Forum Debian Users Gang

root@radius:/etc/freeradius# freeradius -X
FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03
Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. 
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A 
PARTICULAR PURPOSE. 
You may redistribute copies of FreeRADIUS under the terms of the 
GNU General Public License v2. 
Starting - reading configuration files ...
including configuration file /etc/freeradius/radiusd.conf
including configuration file /etc/freeradius/proxy.conf
including configuration file /etc/freeradius/clients.conf
including files in directory /etc/freeradius/modules/
including configuration file /etc/freeradius/modules/passwd
including configuration file /etc/freeradius/modules/opendirectory
including configuration file /etc/freeradius/modules/cui
including configuration file /etc/freeradius/modules/mac2ip
including configuration file /etc/freeradius/modules/checkval
including configuration file /etc/freeradius/modules/smsotp
including configuration file /etc/freeradius/modules/realm
including configuration file /etc/freeradius/modules/acct_unique
including configuration file /etc/freeradius/modules/otp
including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login
including configuration file /etc/freeradius/modules/ntlm_auth
including configuration file /etc/freeradius/modules/expiration
including configuration file /etc/freeradius/modules/linelog
including configuration file /etc/freeradius/modules/ldap
including configuration file /etc/freeradius/modules/ippool
including configuration file /etc/freeradius/modules/detail.log
including configuration file /etc/freeradius/modules/chap
including configuration file /etc/freeradius/modules/unix
including configuration file /etc/freeradius/modules/policy
including configuration file /etc/freeradius/modules/detail.example.com
including configuration file /etc/freeradius/modules/logintime
including configuration file /etc/freeradius/modules/preprocess
including configuration file /etc/freeradius/modules/always
including configuration file /etc/freeradius/modules/attr_rewrite
including configuration file /etc/freeradius/modules/echo
including configuration file /etc/freeradius/modules/counter
including configuration file /etc/freeradius/modules/dynamic_clients
including configuration file /etc/freeradius/modules/perl
including configuration file /etc/freeradius/modules/expr
including configuration file /etc/freeradius/modules/pam
including configuration file /etc/freeradius/modules/sradutmp
including configuration file /etc/freeradius/modules/digest
including configuration file /etc/freeradius/modules/exec
including configuration file /etc/freeradius/modules/krb5
including configuration file /etc/freeradius/modules/inner-eap
including configuration file /etc/freeradius/modules/pap
including configuration file /etc/freeradius/modules/smbpasswd
including configuration file /etc/freeradius/modules/etc_group
including configuration file /etc/freeradius/modules/attr_filter
including configuration file /etc/freeradius/modules/mschap
including configuration file /etc/freeradius/modules/detail
including configuration file /etc/freeradius/modules/mac2vlan
including configuration file /etc/freeradius/modules/sql_log
including configuration file /etc/freeradius/modules/files
including configuration file /etc/freeradius/modules/wimax
including configuration file /etc/freeradius/modules/radutmp
including configuration file /etc/freeradius/eap.conf
including configuration file /etc/freeradius/policy.conf
including files in directory /etc/freeradius/sites-enabled/
including configuration file /etc/freeradius/sites-enabled/default
including configuration file /etc/freeradius/sites-enabled/inner-tunnel
main {
    user = "freerad"
    group = "freerad"
    allow_core_dumps = no
}
including dictionary file /etc/freeradius/dictionary
main {
    prefix = "/usr"
    localstatedir = "/var"
    logdir = "/var/log/freeradius"
    libdir = "/usr/lib/freeradius"
    radacctdir = "/var/log/freeradius/radacct"
    hostname_lookups = no
    max_request_time = 30
    cleanup_delay = 5
    max_requests = 1024
    pidfile = "/var/run/freeradius/freeradius.pid"
    checkrad = "/usr/sbin/checkrad"
    debug_level = 0
    proxy_requests = yes
 log {
    stripped_names = no
    auth = no
    auth_badpass = no
    auth_goodpass = no
 }
 security {
    max_attributes = 200
    reject_delay = 1
    status_server = yes
 }
}
radiusd: #### Loading Realms and Home Servers ####
 proxy server {
    retry_delay = 5
    retry_count = 3
    default_fallback = no
    dead_time = 120
    wake_all_if_all_dead = no
 }
 home_server localhost {
    ipaddr = 127.0.0.1
    port = 1812
    type = "auth"
    secret = "testing123"
    response_window = 20
    max_outstanding = 65536
    require_message_authenticator = yes
    zombie_period = 40
    status_check = "status-server"
    ping_interval = 30
    check_interval = 30
    num_answers_to_alive = 3
    num_pings_to_alive = 3
    revive_interval = 120
    status_check_timeout = 4
    irt = 2
    mrt = 16
    mrc = 5
    mrd = 30
 }
 home_server_pool my_auth_failover {
    type = fail-over
    home_server = localhost
 }
 realm example.com {
    auth_pool = my_auth_failover
 }
 realm LOCAL {
 }
radiusd: #### Loading Clients ####
 client edimax {
    ipaddr = 172.33.0.10
    require_message_authenticator = no
    secret = "haslo"
 }
 client localhost {
    ipaddr = 127.0.0.1
    require_message_authenticator = no
    secret = "testing123"
    nastype = "other"
 }
radiusd: #### Instantiating modules ####
 instantiate {
 Module: Linked to module rlm_exec
 Module: Instantiating module "exec" from file /etc/freeradius/modules/exec
  exec {
    wait = no
    input_pairs = "request"
    shell_escape = yes
  }
 Module: Linked to module rlm_expr
 Module: Instantiating module "expr" from file /etc/freeradius/modules/expr
 Module: Linked to module rlm_expiration
 Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration
  expiration {
    reply-message = "Password Has Expired  "
  }
 Module: Linked to module rlm_logintime
 Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime
  logintime {
    reply-message = "You are calling outside your allowed timespan  "
    minimum-timeout = 60
  }
 }
radiusd: #### Loading Virtual Servers ####
server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_mschap
 Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap
  mschap {
    use_mppe = yes
    require_encryption = no
    require_strong = no
    with_ntdomain_hack = no
  }
 Module: Linked to module rlm_eap
 Module: Instantiating module "eap" from file /etc/freeradius/eap.conf
  eap {
    default_eap_type = "peap"
    timer_expire = 60
    ignore_unknown_eap_types = no
    cisco_accounting_username_bug = no
    max_sessions = 4096
  }
 Module: Linked to sub-module rlm_eap_md5
 Module: Instantiating eap-md5
 Module: Linked to sub-module rlm_eap_leap
 Module: Instantiating eap-leap
 Module: Linked to sub-module rlm_eap_gtc
 Module: Instantiating eap-gtc
   gtc {
    challenge = "Password: "
    auth_type = "PAP"
   }
 Module: Linked to sub-module rlm_eap_tls
 Module: Instantiating eap-tls
   tls {
    rsa_key_exchange = no
    dh_key_exchange = yes
    rsa_key_length = 512
    dh_key_length = 512
    verify_depth = 0
    CA_path = "/etc/freeradius/certs"
    pem_file_type = yes
    private_key_file = "/etc/freeradius/certs/server.key"
    certificate_file = "/etc/freeradius/certs/server.pem"
    CA_file = "/etc/freeradius/certs/ca.pem"
    private_key_password = "whatever"
    dh_file = "/etc/freeradius/certs/dh"
    random_file = "/dev/urandom"
    fragment_size = 1024
    include_length = yes
    check_crl = no
    cipher_list = "DEFAULT"
    make_cert_command = "/etc/freeradius/certs/bootstrap"
    cache {
    enable = no
    lifetime = 24
    max_entries = 255
    }
    verify {
    }
   }
 Module: Linked to sub-module rlm_eap_ttls
 Module: Instantiating eap-ttls
   ttls {
    default_eap_type = "md5"
    copy_request_to_tunnel = no
    use_tunneled_reply = no
    virtual_server = "inner-tunnel"
    include_length = yes
   }
 Module: Linked to sub-module rlm_eap_peap
 Module: Instantiating eap-peap
   peap {
    default_eap_type = "mschapv2"
    copy_request_to_tunnel = yes
    use_tunneled_reply = yes
    proxy_tunneled_request_as_eap = yes
    virtual_server = "inner-tunnel"
   }
 Module: Linked to sub-module rlm_eap_mschapv2
 Module: Instantiating eap-mschapv2
   mschapv2 {
    with_ntdomain_hack = no
   }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_files
 Module: Instantiating module "files" from file /etc/freeradius/modules/files
  files {
    usersfile = "/etc/freeradius/users"
    acctusersfile = "/etc/freeradius/acct_users"
    preproxy_usersfile = "/etc/freeradius/preproxy_users"
    compat = "no"
  }
 Module: Checking session {...} for more modules to load
 Module: Linked to module rlm_radutmp
 Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp
  radutmp {
    filename = "/var/log/freeradius/radutmp"
    username = "%{User-Name}"
    case_sensitive = yes
    check_with_nas = yes
    perm = 384
    callerid = yes
  }
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 Module: Linked to module rlm_attr_filter
 Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter
  attr_filter attr_filter.access_reject {
    attrsfile = "/etc/freeradius/attrs.access_reject"
    key = "%{User-Name}"
  }
 } # modules
} # server
server { # from file /etc/freeradius/radiusd.conf
 modules {
 Module: Checking authenticate {...} for more modules to load
 Module: Linked to module rlm_pap
 Module: Instantiating module "pap" from file /etc/freeradius/modules/pap
  pap {
    encryption_scheme = "auto"
    auto_header = no
  }
 Module: Linked to module rlm_chap
 Module: Instantiating module "chap" from file /etc/freeradius/modules/chap
 Module: Linked to module rlm_digest
 Module: Instantiating module "digest" from file /etc/freeradius/modules/digest
 Module: Linked to module rlm_unix
 Module: Instantiating module "unix" from file /etc/freeradius/modules/unix
  unix {
    radwtmp = "/var/log/freeradius/radwtmp"
  }
 Module: Checking authorize {...} for more modules to load
 Module: Linked to module rlm_preprocess
 Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess
  preprocess {
    huntgroups = "/etc/freeradius/huntgroups"
    hints = "/etc/freeradius/hints"
    with_ascend_hack = no
    ascend_channels_per_line = 23
    with_ntdomain_hack = no
    with_specialix_jetstream_hack = no
    with_cisco_vsa_hack = no
    with_alvarion_vsa_hack = no
  }
 Module: Linked to module rlm_realm
 Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm
  realm suffix {
    format = "suffix"
    delimiter = "@"
    ignore_default = no
    ignore_null = no
  }
 Module: Checking preacct {...} for more modules to load
 Module: Linked to module rlm_acct_unique
 Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique
  acct_unique {
    key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
  }
 Module: Checking accounting {...} for more modules to load
 Module: Linked to module rlm_detail
 Module: Instantiating module "detail" from file /etc/freeradius/modules/detail
  detail {
    detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
    header = "%t"
    detailperm = 384
    dirperm = 493
    locking = no
    log_packet_header = no
  }
 Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter
  attr_filter attr_filter.accounting_response {
    attrsfile = "/etc/freeradius/attrs.accounting_response"
    key = "%{User-Name}"
  }
 Module: Checking session {...} for more modules to load
 Module: Checking post-proxy {...} for more modules to load
 Module: Checking post-auth {...} for more modules to load
 } # modules
} # server
radiusd: #### Opening IP addresses and Ports ####
listen {
    type = "auth"
    ipaddr = *
    port = 0
}
listen {
    type = "acct"
    ipaddr = *
    port = 0
}
listen {
    type = "auth"
    ipaddr = 127.0.0.1
    port = 18120
}
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=255, length=163
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    Framed-MTU = 1400
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0200000801626f62
    Message-Authenticator = 0x0eb6be5806b2514fc502299a6319fcbb
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 0 length 8
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING: Auth-Type already set.  Not setting to PAP
++[pap] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type tls
[tls] Initiate
[tls] Start returned 1
++[eap] returns handled
Sending Access-Challenge of id 255 to 172.33.0.10 port 3072
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x010100061920
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64cfa8941b3a000f615dd9d30c
Finished request 0.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=0, length=272
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0201006919800000005f160301005a0100005603014d5b99af581dae9ad38a1055bdc982574d8da7f17773518f840aa1e228cd695300002800390038003500160013000a00330032002f000500040015001200090014001100080006000300ff020100000400230000
    State = 0xcfa98d64cfa8941b3a000f615dd9d30c
    Message-Authenticator = 0x6c33aa2e4e3bcd4438e4bdf819b399fb
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 1 length 105
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 95
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap]     (other): before/accept initialization
[peap]     TLS_accept: before/accept initialization
[peap] <<< TLS 1.0 Handshake [length 005a], ClientHello  
[peap]     TLS_accept: SSLv3 read client hello A
[peap] >>> TLS 1.0 Handshake [length 0031], ServerHello  
[peap]     TLS_accept: SSLv3 write server hello A
[peap] >>> TLS 1.0 Handshake [length 02bc], Certificate  
[peap]     TLS_accept: SSLv3 write certificate A
[peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange  
[peap]     TLS_accept: SSLv3 write key exchange A
[peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone  
[peap]     TLS_accept: SSLv3 write server done A
[peap]     TLS_accept: SSLv3 flush data
[peap]     TLS_accept: Need to read more data: SSLv3 read client certificate A
In SSL Handshake Phase 
In SSL Accept mode  
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 0 to 172.33.0.10 port 3072
    EAP-Message = 0x0102040019c00000051216030100310200002d03014d5b99af3ca11b848c59994f4cbe099bcf6591a10a857c2b7f488f01b9ae61c3000039010005ff0100010016030102bc0b0002b80002b50002b2308202ae30820196020900d7516cfea3c83fac300d06092a864886f70d01010505003019311730150603550403130e7261646975732e74756b732e706c301e170d3131303231363039313731325a170d3231303231333039313731325a3019311730150603550403130e7261646975732e74756b732e706c30820122300d06092a864886f70d01010105000382010f003082010a0282010100f1941df215f2e3606104ce70a7f43f42aad4e4c506
    EAP-Message = 0xae10d2fd94784e37f734411bf4e000c76c64cb15e6ba9b0619cbbc6df9947237315cb5c8f8c27a0c10c3c3caca91c00f23be8138803af4cb9378ede75f770c289c57f5c2c63547ad267803fe9ec07b6b98f03f1c5f5cbaf760c1c9cd5ca43b1f1f923cbbe4906b8af3e684c53a232b755013184e003fdaf00097c1f35fb314ade19b37d8e18f1a1e6d63d561345c8ec40963cb3ef88c8c607c6f9ac9cfd9ffbb2d7bdcce4fc177ee4259f35f9c5928b386cf1840afa8e84bf2ac536516304ba1303071102d707480fa3ecff379f5f53ef249e81f63db9113ad3194118d0aefa8141e50be10bf7852f6abc90203010001300d06092a864886f70d010105
    EAP-Message = 0x050003820101004dc92483160ca21bb7ba46d422e1371d1fcdbb85c540d30b783831224bd306efcb3b81020e0f5b695c3c28f82c4d7b3886fa9e9318ea250a582411c4c653c04a4b55bfc53ca9d0874092d571d8e1447986e02e62d720039050427944b32190faeb2705e76e4317d62be4aa4d5b05b1ddc93dd5a343d87faeb2993506fa1f8e65c6b6e8406599b2359955534ce213210c2549ec51c973b917ccf53dacaed8f75fea83dc840415e067d376fa83cdbc3625e9907d6695d5b4f9fb712b6cf11e69253c0e34f491852b440b6beb47cfc135800922eda07fb5924eaa9f51485dd4f6cb6cc6a5e935bba148d475f0a1e063bc036dc14537213a
    EAP-Message = 0x4fa4e6cc0d1d025e1ff0160301020d0c00020900809c399b906a65c9e465d81e2b4afadc5b84ebe254226caa611330763696438232c97c690f3f33e87a18ce5619eaea2feddfda0d77cb5b413d0b71984ec283742bdb84e19a5fd47cb673d7b83d1834469aa7d24d7fe1730e48633d69ad4e2f7b01d5aeedeb1860f9b0619c80e6ee0c54d3d7dd1dae89312fd128416a6fe4a605a3000102008068a6b33c10f30146d02381dca8027d305feb3113b3441a966e2c36474044115cae68bb1dc2c654dbac9c817d6f8e494bbb31ad8d4a132c15c652df3dcdbd31164625d6e7566973c7e7cb2d3dd8faf93ecd41fad8aa2686e01ab128821ca3b5335a041d
    EAP-Message = 0x75df73e15cf3c51d4d856758
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64ceab941b3a000f615dd9d30c
Finished request 1.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=1, length=173
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020200061900
    State = 0xcfa98d64ceab941b3a000f615dd9d30c
    Message-Authenticator = 0xc35e248ef58df51251bf1047414cf8e0
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 2 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake fragment handler
[peap] eaptls_verify returned 1 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 1 to 172.33.0.10 port 3072
    EAP-Message = 0x010301221900e4748f1294c6a551216fdad81b5a133a6601003cb64ed6ecf4a79a47068916fbd58e716f4680435bca1b8255987db936be569fcb386f2a262c73ab75c7689fff920ed2622431aa386f4fc5b43264bf63b02b75e5633a08156f616dc662d7676a720baf695a6506482312319ce51a210dda6654c88f0a4f3f679b08236ef8317322e29f6edad81c47ed9fc9d8552a53c07c93cab93e13e2cca8b833c2328386cc532be6873a33924ccf539bb8bd5026ff37d4684d1d08dcaa81f4c4709f72c4b5b1b4288745e034866d79a656a9c1fadee6596269a16481f693437fad19df7ea787c4812ac9b8c7da445cfd719fdb064d411aa6a6011f13
    EAP-Message = 0xe8a7e4ce26acfce50f70cd182f6fbca41780100d635aec8a0eaa243e16030100040e000000
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64cdaa941b3a000f615dd9d30c
Finished request 2.
Going to the next request
Waking up in 4.9 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=2, length=375
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020300d01980000000c616030100861000008200808e00432efe6451a82ca04221f14ddc579c7c01ae46da0e1dce3e1ede1f256a2962511292662bb48cdbc942f95fa64db1953c764dce30587fc45845a7ef5b6350c508b9b113286b947bc04b03f726611614e7d89e8a3efea0d4ec506aa3a51a1e64cee9ad2c73fe79bfd529b240a092e2ddebd33013c418f6390d829c4e20b1a614030100010116030100301ddaf2fc78b690228d1bc20c1b553ff4dd98e829abaa704e237b7bc278620c05ba48becbeccf211a532635b10bd69413
    State = 0xcfa98d64cdaa941b3a000f615dd9d30c
    Message-Authenticator = 0xe6a459792023fc35df7daedf8dbf029a
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 3 length 208
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
  TLS Length 198
[peap] Length Included
[peap] eaptls_verify returned 11 
[peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange  
[peap]     TLS_accept: SSLv3 read client key exchange A
[peap] <<< TLS 1.0 ChangeCipherSpec [length 0001]  
[peap] <<< TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 read finished A
[peap] >>> TLS 1.0 ChangeCipherSpec [length 0001]  
[peap]     TLS_accept: SSLv3 write change cipher spec A
[peap] >>> TLS 1.0 Handshake [length 0010], Finished  
[peap]     TLS_accept: SSLv3 write finished A
[peap]     TLS_accept: SSLv3 flush data
[peap]     (other): SSL negotiation finished successfully
SSL Connection Established 
[peap] eaptls_process returned 13 
[peap] EAPTLS_HANDLED
++[eap] returns handled
Sending Access-Challenge of id 2 to 172.33.0.10 port 3072
    EAP-Message = 0x0104004119001403010001011603010030853d44d54816ca70d3116d8b361979da2a107e4772d249da6be439683ac807ebcd431a201bbb7042ea83283a038f8d6d
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64ccad941b3a000f615dd9d30c
Finished request 3.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=3, length=173
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x020400061900
    State = 0xcfa98d64ccad941b3a000f615dd9d30c
    Message-Authenticator = 0x679861d01d46e3409b73248905b01b6f
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 4 length 6
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] Received TLS ACK
[peap] ACK handshake is finished
[peap] eaptls_verify returned 3 
[peap] eaptls_process returned 3 
[peap] EAPTLS_SUCCESS
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state TUNNEL ESTABLISHED
++[eap] returns handled
Sending Access-Challenge of id 3 to 172.33.0.10 port 3072
    EAP-Message = 0x0105002b1900170301002003433bbd1c1917e5c121c67701fab463cee47252c67f0d6224043402c7c3fe88
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64cbac941b3a000f615dd9d30c
Finished request 4.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=4, length=247
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0205005019001703010020350b7a2b2ebce5f5a399270ae60c0524eaacb155f11ccd7a0998603aad837b511703010020f1a2935aebdfc3c467ca148b5aa28dd50d2310bc3a6f0aa0537c67e0570acfc9
    State = 0xcfa98d64cbac941b3a000f615dd9d30c
    Message-Authenticator = 0xc8bfafe539b8fb91a9862a8836c89015
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 5 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state WAITING FOR INNER IDENTITY
[peap] Identity - bob
[peap] Got inner identity 'bob'
[peap] Setting default EAP type for tunneled EAP session.
[peap] Got tunneled request
    EAP-Message = 0x0205000801626f62
server  {
  PