_escape = yes | |
| } | |
| # Loading module "exec" from file /etc/raddb/mods-enabled-bug/exec | |
| exec { | |
| wait = no | |
| input_pairs = "request" | |
| shell_escape = yes | |
| timeout = 10 | |
| } | |
| # Loaded module rlm_expiration | |
| # Loading module "expiration" from file /etc/raddb/mods-enabled-bug/expiration | |
| # Loaded module rlm_expr | |
| # Loading module "expr" from file /etc/raddb/mods-enabled-bug/expr | |
| expr { | |
| safe_characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /äéöüàâæçèéêëîïôœùûüaÿÄÉÖÜßÀÂÆÇÈÉÊËÎÏÔŒÙÛÜŸ" | |
| } | |
| # Loaded module rlm_files | |
| # Loading module "files" from file /etc/raddb/mods-enabled-bug/files | |
| files { | |
| filename = "/etc/raddb/mods-config/files/authorize" | |
| acctusersfile = "/etc/raddb/mods-config/files/accounting" | |
| preproxy_usersfile = "/etc/raddb/mods-config/files/pre-proxy" | |
| } | |
| # Loaded module rlm_linelog | |
| # Loading module "linelog" from file /etc/raddb/mods-enabled-bug/linelog | |
| linelog { | |
| filename = "/var/log/radius/linelog" | |
| escape_filenames = no | |
| syslog_severity = "info" | |
| permissions = 384 | |
| format = "This is a log message for %{User-Name}" | |
| reference = "messages.%{%{reply:Packet-Type}:-default}" | |
| } | |
| # Loading module "log_accounting" from file /etc/raddb/mods-enabled-bug/linelog | |
| linelog log_accounting { | |
| filename = "/var/log/radius/linelog-accounting" | |
| escape_filenames = no | |
| syslog_severity = "info" | |
| permissions = 384 | |
| format = "" | |
| reference = "Accounting-Request.%{%{Acct-Status-Type}:-unknown}" | |
| } | |
| # Loaded module rlm_logintime | |
| # Loading module "logintime" from file /etc/raddb/mods-enabled-bug/logintime | |
| logintime { | |
| minimum_timeout = 60 | |
| } | |
| # Loaded module rlm_mschap | |
| # Loading module "mschap" from file /etc/raddb/mods-enabled-bug/mschap | |
| mschap { | |
| use_mppe = yes | |
| require_encryption = no | |
| require_strong = no | |
| with_ntdomain_hack = yes | |
| passchange { | |
| } | |
| allow_retry = yes | |
| } | |
| # Loading module "ntlm_auth" from file /etc/raddb/mods-enabled-bug/ntlm_auth | |
| exec ntlm_auth { | |
| wait = yes | |
| program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" | |
| shell_escape = yes | |
| } | |
| # Loaded module rlm_pap | |
| # Loading module "pap" from file /etc/raddb/mods-enabled-bug/pap | |
| pap { | |
| normalise = yes | |
| } | |
| # Loaded module rlm_passwd | |
| # Loading module "etc_passwd" from file /etc/raddb/mods-enabled-bug/passwd | |
| passwd etc_passwd { | |
| filename = "/etc/passwd" | |
| format = "*User-Name:Crypt-Password:" | |
| delimiter = ":" | |
| ignore_nislike = no | |
| ignore_empty = yes | |
| allow_multiple_keys = no | |
| hash_size = 100 | |
| } | |
| # Loaded module rlm_preprocess | |
| # Loading module "preprocess" from file /etc/raddb/mods-enabled-bug/preprocess | |
| preprocess { | |
| huntgroups = "/etc/raddb/mods-config/preprocess/huntgroups" | |
| hints = "/etc/raddb/mods-config/preprocess/hints" | |
| with_ascend_hack = no | |
| ascend_channels_per_line = 23 | |
| with_ntdomain_hack = no | |
| with_specialix_jetstream_hack = no | |
| with_cisco_vsa_hack = no | |
| with_alvarion_vsa_hack = no | |
| } | |
| # Loaded module rlm_radutmp | |
| # Loading module "radutmp" from file /etc/raddb/mods-enabled-bug/radutmp | |
| radutmp { | |
| filename = "/var/log/radius/radutmp" | |
| username = "%{User-Name}" | |
| case_sensitive = yes | |
| check_with_nas = yes | |
| permissions = 384 | |
| caller_id = yes | |
| } | |
| # Loaded module rlm_realm | |
| # Loading module "IPASS" from file /etc/raddb/mods-enabled-bug/realm | |
| realm IPASS { | |
| format = "prefix" | |
| delimiter = "/" | |
| ignore_default = no | |
| ignore_null = no | |
| } | |
| # Loading module "suffix" from file /etc/raddb/mods-enabled-bug/realm | |
| realm suffix { | |
| format = "suffix" | |
| delimiter = "@" | |
| ignore_default = no | |
| ignore_null = no | |
| } | |
| # Loading module "realmpercent" from file /etc/raddb/mods-enabled-bug/realm | |
| realm realmpercent { | |
| format = "suffix" | |
| delimiter = "%" | |
| ignore_default = no | |
| ignore_null = no | |
| } | |
| # Loading module "ntdomain" from file /etc/raddb/mods-enabled-bug/realm | |
| realm ntdomain { | |
| format = "prefix" | |
| delimiter = "\\" | |
| ignore_default = no | |
| ignore_null = no | |
| } | |
| # Loaded module rlm_replicate | |
| # Loading module "replicate" from file /etc/raddb/mods-enabled-bug/replicate | |
| # Loaded module rlm_soh | |
| # Loading module "soh" from file /etc/raddb/mods-enabled-bug/soh | |
| soh { | |
| dhcp = yes | |
| } | |
| # Loading module "sradutmp" from file /etc/raddb/mods-enabled-bug/sradutmp | |
| radutmp sradutmp { | |
| filename = "/var/log/radius/sradutmp" | |
| username = "%{User-Name}" | |
| case_sensitive = yes | |
| check_with_nas = yes | |
| permissions = 420 | |
| caller_id = no | |
| } | |
| # Loaded module rlm_unix | |
| # Loading module "unix" from file /etc/raddb/mods-enabled-bug/unix | |
| unix { | |
| radwtmp = "/var/log/radius/radwtmp" | |
| } | |
| Creating attribute Unix-Group | |
| # Loaded module rlm_utf8 | |
| # Loading module "utf8" from file /etc/raddb/mods-enabled-bug/utf8 | |
| instantiate { | |
| } | |
| modules { | |
| # Instantiating module "eap" from file /etc/raddb/mods-enabled-bug/eap | |
| # Linked to sub-module rlm_eap_md5 | |
| # Linked to sub-module rlm_eap_leap | |
| # Linked to sub-module rlm_eap_gtc | |
| gtc { | |
| challenge = "Password: " | |
| auth_type = "PAP" | |
| } | |
| # Linked to sub-module rlm_eap_tls | |
| tls { | |
| tls = "tls-common" | |
| } | |
| tls-config tls-common { | |
| rsa_key_exchange = no | |
| dh_key_exchange = yes | |
| rsa_key_length = 512 | |
| dh_key_length = 512 | |
| verify_depth = 0 | |
| ca_path = "/etc/raddb/certs" | |
| pem_file_type = yes | |
| private_key_file = "/etc/raddb/certs/server.pem" | |
| certificate_file = "/etc/raddb/certs/server.pem" | |
| ca_file = "/etc/raddb/certs/ca.pem" | |
| private_key_password = <<< secret >>> | |
| dh_file = "/etc/raddb/certs/dh" | |
| fragment_size = 1024 | |
| include_length = yes | |
| check_crl = no | |
| check_all_crl = no | |
| cipher_list = "DEFAULT" | |
| ecdh_curve = "prime256v1" | |
| cache { | |
| enable = yes | |
| lifetime = 24 | |
| max_entries = 255 | |
| } | |
| verify { | |
| } | |
| ocsp { | |
| enable = no | |
| override_cert_url = yes | |
| url = "http://127.0.0.1/ocsp/" | |
| use_nonce = yes | |
| timeout = 0 | |
| softfail = no | |
| } | |
| } | |
| # Linked to sub-module rlm_eap_ttls | |
| ttls { | |
| tls = "tls-common" | |
| default_eap_type = "md5" | |
| copy_request_to_tunnel = no | |
| use_tunneled_reply = no | |
| virtual_server = "inner-tunnel" | |
| include_length = yes | |
| require_client_cert = no | |
| } | |
| tls: Using cached TLS configuration from previous invocation | |
| # Linked to sub-module rlm_eap_peap | |
| peap { | |
| tls = "tls-common" | |
| default_eap_type = "mschapv2" | |
| copy_request_to_tunnel = no | |
| use_tunneled_reply = no | |
| proxy_tunneled_request_as_eap = yes | |
| virtual_server = "inner-tunnel" | |
| soh = no | |
| require_client_cert = no | |
| } | |
| tls: Using cached TLS configuration from previous invocation | |
| # Linked to sub-module rlm_eap_mschapv2 | |
| mschapv2 { | |
| with_ntdomain_hack = no | |
| send_error = no | |
| } | |
| # Instantiating module "reject" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "fail" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "ok" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "handled" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "invalid" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "userlock" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "notfound" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "noop" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "updated" from file /etc/raddb/mods-enabled-bug/always | |
| # Instantiating module "attr_filter.post-proxy" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| reading pairlist file /etc/raddb/mods-config/attr_filter/post-proxy | |
| # Instantiating module "attr_filter.pre-proxy" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| reading pairlist file /etc/raddb/mods-config/attr_filter/pre-proxy | |
| # Instantiating module "attr_filter.access_reject" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| reading pairlist file /etc/raddb/mods-config/attr_filter/access_reject | |
| [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay" found in filter list for realm "DEFAULT". | |
| [/etc/raddb/mods-config/attr_filter/access_reject]:11 Check item "FreeRADIUS-Response-Delay-USec" found in filter list for realm "DEFAULT". | |
| # Instantiating module "attr_filter.access_challenge" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| reading pairlist file /etc/raddb/mods-config/attr_filter/access_challenge | |
| # Instantiating module "attr_filter.accounting_response" from file /etc/raddb/mods-enabled-bug/attr_filter | |
| reading pairlist file /etc/raddb/mods-config/attr_filter/accounting_response | |
| # Instantiating module "detail" from file /etc/raddb/mods-enabled-bug/detail | |
| # Instantiating module "auth_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| rlm_detail (auth_log): 'User-Password' suppressed, will not appear in detail output | |
| # Instantiating module "reply_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| # Instantiating module "pre_proxy_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| # Instantiating module "post_proxy_log" from file /etc/raddb/mods-enabled-bug/detail.log | |
| # Instantiating module "expiration" from file /etc/raddb/mods-enabled-bug/expiration | |
| # Instantiating module "files" from file /etc/raddb/mods-enabled-bug/files | |
| reading pairlist file /etc/raddb/mods-config/files/authorize | |
| reading pairlist file /etc/raddb/mods-config/files/accounting | |
| reading pairlist file /etc/raddb/mods-config/files/pre-proxy | |
| # Instantiating module "linelog" from file /etc/raddb/mods-enabled-bug/linelog | |
| # Instantiating module "log_accounting" from file /etc/raddb/mods-enabled-bug/linelog | |
| # Instantiating module "logintime" from file /etc/raddb/mods-enabled-bug/logintime | |
| # Instantiating module "mschap" from file /etc/raddb/mods-enabled-bug/mschap | |
| rlm_mschap (mschap): using internal authentication | |
| # Instantiating module "pap" from file /etc/raddb/mods-enabled-bug/pap | |
| # Instantiating module "etc_passwd" from file /etc/raddb/mods-enabled-bug/passwd | |
| rlm_passwd: nfields: 3 keyfield 0(User-Name) listable: no | |
| # Instantiating module "preprocess" from file /etc/raddb/mods-enabled-bug/preprocess | |
| reading pairlist file /etc/raddb/mods-config/preprocess/huntgroups | |
| reading pairlist file /etc/raddb/mods-config/preprocess/hints | |
| # Instantiating module "IPASS" from file /etc/raddb/mods-enabled-bug/realm | |
| # Instantiating module "suffix" from file /etc/raddb/mods-enabled-bug/realm | |
| # Instantiating module "realmpercent" from file /etc/raddb/mods-enabled-bug/realm | |
| # Instantiating module "ntdomain" from file /etc/raddb/mods-enabled-bug/realm | |
| } # modules | |
| bug: #### Loading Virtual Servers #### | |
| server { # from file /etc/raddb/bug.conf | |
| } # server | |
| server virtual.example.com { # from file /etc/raddb/proxy-bug.conf | |
| # Loading authenticate {...} | |
| # Loading authorize {...} | |
| Ignoring "sql" (see raddb/mods-available/README.rst) | |
| Ignoring "ldap" (see raddb/mods-available/README.rst) | |
| # Loading preacct {...} | |
| # Loading accounting {...} | |
| # Loading post-proxy {...} | |
| # Loading post-auth {...} | |
| } # server virtual.example.com | |
| server default { # from file /etc/raddb/sites-enabled-bug/default | |
| # Loading authenticate {...} | |
| # Loading authorize {...} | |
| # Loading preacct {...} | |
| # Loading accounting {...} | |
| # Loading post-proxy {...} | |
| # Loading post-auth {...} | |
| } # server default | |
| server inner-tunnel { # from file /etc/raddb/sites-enabled-bug/inner-tunnel | |
| # Loading authenticate {...} | |
| # Loading authorize {...} | |
| # Loading session {...} | |
| # Loading post-proxy {...} | |
| # Loading post-auth {...} | |
| } # server inner-tunnel | |
| bug: #### Opening IP addresses and Ports #### | |
| listen { | |
| type = "auth" | |
| ipaddr = * | |
| port = 1810 | |
| limit { | |
| max_connections = 16 | |
| lifetime = 0 | |
| idle_timeout = 30 | |
| } | |
| } | |
| listen { | |
| type = "acct" | |
| ipaddr = * | |
| port = 1811 | |
| limit { | |
| max_connections = 16 | |
| lifetime = 0 | |
| idle_timeout = 30 | |
| } | |
| } | |
| listen { | |
| type = "auth" | |
| ipv6addr = :: | |
| port = 0 | |
| limit { | |
| max_connections = 16 | |
| lifetime = 0 | |
| idle_timeout = 30 | |
| } | |
| } | |
| listen { | |
| type = "acct" | |
| ipv6addr = :: | |
| port = 0 | |
| limit { | |
| max_connections = 16 | |
| lifetime = 0 | |
| idle_timeout = 30 | |
| } | |
| } | |
| listen { | |
| type = "auth" | |
| ipaddr = 127.0.0.1 | |
| port = 18120 | |
| } | |
| Listening on auth address * port 1810 bound to server default | |
| Listening on acct address * port 1811 bound to server default | |
| Listening on auth address :: port 1812 bound to server default | |
| Listening on acct address :: port 1813 bound to server default | |
| Listening on auth address 127.0.0.1 port 18120 bound to server inner-tunnel | |
| Listening on proxy address * port 37553 | |
| Listening on proxy address :: port 56453 | |
| Ready to process requests | |
| (0) Received Access-Request Id 0 from 127.0.0.1:49077 to 127.0.0.1:1810 length 167 | |
| (0) User-Name = "[email protected]" | |
| (0) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (0) Framed-MTU = 1400 | |
| (0) NAS-Port-Type = Wireless-802.11 | |
| (0) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (0) NAS-IP-Address = 127.0.0.1 | |
| (0) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (0) EAP-Message = 0x0200001501616e6f6e406578616d706c652e636f6d | |
| (0) Message-Authenticator = 0x909aff9f2dc64ffdcb3c1f4367059c37 | |
| (0) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (0) authorize { | |
| (0) policy filter_username { | |
| (0) if (!&User-Name) { | |
| (0) if (!&User-Name) -> FALSE | |
| (0) if (&User-Name =~ / /) { | |
| (0) if (&User-Name =~ / /) -> FALSE | |
| (0) if (&User-Name =~ /@.*@/ ) { | |
| (0) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (0) if (&User-Name =~ /\.\./ ) { | |
| (0) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (0) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (0) if (&User-Name =~ /\.$/) { | |
| (0) if (&User-Name =~ /\.$/) -> FALSE | |
| (0) if (&User-Name =~ /@\./) { | |
| (0) if (&User-Name =~ /@\./) -> FALSE | |
| (0) } # policy filter_username = notfound | |
| (0) [preprocess] = ok | |
| (0) [chap] = noop | |
| (0) [mschap] = noop | |
| (0) [digest] = noop | |
| (0) suffix: Checking for suffix after "@" | |
| (0) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (0) suffix: Found realm "example.com" | |
| (0) suffix: Adding Stripped-User-Name = "anon" | |
| (0) suffix: Adding Realm = "example.com" | |
| (0) suffix: Proxying request from user anon to realm example.com | |
| (0) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (0) [suffix] = updated | |
| (0) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (0) [eap] = noop | |
| (0) [files] = noop | |
| (0) [expiration] = noop | |
| (0) [logintime] = noop | |
| (0) [pap] = noop | |
| (0) } # authorize = updated | |
| (0) Proxying request to home server 127.0.0.1 port 1808 timeout 20.000000 | |
| (0) Sent Access-Request Id 138 from 0.0.0.0:37553 to 127.0.0.1:1808 length 164 | |
| (0) User-Name = "anon" | |
| (0) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (0) Framed-MTU = 1400 | |
| (0) NAS-Port-Type = Wireless-802.11 | |
| (0) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (0) NAS-IP-Address = 127.0.0.1 | |
| (0) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (0) EAP-Message = 0x0200001501616e6f6e406578616d706c652e636f6d | |
| (0) Message-Authenticator = 0x909aff9f2dc64ffdcb3c1f4367059c37 | |
| (0) Event-Timestamp = "Oct 7 2015 09:11:36 EDT" | |
| (0) Proxy-State = 0x30 | |
| Waking up in 0.3 seconds. | |
| (0) Expecting proxy response no later than 19.666210 seconds from now | |
| Waking up in 19.6 seconds. | |
| (0) No proxy response, giving up on request and marking it done | |
| Marking home server 127.0.0.1 port 1808 as zombie (it has not responded in 20.000000 seconds). | |
| PING: Waiting 4 seconds for response to ping | |
| (1) Sent Status-Server Id 53 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (1) Message-Authenticator := 0x00 | |
| (1) NAS-Identifier := "Status Check 0. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| (0) ERROR: Failing proxied request for user "anon", due to lack of any response from home server 127.0.0.1 port 1808 | |
| (0) Clearing existing &reply: attributes | |
| (0) Found Post-Proxy-Type Fail-Authentication | |
| (0) Post-Proxy-Type sub-section not found. Ignoring. | |
| (0) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (0) There was no response configured: rejecting request | |
| (0) Using Post-Auth-Type Reject | |
| (0) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (0) Post-Auth-Type REJECT { | |
| (0) attr_filter.access_reject: EXPAND %{User-Name} | |
| (0) attr_filter.access_reject: --> [email protected] | |
| (0) attr_filter.access_reject: Matched entry DEFAULT at line 11 | |
| (0) [attr_filter.access_reject] = updated | |
| (0) eap: Request was previously rejected, inserting EAP-Failure | |
| (0) eap: Sending EAP Failure (code 4) ID 0 length 4 | |
| (0) [eap] = updated | |
| (0) policy remove_reply_message_if_eap { | |
| (0) if (&reply:EAP-Message && &reply:Reply-Message) { | |
| (0) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE | |
| (0) else { | |
| (0) [noop] = noop | |
| (0) } # else = noop | |
| (0) } # policy remove_reply_message_if_eap = noop | |
| (0) } # Post-Auth-Type REJECT = updated | |
| (0) Sent Access-Reject Id 0 from 127.0.0.1:1810 to 127.0.0.1:49077 length 0 | |
| (0) EAP-Message = 0x04000004 | |
| (0) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (0) Finished request | |
| Waking up in 3.9 seconds. | |
| No response to status check 1 ID 53 for home server 127.0.0.1 port 1808 | |
| Waking up in 0.9 seconds. | |
| (0) Cleaning up request packet ID 0 with timestamp +2 | |
| Waking up in 25.2 seconds. | |
| PING: Zombie period is over for home server localhost | |
| Marking home server 127.0.0.1 port 1808 as dead. | |
| PING: Already pinging home server localhost | |
| PING: Waiting 4 seconds for response to ping | |
| (2) Sent Status-Server Id 247 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (2) Message-Authenticator := 0x00 | |
| (2) NAS-Identifier := "Status Check 1. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 2 ID 247 for home server 127.0.0.1 port 1808 | |
| Waking up in 25.8 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (3) Sent Status-Server Id 189 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (3) Message-Authenticator := 0x00 | |
| (3) NAS-Identifier := "Status Check 2. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 3 ID 189 for home server 127.0.0.1 port 1808 | |
| Waking up in 24.9 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (4) Sent Status-Server Id 78 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (4) Message-Authenticator := 0x00 | |
| (4) NAS-Identifier := "Status Check 3. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 4 ID 78 for home server 127.0.0.1 port 1808 | |
| Waking up in 27.5 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (5) Sent Status-Server Id 113 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (5) Message-Authenticator := 0x00 | |
| (5) NAS-Identifier := "Status Check 4. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 5 ID 113 for home server 127.0.0.1 port 1808 | |
| Waking up in 25.6 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (6) Sent Status-Server Id 46 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (6) Message-Authenticator := 0x00 | |
| (6) NAS-Identifier := "Status Check 5. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 6 ID 46 for home server 127.0.0.1 port 1808 | |
| Waking up in 24.5 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (7) Sent Status-Server Id 129 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (7) Message-Authenticator := 0x00 | |
| (7) NAS-Identifier := "Status Check 6. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 7 ID 129 for home server 127.0.0.1 port 1808 | |
| Waking up in 26.7 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (8) Sent Status-Server Id 103 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (8) Message-Authenticator := 0x00 | |
| (8) NAS-Identifier := "Status Check 7. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 8 ID 103 for home server 127.0.0.1 port 1808 | |
| Waking up in 24.5 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (9) Sent Status-Server Id 57 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (9) Message-Authenticator := 0x00 | |
| (9) NAS-Identifier := "Status Check 8. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 9 ID 57 for home server 127.0.0.1 port 1808 | |
| Waking up in 27.4 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (10) Sent Status-Server Id 15 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (10) Message-Authenticator := 0x00 | |
| (10) NAS-Identifier := "Status Check 9. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 10 ID 15 for home server 127.0.0.1 port 1808 | |
| Waking up in 28.1 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (11) Sent Status-Server Id 230 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (11) Message-Authenticator := 0x00 | |
| (11) NAS-Identifier := "Status Check 10. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 11 ID 230 for home server 127.0.0.1 port 1808 | |
| Waking up in 24.9 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (12) Sent Status-Server Id 209 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (12) Message-Authenticator := 0x00 | |
| (12) NAS-Identifier := "Status Check 11. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 12 ID 209 for home server 127.0.0.1 port 1808 | |
| Waking up in 25.0 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (13) Sent Status-Server Id 190 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (13) Message-Authenticator := 0x00 | |
| (13) NAS-Identifier := "Status Check 12. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 3.9 seconds. | |
| No response to status check 13 ID 190 for home server 127.0.0.1 port 1808 | |
| Waking up in 25.8 seconds. | |
| (14) Received Access-Request Id 0 from 127.0.0.1:54692 to 127.0.0.1:1810 length 167 | |
| (14) User-Name = "[email protected]" | |
| (14) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (14) Framed-MTU = 1400 | |
| (14) NAS-Port-Type = Wireless-802.11 | |
| (14) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (14) NAS-IP-Address = 127.0.0.1 | |
| (14) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (14) EAP-Message = 0x0200001501616e6f6e406578616d706c652e636f6d | |
| (14) Message-Authenticator = 0x196cf8b5ef7704bc016a158a609b73ad | |
| (14) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (14) authorize { | |
| (14) policy filter_username { | |
| (14) if (!&User-Name) { | |
| (14) if (!&User-Name) -> FALSE | |
| (14) if (&User-Name =~ / /) { | |
| (14) if (&User-Name =~ / /) -> FALSE | |
| (14) if (&User-Name =~ /@.*@/ ) { | |
| (14) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (14) if (&User-Name =~ /\.\./ ) { | |
| (14) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (14) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (14) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (14) if (&User-Name =~ /\.$/) { | |
| (14) if (&User-Name =~ /\.$/) -> FALSE | |
| (14) if (&User-Name =~ /@\./) { | |
| (14) if (&User-Name =~ /@\./) -> FALSE | |
| (14) } # policy filter_username = notfound | |
| (14) [preprocess] = ok | |
| (14) [chap] = noop | |
| (14) [mschap] = noop | |
| (14) [digest] = noop | |
| (14) suffix: Checking for suffix after "@" | |
| (14) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (14) suffix: Found realm "example.com" | |
| (14) suffix: Adding Stripped-User-Name = "anon" | |
| (14) suffix: Adding Realm = "example.com" | |
| (14) suffix: Proxying request from user anon to realm example.com | |
| (14) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (14) [suffix] = updated | |
| (14) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (14) [eap] = noop | |
| (14) [files] = noop | |
| (14) [expiration] = noop | |
| (14) [logintime] = noop | |
| (14) [pap] = noop | |
| (14) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (14) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (14) authorize { | |
| (14) policy filter_username { | |
| (14) if (!&User-Name) { | |
| (14) if (!&User-Name) -> FALSE | |
| (14) if (&User-Name =~ / /) { | |
| (14) if (&User-Name =~ / /) -> FALSE | |
| (14) if (&User-Name =~ /@.*@/ ) { | |
| (14) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (14) if (&User-Name =~ /\.\./ ) { | |
| (14) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (14) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (14) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (14) if (&User-Name =~ /\.$/) { | |
| (14) if (&User-Name =~ /\.$/) -> FALSE | |
| (14) if (&User-Name =~ /@\./) { | |
| (14) if (&User-Name =~ /@\./) -> FALSE | |
| (14) } # policy filter_username = notfound | |
| (14) [preprocess] = ok | |
| (14) [chap] = noop | |
| (14) [mschap] = noop | |
| (14) [digest] = noop | |
| (14) eap: Peer sent EAP Response (code 2) ID 0 length 21 | |
| (14) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize | |
| (14) [eap] = ok | |
| (14) } # authorize = ok | |
| (14) Found Auth-Type = EAP | |
| (14) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (14) authenticate { | |
| (14) eap: Peer sent packet with method EAP Identity (1) | |
| (14) eap: Calling submodule eap_md5 to process data | |
| (14) eap_md5: Issuing MD5 Challenge | |
| (14) eap: Sending EAP Request (code 1) ID 1 length 22 | |
| (14) eap: EAP session adding &reply:State = 0xf679a215f678a601 | |
| (14) [eap] = handled | |
| (14) } # authenticate = handled | |
| (14) Using Post-Auth-Type Challenge | |
| (14) Post-Auth-Type sub-section not found. Ignoring. | |
| (14) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (14) Finished internally proxied request. | |
| (14) Clearing existing &reply: attributes | |
| (14) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (14) post-proxy { | |
| (14) eap: No pre-existing handler found | |
| (14) [eap] = noop | |
| (14) } # post-proxy = noop | |
| (14) Using Post-Auth-Type Challenge | |
| (14) Post-Auth-Type sub-section not found. Ignoring. | |
| (14) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (14) Sent Access-Challenge Id 0 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (14) EAP-Message = 0x010100160410aebf85304e80c321c3763896c7829d21 | |
| (14) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (14) State = 0xf679a215f678a60177d7bad98e3b1ad7 | |
| (14) Finished request | |
| Waking up in 0.5 seconds. | |
| (15) Received Access-Request Id 1 from 127.0.0.1:54692 to 127.0.0.1:1810 length 170 | |
| (15) User-Name = "[email protected]" | |
| (15) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (15) Framed-MTU = 1400 | |
| (15) NAS-Port-Type = Wireless-802.11 | |
| (15) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (15) NAS-IP-Address = 127.0.0.1 | |
| (15) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (15) EAP-Message = 0x020100060319 | |
| (15) State = 0xf679a215f678a60177d7bad98e3b1ad7 | |
| (15) Message-Authenticator = 0xf73bff86db0295a092f41277a5516d3d | |
| (15) session-state: No cached attributes | |
| (15) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (15) authorize { | |
| (15) policy filter_username { | |
| (15) if (!&User-Name) { | |
| (15) if (!&User-Name) -> FALSE | |
| (15) if (&User-Name =~ / /) { | |
| (15) if (&User-Name =~ / /) -> FALSE | |
| (15) if (&User-Name =~ /@.*@/ ) { | |
| (15) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (15) if (&User-Name =~ /\.\./ ) { | |
| (15) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (15) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (15) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (15) if (&User-Name =~ /\.$/) { | |
| (15) if (&User-Name =~ /\.$/) -> FALSE | |
| (15) if (&User-Name =~ /@\./) { | |
| (15) if (&User-Name =~ /@\./) -> FALSE | |
| (15) } # policy filter_username = notfound | |
| (15) [preprocess] = ok | |
| (15) [chap] = noop | |
| (15) [mschap] = noop | |
| (15) [digest] = noop | |
| (15) suffix: Checking for suffix after "@" | |
| (15) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (15) suffix: Found realm "example.com" | |
| (15) suffix: Adding Stripped-User-Name = "anon" | |
| (15) suffix: Adding Realm = "example.com" | |
| (15) suffix: Proxying request from user anon to realm example.com | |
| (15) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (15) [suffix] = updated | |
| (15) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (15) [eap] = noop | |
| (15) [files] = noop | |
| (15) [expiration] = noop | |
| (15) [logintime] = noop | |
| (15) [pap] = noop | |
| (15) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (15) session-state: No cached attributes | |
| (15) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (15) authorize { | |
| (15) policy filter_username { | |
| (15) if (!&User-Name) { | |
| (15) if (!&User-Name) -> FALSE | |
| (15) if (&User-Name =~ / /) { | |
| (15) if (&User-Name =~ / /) -> FALSE | |
| (15) if (&User-Name =~ /@.*@/ ) { | |
| (15) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (15) if (&User-Name =~ /\.\./ ) { | |
| (15) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (15) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (15) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (15) if (&User-Name =~ /\.$/) { | |
| (15) if (&User-Name =~ /\.$/) -> FALSE | |
| (15) if (&User-Name =~ /@\./) { | |
| (15) if (&User-Name =~ /@\./) -> FALSE | |
| (15) } # policy filter_username = notfound | |
| (15) [preprocess] = ok | |
| (15) [chap] = noop | |
| (15) [mschap] = noop | |
| (15) [digest] = noop | |
| (15) eap: Peer sent EAP Response (code 2) ID 1 length 6 | |
| (15) eap: No EAP Start, assuming it's an on-going EAP conversation | |
| (15) [eap] = updated | |
| (15) [files] = noop | |
| (15) [expiration] = noop | |
| (15) [logintime] = noop | |
| (15) pap: WARNING: No "known good" password found for the user. Not setting Auth-Type | |
| (15) pap: WARNING: Authentication will fail unless a "known good" password is available | |
| (15) [pap] = noop | |
| (15) } # authorize = updated | |
| (15) Found Auth-Type = EAP | |
| (15) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (15) authenticate { | |
| (15) eap: Expiring EAP session with state 0xf679a215f678a601 | |
| (15) eap: Finished EAP session with state 0xf679a215f678a601 | |
| (15) eap: Previous EAP request found for state 0xf679a215f678a601, released from the list | |
| (15) eap: Peer sent packet with method EAP NAK (3) | |
| (15) eap: Found mutually acceptable type PEAP (25) | |
| (15) eap: Calling submodule eap_peap to process data | |
| (15) eap_peap: Initiating new EAP-TLS session | |
| (15) eap_peap: Flushing SSL sessions (of #0) | |
| (15) eap_peap: [eaptls start] = request | |
| (15) eap: Sending EAP Request (code 1) ID 2 length 6 | |
| (15) eap: EAP session adding &reply:State = 0xf679a215f77bbb01 | |
| (15) [eap] = handled | |
| (15) } # authenticate = handled | |
| (15) Using Post-Auth-Type Challenge | |
| (15) Post-Auth-Type sub-section not found. Ignoring. | |
| (15) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (15) Finished internally proxied request. | |
| (15) Clearing existing &reply: attributes | |
| (15) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (15) post-proxy { | |
| (15) eap: No pre-existing handler found | |
| (15) [eap] = noop | |
| (15) } # post-proxy = noop | |
| (15) Using Post-Auth-Type Challenge | |
| (15) Post-Auth-Type sub-section not found. Ignoring. | |
| (15) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (15) Sent Access-Challenge Id 1 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (15) EAP-Message = 0x010200061920 | |
| (15) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (15) State = 0xf679a215f77bbb0177d7bad98e3b1ad7 | |
| (15) Finished request | |
| Waking up in 0.5 seconds. | |
| (16) Received Access-Request Id 2 from 127.0.0.1:54692 to 127.0.0.1:1810 length 325 | |
| (16) User-Name = "[email protected]" | |
| (16) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (16) Framed-MTU = 1400 | |
| (16) NAS-Port-Type = Wireless-802.11 | |
| (16) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (16) NAS-IP-Address = 127.0.0.1 | |
| (16) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (16) EAP-Message = 0x020200a119800000009716030100920100008e030156151ba17a1a0f9b26d39b85fb3942fc32e676659aba0f5adef1446bf5dbb68500004cc014c00a0039003800880087c00fc00500350084c013c00900330032c012c008009a00990045004400160013c00ec004c00dc003002f00960041000a0007c0 | |
| (16) State = 0xf679a215f77bbb0177d7bad98e3b1ad7 | |
| (16) Message-Authenticator = 0xbfd1b33617c9a7324414fa43589caca9 | |
| (16) session-state: No cached attributes | |
| (16) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (16) authorize { | |
| (16) policy filter_username { | |
| (16) if (!&User-Name) { | |
| (16) if (!&User-Name) -> FALSE | |
| (16) if (&User-Name =~ / /) { | |
| (16) if (&User-Name =~ / /) -> FALSE | |
| (16) if (&User-Name =~ /@.*@/ ) { | |
| (16) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (16) if (&User-Name =~ /\.\./ ) { | |
| (16) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (16) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (16) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (16) if (&User-Name =~ /\.$/) { | |
| (16) if (&User-Name =~ /\.$/) -> FALSE | |
| (16) if (&User-Name =~ /@\./) { | |
| (16) if (&User-Name =~ /@\./) -> FALSE | |
| (16) } # policy filter_username = notfound | |
| (16) [preprocess] = ok | |
| (16) [chap] = noop | |
| (16) [mschap] = noop | |
| (16) [digest] = noop | |
| (16) suffix: Checking for suffix after "@" | |
| (16) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (16) suffix: Found realm "example.com" | |
| (16) suffix: Adding Stripped-User-Name = "anon" | |
| (16) suffix: Adding Realm = "example.com" | |
| (16) suffix: Proxying request from user anon to realm example.com | |
| (16) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (16) [suffix] = updated | |
| (16) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (16) [eap] = noop | |
| (16) [files] = noop | |
| (16) [expiration] = noop | |
| (16) [logintime] = noop | |
| (16) [pap] = noop | |
| (16) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (16) session-state: No cached attributes | |
| (16) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (16) authorize { | |
| (16) policy filter_username { | |
| (16) if (!&User-Name) { | |
| (16) if (!&User-Name) -> FALSE | |
| (16) if (&User-Name =~ / /) { | |
| (16) if (&User-Name =~ / /) -> FALSE | |
| (16) if (&User-Name =~ /@.*@/ ) { | |
| (16) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (16) if (&User-Name =~ /\.\./ ) { | |
| (16) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (16) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (16) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (16) if (&User-Name =~ /\.$/) { | |
| (16) if (&User-Name =~ /\.$/) -> FALSE | |
| (16) if (&User-Name =~ /@\./) { | |
| (16) if (&User-Name =~ /@\./) -> FALSE | |
| (16) } # policy filter_username = notfound | |
| (16) [preprocess] = ok | |
| (16) [chap] = noop | |
| (16) [mschap] = noop | |
| (16) [digest] = noop | |
| (16) eap: Peer sent EAP Response (code 2) ID 2 length 161 | |
| (16) eap: Continuing tunnel setup | |
| (16) [eap] = ok | |
| (16) } # authorize = ok | |
| (16) Found Auth-Type = EAP | |
| (16) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (16) authenticate { | |
| (16) eap: Expiring EAP session with state 0xf679a215f77bbb01 | |
| (16) eap: Finished EAP session with state 0xf679a215f77bbb01 | |
| (16) eap: Previous EAP request found for state 0xf679a215f77bbb01, released from the list | |
| (16) eap: Peer sent packet with method EAP PEAP (25) | |
| (16) eap: Calling submodule eap_peap to process data | |
| (16) eap_peap: Continuing EAP-TLS | |
| (16) eap_peap: Peer indicated complete TLS record size will be 151 bytes | |
| (16) eap_peap: Got complete TLS record (151 bytes) | |
| (16) eap_peap: [eaptls verify] = length included | |
| (16) eap_peap: (other): before/accept initialization | |
| (16) eap_peap: TLS_accept: before/accept initialization | |
| (16) eap_peap: <<< TLS 1.0 Handshake [length 0092], ClientHello | |
| (16) eap_peap: TLS_accept: SSLv3 read client hello A | |
| (16) eap_peap: >>> TLS 1.0 Handshake [length 005e], ServerHello | |
| (16) eap_peap: TLS_accept: SSLv3 write server hello A | |
| (16) eap_peap: >>> TLS 1.0 Handshake [length 08d0], Certificate | |
| (16) eap_peap: TLS_accept: SSLv3 write certificate A | |
| (16) eap_peap: >>> TLS 1.0 Handshake [length 014b], ServerKeyExchange | |
| (16) eap_peap: TLS_accept: SSLv3 write key exchange A | |
| (16) eap_peap: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone | |
| (16) eap_peap: TLS_accept: SSLv3 write server done A | |
| (16) eap_peap: TLS_accept: SSLv3 flush data | |
| (16) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A | |
| (16) eap_peap: TLS_accept: Need to read more data: SSLv3 read client certificate A | |
| (16) eap_peap: In SSL Handshake Phase | |
| (16) eap_peap: In SSL Accept mode | |
| (16) eap_peap: [eaptls process] = handled | |
| (16) eap: Sending EAP Request (code 1) ID 3 length 1004 | |
| (16) eap: EAP session adding &reply:State = 0xf679a215f47abb01 | |
| (16) [eap] = handled | |
| (16) } # authenticate = handled | |
| (16) Using Post-Auth-Type Challenge | |
| (16) Post-Auth-Type sub-section not found. Ignoring. | |
| (16) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (16) Finished internally proxied request. | |
| (16) Clearing existing &reply: attributes | |
| (16) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (16) post-proxy { | |
| (16) eap: No pre-existing handler found | |
| (16) [eap] = noop | |
| (16) } # post-proxy = noop | |
| (16) Using Post-Auth-Type Challenge | |
| (16) Post-Auth-Type sub-section not found. Ignoring. | |
| (16) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (16) Sent Access-Challenge Id 2 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (16) EAP-Message = 0x010303ec19c000000a91160301005e0200005a030156151ba11d0db7d87b1f68f08163498399299684ba31d3279739e7904ba7fd0c2046f937b4d26bff4b55cb75db3a256142456dfb53fe5476c4d9e3e08b838f3843c014000012ff01000100000b000403000102000f00010116030108d00b0008cc00 | |
| (16) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (16) State = 0xf679a215f47abb0177d7bad98e3b1ad7 | |
| (16) Finished request | |
| Waking up in 0.5 seconds. | |
| (17) Received Access-Request Id 3 from 127.0.0.1:54692 to 127.0.0.1:1810 length 170 | |
| (17) User-Name = "[email protected]" | |
| (17) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (17) Framed-MTU = 1400 | |
| (17) NAS-Port-Type = Wireless-802.11 | |
| (17) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (17) NAS-IP-Address = 127.0.0.1 | |
| (17) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (17) EAP-Message = 0x020300061900 | |
| (17) State = 0xf679a215f47abb0177d7bad98e3b1ad7 | |
| (17) Message-Authenticator = 0x90637de2aa8dd25314c3c0d1f2dcd7f2 | |
| (17) session-state: No cached attributes | |
| (17) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (17) authorize { | |
| (17) policy filter_username { | |
| (17) if (!&User-Name) { | |
| (17) if (!&User-Name) -> FALSE | |
| (17) if (&User-Name =~ / /) { | |
| (17) if (&User-Name =~ / /) -> FALSE | |
| (17) if (&User-Name =~ /@.*@/ ) { | |
| (17) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (17) if (&User-Name =~ /\.\./ ) { | |
| (17) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (17) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (17) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (17) if (&User-Name =~ /\.$/) { | |
| (17) if (&User-Name =~ /\.$/) -> FALSE | |
| (17) if (&User-Name =~ /@\./) { | |
| (17) if (&User-Name =~ /@\./) -> FALSE | |
| (17) } # policy filter_username = notfound | |
| (17) [preprocess] = ok | |
| (17) [chap] = noop | |
| (17) [mschap] = noop | |
| (17) [digest] = noop | |
| (17) suffix: Checking for suffix after "@" | |
| (17) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (17) suffix: Found realm "example.com" | |
| (17) suffix: Adding Stripped-User-Name = "anon" | |
| (17) suffix: Adding Realm = "example.com" | |
| (17) suffix: Proxying request from user anon to realm example.com | |
| (17) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (17) [suffix] = updated | |
| (17) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (17) [eap] = noop | |
| (17) [files] = noop | |
| (17) [expiration] = noop | |
| (17) [logintime] = noop | |
| (17) [pap] = noop | |
| (17) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (17) session-state: No cached attributes | |
| (17) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (17) authorize { | |
| (17) policy filter_username { | |
| (17) if (!&User-Name) { | |
| (17) if (!&User-Name) -> FALSE | |
| (17) if (&User-Name =~ / /) { | |
| (17) if (&User-Name =~ / /) -> FALSE | |
| (17) if (&User-Name =~ /@.*@/ ) { | |
| (17) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (17) if (&User-Name =~ /\.\./ ) { | |
| (17) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (17) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (17) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (17) if (&User-Name =~ /\.$/) { | |
| (17) if (&User-Name =~ /\.$/) -> FALSE | |
| (17) if (&User-Name =~ /@\./) { | |
| (17) if (&User-Name =~ /@\./) -> FALSE | |
| (17) } # policy filter_username = notfound | |
| (17) [preprocess] = ok | |
| (17) [chap] = noop | |
| (17) [mschap] = noop | |
| (17) [digest] = noop | |
| (17) eap: Peer sent EAP Response (code 2) ID 3 length 6 | |
| (17) eap: Continuing tunnel setup | |
| (17) [eap] = ok | |
| (17) } # authorize = ok | |
| (17) Found Auth-Type = EAP | |
| (17) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (17) authenticate { | |
| (17) eap: Expiring EAP session with state 0xf679a215f47abb01 | |
| (17) eap: Finished EAP session with state 0xf679a215f47abb01 | |
| (17) eap: Previous EAP request found for state 0xf679a215f47abb01, released from the list | |
| (17) eap: Peer sent packet with method EAP PEAP (25) | |
| (17) eap: Calling submodule eap_peap to process data | |
| (17) eap_peap: Continuing EAP-TLS | |
| (17) eap_peap: Peer ACKed our handshake fragment | |
| (17) eap_peap: [eaptls verify] = request | |
| (17) eap_peap: [eaptls process] = handled | |
| (17) eap: Sending EAP Request (code 1) ID 4 length 1000 | |
| (17) eap: EAP session adding &reply:State = 0xf679a215f57dbb01 | |
| (17) [eap] = handled | |
| (17) } # authenticate = handled | |
| (17) Using Post-Auth-Type Challenge | |
| (17) Post-Auth-Type sub-section not found. Ignoring. | |
| (17) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (17) Finished internally proxied request. | |
| (17) Clearing existing &reply: attributes | |
| (17) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (17) post-proxy { | |
| (17) eap: No pre-existing handler found | |
| (17) [eap] = noop | |
| (17) } # post-proxy = noop | |
| (17) Using Post-Auth-Type Challenge | |
| (17) Post-Auth-Type sub-section not found. Ignoring. | |
| (17) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (17) Sent Access-Challenge Id 3 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (17) EAP-Message = 0x010403e81940db8b0982bced9ad59c49ba205310c45da57a964f96aff296e6c6714945628f773c6fa9e323ecd9472778a33325c65dcfdc7e7687564e8adc201b51390f373e0db5fe98c3ca131cd7197258bdf78e19f91054170804b2ac0c911ec51f79241f0a7345f6af8c11264d4ce058f3fb930004e5 | |
| (17) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (17) State = 0xf679a215f57dbb0177d7bad98e3b1ad7 | |
| (17) Finished request | |
| Waking up in 0.5 seconds. | |
| (18) Received Access-Request Id 4 from 127.0.0.1:54692 to 127.0.0.1:1810 length 170 | |
| (18) User-Name = "[email protected]" | |
| (18) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (18) Framed-MTU = 1400 | |
| (18) NAS-Port-Type = Wireless-802.11 | |
| (18) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (18) NAS-IP-Address = 127.0.0.1 | |
| (18) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (18) EAP-Message = 0x020400061900 | |
| (18) State = 0xf679a215f57dbb0177d7bad98e3b1ad7 | |
| (18) Message-Authenticator = 0x854bcdfdb561fb5e43c67a537c7145cf | |
| (18) session-state: No cached attributes | |
| (18) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (18) authorize { | |
| (18) policy filter_username { | |
| (18) if (!&User-Name) { | |
| (18) if (!&User-Name) -> FALSE | |
| (18) if (&User-Name =~ / /) { | |
| (18) if (&User-Name =~ / /) -> FALSE | |
| (18) if (&User-Name =~ /@.*@/ ) { | |
| (18) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (18) if (&User-Name =~ /\.\./ ) { | |
| (18) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (18) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (18) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (18) if (&User-Name =~ /\.$/) { | |
| (18) if (&User-Name =~ /\.$/) -> FALSE | |
| (18) if (&User-Name =~ /@\./) { | |
| (18) if (&User-Name =~ /@\./) -> FALSE | |
| (18) } # policy filter_username = notfound | |
| (18) [preprocess] = ok | |
| (18) [chap] = noop | |
| (18) [mschap] = noop | |
| (18) [digest] = noop | |
| (18) suffix: Checking for suffix after "@" | |
| (18) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (18) suffix: Found realm "example.com" | |
| (18) suffix: Adding Stripped-User-Name = "anon" | |
| (18) suffix: Adding Realm = "example.com" | |
| (18) suffix: Proxying request from user anon to realm example.com | |
| (18) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (18) [suffix] = updated | |
| (18) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (18) [eap] = noop | |
| (18) [files] = noop | |
| (18) [expiration] = noop | |
| (18) [logintime] = noop | |
| (18) [pap] = noop | |
| (18) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (18) session-state: No cached attributes | |
| (18) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (18) authorize { | |
| (18) policy filter_username { | |
| (18) if (!&User-Name) { | |
| (18) if (!&User-Name) -> FALSE | |
| (18) if (&User-Name =~ / /) { | |
| (18) if (&User-Name =~ / /) -> FALSE | |
| (18) if (&User-Name =~ /@.*@/ ) { | |
| (18) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (18) if (&User-Name =~ /\.\./ ) { | |
| (18) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (18) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (18) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (18) if (&User-Name =~ /\.$/) { | |
| (18) if (&User-Name =~ /\.$/) -> FALSE | |
| (18) if (&User-Name =~ /@\./) { | |
| (18) if (&User-Name =~ /@\./) -> FALSE | |
| (18) } # policy filter_username = notfound | |
| (18) [preprocess] = ok | |
| (18) [chap] = noop | |
| (18) [mschap] = noop | |
| (18) [digest] = noop | |
| (18) eap: Peer sent EAP Response (code 2) ID 4 length 6 | |
| (18) eap: Continuing tunnel setup | |
| (18) [eap] = ok | |
| (18) } # authorize = ok | |
| (18) Found Auth-Type = EAP | |
| (18) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (18) authenticate { | |
| (18) eap: Expiring EAP session with state 0xf679a215f57dbb01 | |
| (18) eap: Finished EAP session with state 0xf679a215f57dbb01 | |
| (18) eap: Previous EAP request found for state 0xf679a215f57dbb01, released from the list | |
| (18) eap: Peer sent packet with method EAP PEAP (25) | |
| (18) eap: Calling submodule eap_peap to process data | |
| (18) eap_peap: Continuing EAP-TLS | |
| (18) eap_peap: Peer ACKed our handshake fragment | |
| (18) eap_peap: [eaptls verify] = request | |
| (18) eap_peap: [eaptls process] = handled | |
| (18) eap: Sending EAP Request (code 1) ID 5 length 723 | |
| (18) eap: EAP session adding &reply:State = 0xf679a215f27cbb01 | |
| (18) [eap] = handled | |
| (18) } # authenticate = handled | |
| (18) Using Post-Auth-Type Challenge | |
| (18) Post-Auth-Type sub-section not found. Ignoring. | |
| (18) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (18) Finished internally proxied request. | |
| (18) Clearing existing &reply: attributes | |
| (18) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (18) post-proxy { | |
| (18) eap: No pre-existing handler found | |
| (18) [eap] = noop | |
| (18) } # post-proxy = noop | |
| (18) Using Post-Auth-Type Challenge | |
| (18) Post-Auth-Type sub-section not found. Ignoring. | |
| (18) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (18) Sent Access-Challenge Id 4 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (18) EAP-Message = 0x010502d31900696361746520417574686f72697479820900dd607d2bd65f219f300c0603551d13040530030101ff30360603551d1f042f302d302ba029a0278625687474703a2f2f7777772e6578616d706c652e636f6d2f6578616d706c655f63612e63726c300d06092a864886f70d01010505000382 | |
| (18) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (18) State = 0xf679a215f27cbb0177d7bad98e3b1ad7 | |
| (18) Finished request | |
| Waking up in 0.5 seconds. | |
| (19) Received Access-Request Id 5 from 127.0.0.1:54692 to 127.0.0.1:1810 length 308 | |
| (19) User-Name = "[email protected]" | |
| (19) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (19) Framed-MTU = 1400 | |
| (19) NAS-Port-Type = Wireless-802.11 | |
| (19) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (19) NAS-IP-Address = 127.0.0.1 | |
| (19) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (19) EAP-Message = 0x02050090198000000086160301004610000042410453d017c02602f647d3bab0030ef89c0f163e65ae77f184fb465d87e3601ca93a563929652f50571b792b020399eabb7a45e2bedb5e4faa5da8d315198102088f14030100010116030100302198fa4624c2a4be9162ec60dc65932babb2df4b85423e | |
| (19) State = 0xf679a215f27cbb0177d7bad98e3b1ad7 | |
| (19) Message-Authenticator = 0xda075a0080c4f9c58bb8c0addac2cb47 | |
| (19) session-state: No cached attributes | |
| (19) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (19) authorize { | |
| (19) policy filter_username { | |
| (19) if (!&User-Name) { | |
| (19) if (!&User-Name) -> FALSE | |
| (19) if (&User-Name =~ / /) { | |
| (19) if (&User-Name =~ / /) -> FALSE | |
| (19) if (&User-Name =~ /@.*@/ ) { | |
| (19) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (19) if (&User-Name =~ /\.\./ ) { | |
| (19) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (19) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (19) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (19) if (&User-Name =~ /\.$/) { | |
| (19) if (&User-Name =~ /\.$/) -> FALSE | |
| (19) if (&User-Name =~ /@\./) { | |
| (19) if (&User-Name =~ /@\./) -> FALSE | |
| (19) } # policy filter_username = notfound | |
| (19) [preprocess] = ok | |
| (19) [chap] = noop | |
| (19) [mschap] = noop | |
| (19) [digest] = noop | |
| (19) suffix: Checking for suffix after "@" | |
| (19) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (19) suffix: Found realm "example.com" | |
| (19) suffix: Adding Stripped-User-Name = "anon" | |
| (19) suffix: Adding Realm = "example.com" | |
| (19) suffix: Proxying request from user anon to realm example.com | |
| (19) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (19) [suffix] = updated | |
| (19) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (19) [eap] = noop | |
| (19) [files] = noop | |
| (19) [expiration] = noop | |
| (19) [logintime] = noop | |
| (19) [pap] = noop | |
| (19) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (19) session-state: No cached attributes | |
| (19) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (19) authorize { | |
| (19) policy filter_username { | |
| (19) if (!&User-Name) { | |
| (19) if (!&User-Name) -> FALSE | |
| (19) if (&User-Name =~ / /) { | |
| (19) if (&User-Name =~ / /) -> FALSE | |
| (19) if (&User-Name =~ /@.*@/ ) { | |
| (19) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (19) if (&User-Name =~ /\.\./ ) { | |
| (19) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (19) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (19) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (19) if (&User-Name =~ /\.$/) { | |
| (19) if (&User-Name =~ /\.$/) -> FALSE | |
| (19) if (&User-Name =~ /@\./) { | |
| (19) if (&User-Name =~ /@\./) -> FALSE | |
| (19) } # policy filter_username = notfound | |
| (19) [preprocess] = ok | |
| (19) [chap] = noop | |
| (19) [mschap] = noop | |
| (19) [digest] = noop | |
| (19) eap: Peer sent EAP Response (code 2) ID 5 length 144 | |
| (19) eap: Continuing tunnel setup | |
| (19) [eap] = ok | |
| (19) } # authorize = ok | |
| (19) Found Auth-Type = EAP | |
| (19) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (19) authenticate { | |
| (19) eap: Expiring EAP session with state 0xf679a215f27cbb01 | |
| (19) eap: Finished EAP session with state 0xf679a215f27cbb01 | |
| (19) eap: Previous EAP request found for state 0xf679a215f27cbb01, released from the list | |
| (19) eap: Peer sent packet with method EAP PEAP (25) | |
| (19) eap: Calling submodule eap_peap to process data | |
| (19) eap_peap: Continuing EAP-TLS | |
| (19) eap_peap: Peer indicated complete TLS record size will be 134 bytes | |
| (19) eap_peap: Got complete TLS record (134 bytes) | |
| (19) eap_peap: [eaptls verify] = length included | |
| (19) eap_peap: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange | |
| (19) eap_peap: TLS_accept: SSLv3 read client key exchange A | |
| (19) eap_peap: <<< TLS 1.0 ChangeCipherSpec [length 0001] | |
| (19) eap_peap: <<< TLS 1.0 Handshake [length 0010], Finished | |
| (19) eap_peap: TLS_accept: SSLv3 read finished A | |
| (19) eap_peap: >>> TLS 1.0 ChangeCipherSpec [length 0001] | |
| (19) eap_peap: TLS_accept: SSLv3 write change cipher spec A | |
| (19) eap_peap: >>> TLS 1.0 Handshake [length 0010], Finished | |
| (19) eap_peap: TLS_accept: SSLv3 write finished A | |
| (19) eap_peap: TLS_accept: SSLv3 flush data | |
| (19) eap_peap: (other): SSL negotiation finished successfully | |
| (19) eap_peap: SSL Connection Established | |
| (19) eap_peap: [eaptls process] = handled | |
| (19) eap: Sending EAP Request (code 1) ID 6 length 65 | |
| (19) eap: EAP session adding &reply:State = 0xf679a215f37fbb01 | |
| (19) [eap] = handled | |
| (19) } # authenticate = handled | |
| (19) Using Post-Auth-Type Challenge | |
| (19) Post-Auth-Type sub-section not found. Ignoring. | |
| (19) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (19) Finished internally proxied request. | |
| (19) Clearing existing &reply: attributes | |
| (19) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (19) post-proxy { | |
| (19) eap: No pre-existing handler found | |
| (19) [eap] = noop | |
| (19) } # post-proxy = noop | |
| (19) Using Post-Auth-Type Challenge | |
| (19) Post-Auth-Type sub-section not found. Ignoring. | |
| (19) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (19) Sent Access-Challenge Id 5 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (19) EAP-Message = 0x01060041190014030100010116030100303ec0e404131dbd1a08f712aa55a9a54f92b180ab96dc1cedf3f710f25261f3f54fd142016b645ad6cd5626d388cd2709 | |
| (19) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (19) State = 0xf679a215f37fbb0177d7bad98e3b1ad7 | |
| (19) Finished request | |
| Waking up in 0.5 seconds. | |
| (20) Received Access-Request Id 6 from 127.0.0.1:54692 to 127.0.0.1:1810 length 170 | |
| (20) User-Name = "[email protected]" | |
| (20) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (20) Framed-MTU = 1400 | |
| (20) NAS-Port-Type = Wireless-802.11 | |
| (20) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (20) NAS-IP-Address = 127.0.0.1 | |
| (20) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (20) EAP-Message = 0x020600061900 | |
| (20) State = 0xf679a215f37fbb0177d7bad98e3b1ad7 | |
| (20) Message-Authenticator = 0x66347d5f4d402214d070bf3ac0fbd643 | |
| (20) session-state: No cached attributes | |
| (20) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (20) authorize { | |
| (20) policy filter_username { | |
| (20) if (!&User-Name) { | |
| (20) if (!&User-Name) -> FALSE | |
| (20) if (&User-Name =~ / /) { | |
| (20) if (&User-Name =~ / /) -> FALSE | |
| (20) if (&User-Name =~ /@.*@/ ) { | |
| (20) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (20) if (&User-Name =~ /\.\./ ) { | |
| (20) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (20) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (20) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (20) if (&User-Name =~ /\.$/) { | |
| (20) if (&User-Name =~ /\.$/) -> FALSE | |
| (20) if (&User-Name =~ /@\./) { | |
| (20) if (&User-Name =~ /@\./) -> FALSE | |
| (20) } # policy filter_username = notfound | |
| (20) [preprocess] = ok | |
| (20) [chap] = noop | |
| (20) [mschap] = noop | |
| (20) [digest] = noop | |
| (20) suffix: Checking for suffix after "@" | |
| (20) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (20) suffix: Found realm "example.com" | |
| (20) suffix: Adding Stripped-User-Name = "anon" | |
| (20) suffix: Adding Realm = "example.com" | |
| (20) suffix: Proxying request from user anon to realm example.com | |
| (20) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (20) [suffix] = updated | |
| (20) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (20) [eap] = noop | |
| (20) [files] = noop | |
| (20) [expiration] = noop | |
| (20) [logintime] = noop | |
| (20) [pap] = noop | |
| (20) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (20) session-state: No cached attributes | |
| (20) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (20) authorize { | |
| (20) policy filter_username { | |
| (20) if (!&User-Name) { | |
| (20) if (!&User-Name) -> FALSE | |
| (20) if (&User-Name =~ / /) { | |
| (20) if (&User-Name =~ / /) -> FALSE | |
| (20) if (&User-Name =~ /@.*@/ ) { | |
| (20) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (20) if (&User-Name =~ /\.\./ ) { | |
| (20) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (20) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (20) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (20) if (&User-Name =~ /\.$/) { | |
| (20) if (&User-Name =~ /\.$/) -> FALSE | |
| (20) if (&User-Name =~ /@\./) { | |
| (20) if (&User-Name =~ /@\./) -> FALSE | |
| (20) } # policy filter_username = notfound | |
| (20) [preprocess] = ok | |
| (20) [chap] = noop | |
| (20) [mschap] = noop | |
| (20) [digest] = noop | |
| (20) eap: Peer sent EAP Response (code 2) ID 6 length 6 | |
| (20) eap: Continuing tunnel setup | |
| (20) [eap] = ok | |
| (20) } # authorize = ok | |
| (20) Found Auth-Type = EAP | |
| (20) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (20) authenticate { | |
| (20) eap: Expiring EAP session with state 0xf679a215f37fbb01 | |
| (20) eap: Finished EAP session with state 0xf679a215f37fbb01 | |
| (20) eap: Previous EAP request found for state 0xf679a215f37fbb01, released from the list | |
| (20) eap: Peer sent packet with method EAP PEAP (25) | |
| (20) eap: Calling submodule eap_peap to process data | |
| (20) eap_peap: Continuing EAP-TLS | |
| (20) eap_peap: Peer ACKed our handshake fragment. handshake is finished | |
| (20) eap_peap: [eaptls verify] = success | |
| (20) eap_peap: [eaptls process] = success | |
| (20) eap_peap: Session established. Decoding tunneled attributes | |
| (20) eap_peap: PEAP state TUNNEL ESTABLISHED | |
| (20) eap: Sending EAP Request (code 1) ID 7 length 43 | |
| (20) eap: EAP session adding &reply:State = 0xf679a215f07ebb01 | |
| (20) [eap] = handled | |
| (20) } # authenticate = handled | |
| (20) Using Post-Auth-Type Challenge | |
| (20) Post-Auth-Type sub-section not found. Ignoring. | |
| (20) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (20) Finished internally proxied request. | |
| (20) Clearing existing &reply: attributes | |
| (20) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (20) post-proxy { | |
| (20) eap: No pre-existing handler found | |
| (20) [eap] = noop | |
| (20) } # post-proxy = noop | |
| (20) Using Post-Auth-Type Challenge | |
| (20) Post-Auth-Type sub-section not found. Ignoring. | |
| (20) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (20) Sent Access-Challenge Id 6 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (20) EAP-Message = 0x0107002b19001703010020f3231a82478b1eb06cefad7af13ec9c83ca49998f94a2e982cc5ba48081c3eec | |
| (20) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (20) State = 0xf679a215f07ebb0177d7bad98e3b1ad7 | |
| (20) Finished request | |
| Waking up in 0.5 seconds. | |
| (21) Received Access-Request Id 7 from 127.0.0.1:54692 to 127.0.0.1:1810 length 260 | |
| (21) User-Name = "[email protected]" | |
| (21) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (21) Framed-MTU = 1400 | |
| (21) NAS-Port-Type = Wireless-802.11 | |
| (21) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (21) NAS-IP-Address = 127.0.0.1 | |
| (21) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (21) EAP-Message = 0x0207006019001703010020584091273451d6411dca61d09a23f1cd38c880e4d29b05d45fe1644b5abdfe5917030100307cc8dac4ada4eefbb27d05d5295f00b41def236460d829cbed9ac56b5efcc506bc22f9bf0a944c45d437529e48a58ba8 | |
| (21) State = 0xf679a215f07ebb0177d7bad98e3b1ad7 | |
| (21) Message-Authenticator = 0x25e020898b0a19a097bde5b1885c1f3e | |
| (21) session-state: No cached attributes | |
| (21) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (21) authorize { | |
| (21) policy filter_username { | |
| (21) if (!&User-Name) { | |
| (21) if (!&User-Name) -> FALSE | |
| (21) if (&User-Name =~ / /) { | |
| (21) if (&User-Name =~ / /) -> FALSE | |
| (21) if (&User-Name =~ /@.*@/ ) { | |
| (21) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (21) if (&User-Name =~ /\.\./ ) { | |
| (21) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (21) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (21) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (21) if (&User-Name =~ /\.$/) { | |
| (21) if (&User-Name =~ /\.$/) -> FALSE | |
| (21) if (&User-Name =~ /@\./) { | |
| (21) if (&User-Name =~ /@\./) -> FALSE | |
| (21) } # policy filter_username = notfound | |
| (21) [preprocess] = ok | |
| (21) [chap] = noop | |
| (21) [mschap] = noop | |
| (21) [digest] = noop | |
| (21) suffix: Checking for suffix after "@" | |
| (21) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (21) suffix: Found realm "example.com" | |
| (21) suffix: Adding Stripped-User-Name = "anon" | |
| (21) suffix: Adding Realm = "example.com" | |
| (21) suffix: Proxying request from user anon to realm example.com | |
| (21) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (21) [suffix] = updated | |
| (21) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (21) [eap] = noop | |
| (21) [files] = noop | |
| (21) [expiration] = noop | |
| (21) [logintime] = noop | |
| (21) [pap] = noop | |
| (21) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (21) session-state: No cached attributes | |
| (21) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (21) authorize { | |
| (21) policy filter_username { | |
| (21) if (!&User-Name) { | |
| (21) if (!&User-Name) -> FALSE | |
| (21) if (&User-Name =~ / /) { | |
| (21) if (&User-Name =~ / /) -> FALSE | |
| (21) if (&User-Name =~ /@.*@/ ) { | |
| (21) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (21) if (&User-Name =~ /\.\./ ) { | |
| (21) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (21) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (21) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (21) if (&User-Name =~ /\.$/) { | |
| (21) if (&User-Name =~ /\.$/) -> FALSE | |
| (21) if (&User-Name =~ /@\./) { | |
| (21) if (&User-Name =~ /@\./) -> FALSE | |
| (21) } # policy filter_username = notfound | |
| (21) [preprocess] = ok | |
| (21) [chap] = noop | |
| (21) [mschap] = noop | |
| (21) [digest] = noop | |
| (21) eap: Peer sent EAP Response (code 2) ID 7 length 96 | |
| (21) eap: Continuing tunnel setup | |
| (21) [eap] = ok | |
| (21) } # authorize = ok | |
| (21) Found Auth-Type = EAP | |
| (21) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (21) authenticate { | |
| (21) eap: Expiring EAP session with state 0xf679a215f07ebb01 | |
| (21) eap: Finished EAP session with state 0xf679a215f07ebb01 | |
| (21) eap: Previous EAP request found for state 0xf679a215f07ebb01, released from the list | |
| (21) eap: Peer sent packet with method EAP PEAP (25) | |
| (21) eap: Calling submodule eap_peap to process data | |
| (21) eap_peap: Continuing EAP-TLS | |
| (21) eap_peap: [eaptls verify] = ok | |
| (21) eap_peap: Done initial handshake | |
| (21) eap_peap: [eaptls process] = ok | |
| (21) eap_peap: Session established. Decoding tunneled attributes | |
| (21) eap_peap: PEAP state WAITING FOR INNER IDENTITY | |
| (21) eap_peap: Identity - [email protected] | |
| (21) eap_peap: Got inner identity '[email protected]' | |
| (21) eap_peap: Setting default EAP type for tunneled EAP session | |
| (21) eap_peap: Got tunneled request | |
| (21) eap_peap: EAP-Message = 0x020700180162756775736572406578616d706c652e636f6d | |
| (21) eap_peap: Setting User-Name to [email protected] | |
| (21) eap_peap: Sending tunneled request to inner-tunnel | |
| (21) eap_peap: EAP-Message = 0x020700180162756775736572406578616d706c652e636f6d | |
| (21) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 | |
| (21) eap_peap: User-Name = "[email protected]" | |
| (21) Virtual server inner-tunnel received request | |
| (21) EAP-Message = 0x020700180162756775736572406578616d706c652e636f6d | |
| (21) FreeRADIUS-Proxied-To = 127.0.0.1 | |
| (21) User-Name = "[email protected]" | |
| (21) server inner-tunnel { | |
| (21) # Executing section authorize from file /etc/raddb/sites-enabled-bug/inner-tunnel | |
| (21) authorize { | |
| (21) update control { | |
| (21) &Cleartext-Password := testing123 | |
| (21) } # update control = noop | |
| (21) [chap] = noop | |
| (21) [mschap] = noop | |
| (21) suffix: Checking for suffix after "@" | |
| (21) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (21) suffix: Found realm "example.com" | |
| (21) suffix: Adding Stripped-User-Name = "buguser" | |
| (21) suffix: Adding Realm = "example.com" | |
| (21) suffix: Proxying request from user buguser to realm example.com | |
| (21) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (21) [suffix] = updated | |
| (21) update control { | |
| (21) &Proxy-To-Realm := LOCAL | |
| (21) } # update control = noop | |
| (21) eap: Peer sent EAP Response (code 2) ID 7 length 24 | |
| (21) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize | |
| (21) [eap] = ok | |
| (21) } # authorize = ok | |
| (21) Found Auth-Type = EAP | |
| (21) # Executing group from file /etc/raddb/sites-enabled-bug/inner-tunnel | |
| (21) authenticate { | |
| (21) eap: Multiple levels of TLS nesting is invalid | |
| (21) eap: Sending EAP Failure (code 4) ID 7 length 4 | |
| (21) eap: Failed in EAP select | |
| (21) [eap] = invalid | |
| (21) } # authenticate = invalid | |
| (21) Failed to authenticate the user | |
| (21) Using Post-Auth-Type Reject | |
| (21) # Executing group from file /etc/raddb/sites-enabled-bug/inner-tunnel | |
| (21) Post-Auth-Type REJECT { | |
| (21) attr_filter.access_reject: EXPAND %{User-Name} | |
| (21) attr_filter.access_reject: --> [email protected] | |
| (21) attr_filter.access_reject: Matched entry DEFAULT at line 11 | |
| (21) [attr_filter.access_reject] = updated | |
| (21) update outer.session-state { | |
| (21) No attributes updated | |
| (21) } # update outer.session-state = noop | |
| (21) } # Post-Auth-Type REJECT = updated | |
| (21) } # server inner-tunnel | |
| (21) Virtual server sending reply | |
| (21) EAP-Message = 0x04070004 | |
| (21) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (21) eap_peap: Got tunneled reply code 3 | |
| (21) eap_peap: EAP-Message = 0x04070004 | |
| (21) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 | |
| (21) eap_peap: Got tunneled reply RADIUS code 3 | |
| (21) eap_peap: EAP-Message = 0x04070004 | |
| (21) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 | |
| (21) eap_peap: Tunneled authentication was rejected | |
| (21) eap_peap: FAILURE | |
| (21) eap: Sending EAP Request (code 1) ID 8 length 43 | |
| (21) eap: EAP session adding &reply:State = 0xf679a215f171bb01 | |
| (21) [eap] = handled | |
| (21) } # authenticate = handled | |
| (21) Using Post-Auth-Type Challenge | |
| (21) Post-Auth-Type sub-section not found. Ignoring. | |
| (21) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (21) Finished internally proxied request. | |
| (21) Clearing existing &reply: attributes | |
| (21) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (21) post-proxy { | |
| (21) eap: No pre-existing handler found | |
| (21) [eap] = noop | |
| (21) } # post-proxy = noop | |
| (21) Using Post-Auth-Type Challenge | |
| (21) Post-Auth-Type sub-section not found. Ignoring. | |
| (21) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (21) Sent Access-Challenge Id 7 from 127.0.0.1:1810 to 127.0.0.1:54692 length 0 | |
| (21) EAP-Message = 0x0108002b19001703010020b8ddc0f479299a10c8f25916ef1d32269cdd14c27fb173b8f54d8c4922484cf8 | |
| (21) Message-Authenticator = 0x00000000000000000000000000000000 | |
| (21) State = 0xf679a215f171bb0177d7bad98e3b1ad7 | |
| (21) Finished request | |
| Waking up in 0.5 seconds. | |
| (22) Received Access-Request Id 8 from 127.0.0.1:54692 to 127.0.0.1:1810 length 244 | |
| (22) User-Name = "[email protected]" | |
| (22) Calling-Station-Id = "D4-20-6D-84-14-85" | |
| (22) Framed-MTU = 1400 | |
| (22) NAS-Port-Type = Wireless-802.11 | |
| (22) Connect-Info = "CONNECT 11Mbps 802.11b" | |
| (22) NAS-IP-Address = 127.0.0.1 | |
| (22) Called-Station-Id = "00-01-02-03-04-03:example" | |
| (22) EAP-Message = 0x020800501900170301002049d2123cedd06001df227f2d9cf21edc6ef5b3d2f25b0705da47b759073532fc1703010020fd80d0847b74c3437064c224e24d35186b4096edf5cb8397e42d4454fc05ff21 | |
| (22) State = 0xf679a215f171bb0177d7bad98e3b1ad7 | |
| (22) Message-Authenticator = 0xe84e3eddcd274cd6c2e1ceebdac2a42d | |
| (22) session-state: No cached attributes | |
| (22) # Executing section authorize from file /etc/raddb/sites-enabled-bug/default | |
| (22) authorize { | |
| (22) policy filter_username { | |
| (22) if (!&User-Name) { | |
| (22) if (!&User-Name) -> FALSE | |
| (22) if (&User-Name =~ / /) { | |
| (22) if (&User-Name =~ / /) -> FALSE | |
| (22) if (&User-Name =~ /@.*@/ ) { | |
| (22) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (22) if (&User-Name =~ /\.\./ ) { | |
| (22) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (22) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (22) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (22) if (&User-Name =~ /\.$/) { | |
| (22) if (&User-Name =~ /\.$/) -> FALSE | |
| (22) if (&User-Name =~ /@\./) { | |
| (22) if (&User-Name =~ /@\./) -> FALSE | |
| (22) } # policy filter_username = notfound | |
| (22) [preprocess] = ok | |
| (22) [chap] = noop | |
| (22) [mschap] = noop | |
| (22) [digest] = noop | |
| (22) suffix: Checking for suffix after "@" | |
| (22) suffix: Looking up realm "example.com" for User-Name = "[email protected]" | |
| (22) suffix: Found realm "example.com" | |
| (22) suffix: Adding Stripped-User-Name = "anon" | |
| (22) suffix: Adding Realm = "example.com" | |
| (22) suffix: Proxying request from user anon to realm example.com | |
| (22) suffix: Preparing to proxy authentication request to realm "example.com" | |
| (22) [suffix] = updated | |
| (22) eap: Request is supposed to be proxied to Realm example.com. Not doing EAP. | |
| (22) [eap] = noop | |
| (22) [files] = noop | |
| (22) [expiration] = noop | |
| (22) [logintime] = noop | |
| (22) [pap] = noop | |
| (22) } # authorize = updated | |
| Home server pool my_auth_failover failing over to fallback virtual.example.com | |
| Proxying to virtual server virtual.example.com | |
| (22) session-state: No cached attributes | |
| (22) # Executing section authorize from file /etc/raddb/proxy-bug.conf | |
| (22) authorize { | |
| (22) policy filter_username { | |
| (22) if (!&User-Name) { | |
| (22) if (!&User-Name) -> FALSE | |
| (22) if (&User-Name =~ / /) { | |
| (22) if (&User-Name =~ / /) -> FALSE | |
| (22) if (&User-Name =~ /@.*@/ ) { | |
| (22) if (&User-Name =~ /@.*@/ ) -> FALSE | |
| (22) if (&User-Name =~ /\.\./ ) { | |
| (22) if (&User-Name =~ /\.\./ ) -> FALSE | |
| (22) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) { | |
| (22) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/)) -> FALSE | |
| (22) if (&User-Name =~ /\.$/) { | |
| (22) if (&User-Name =~ /\.$/) -> FALSE | |
| (22) if (&User-Name =~ /@\./) { | |
| (22) if (&User-Name =~ /@\./) -> FALSE | |
| (22) } # policy filter_username = notfound | |
| (22) [preprocess] = ok | |
| (22) [chap] = noop | |
| (22) [mschap] = noop | |
| (22) [digest] = noop | |
| (22) eap: Peer sent EAP Response (code 2) ID 8 length 80 | |
| (22) eap: Continuing tunnel setup | |
| (22) [eap] = ok | |
| (22) } # authorize = ok | |
| (22) Found Auth-Type = EAP | |
| (22) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (22) authenticate { | |
| (22) eap: Expiring EAP session with state 0xf679a215f171bb01 | |
| (22) eap: Finished EAP session with state 0xf679a215f171bb01 | |
| (22) eap: Previous EAP request found for state 0xf679a215f171bb01, released from the list | |
| (22) eap: Peer sent packet with method EAP PEAP (25) | |
| (22) eap: Calling submodule eap_peap to process data | |
| (22) eap_peap: Continuing EAP-TLS | |
| (22) eap_peap: [eaptls verify] = ok | |
| (22) eap_peap: Done initial handshake | |
| (22) eap_peap: [eaptls process] = ok | |
| (22) eap_peap: Session established. Decoding tunneled attributes | |
| (22) eap_peap: PEAP state send tlv failure | |
| (22) eap_peap: Received EAP-TLV response | |
| (22) eap_peap: The users session was previously rejected: returning reject (again.) | |
| (22) eap_peap: This means you need to read the PREVIOUS messages in the debug output | |
| (22) eap_peap: to find out the reason why the user was rejected | |
| (22) eap_peap: Look for "reject" or "fail". Those earlier messages will tell you | |
| (22) eap_peap: what went wrong, and how to fix the problem | |
| (22) eap: ERROR: Failed continuing EAP PEAP (25) session. EAP sub-module failed | |
| (22) eap: Sending EAP Failure (code 4) ID 8 length 4 | |
| (22) eap: Failed in EAP select | |
| (22) [eap] = invalid | |
| (22) } # authenticate = invalid | |
| (22) Failed to authenticate the user | |
| (22) Using Post-Auth-Type Reject | |
| (22) # Executing group from file /etc/raddb/proxy-bug.conf | |
| (22) Post-Auth-Type REJECT { | |
| (22) attr_filter.access_reject: EXPAND %{User-Name} | |
| (22) attr_filter.access_reject: --> [email protected] | |
| (22) attr_filter.access_reject: Matched entry DEFAULT at line 11 | |
| (22) [attr_filter.access_reject] = updated | |
| (22) [eap] = noop | |
| (22) policy remove_reply_message_if_eap { | |
| (22) if (&reply:EAP-Message && &reply:Reply-Message) { | |
| (22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE | |
| (22) else { | |
| (22) [noop] = noop | |
| (22) } # else = noop | |
| (22) } # policy remove_reply_message_if_eap = noop | |
| (22) } # Post-Auth-Type REJECT = updated | |
| (22) Finished internally proxied request. | |
| (22) Clearing existing &reply: attributes | |
| (22) # Executing section post-proxy from file /etc/raddb/sites-enabled-bug/default | |
| (22) post-proxy { | |
| (22) eap: No pre-existing handler found | |
| (22) [eap] = noop | |
| (22) } # post-proxy = noop | |
| (22) Using Post-Auth-Type Reject | |
| (22) # Executing group from file /etc/raddb/sites-enabled-bug/default | |
| (22) Post-Auth-Type REJECT { | |
| (22) attr_filter.access_reject: EXPAND %{User-Name} | |
| (22) attr_filter.access_reject: --> [email protected] | |
| (22) attr_filter.access_reject: Matched entry DEFAULT at line 11 | |
| (22) [attr_filter.access_reject] = updated | |
| (22) [eap] = noop | |
| (22) policy remove_reply_message_if_eap { | |
| (22) if (&reply:EAP-Message && &reply:Reply-Message) { | |
| (22) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE | |
| (22) else { | |
| (22) [noop] = noop | |
| (22) } # else = noop | |
| (22) } # policy remove_reply_message_if_eap = noop | |
| (22) } # Post-Auth-Type REJECT = updated | |
| (22) Delaying response for 1.000000 seconds | |
| Waking up in 0.3 seconds. | |
| Waking up in 0.2 seconds. | |
| PING: Waiting 4 seconds for response to ping | |
| (23) Sent Status-Server Id 237 from 0.0.0.0:37553 to 127.0.0.1:1808 length 0 | |
| (23) Message-Authenticator := 0x00 | |
| (23) NAS-Identifier := "Status Check 13. Are you alive?" | |
| PING: Next status packet in 30 seconds | |
| Waking up in 0.4 seconds. | |
| (22) Sending delayed response | |
| (22) Sent Access-Reject Id 8 from 127.0.0.1:1810 to 127.0.0.1:54692 length 44 | |
| (22) EAP-Message = 0x04080004 | |
| (22) Message-Authenticator = 0x00000000000000000000000000000000 | |
| Waking up in 3.5 seconds. | |
| No response to status check 23 ID 237 for home server 127.0.0.1 port 1808 | |
| Waking up in 0.3 seconds. | |
| (14) Cleaning up request packet ID 0 with timestamp +411 | |
| (15) Cleaning up request packet ID 1 with timestamp +411 | |
| (16) Cleaning up request packet ID 2 with timestamp +411 | |
| (17) Cleaning up request packet ID 3 with timestamp +411 | |
| (18) Cleaning up request packet ID 4 with timestamp +411 | |
| (19) Cleaning up request packet ID 5 with timestamp +411 | |
| (20) Cleaning up request packet ID 6 with timestamp +411 | |
| (21) Cleaning up request packet ID 7 with timestamp +411 | |
| (22) Cleaning up request packet ID 8 with timestamp +411 | |
| Waking up in 25.0 seconds. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment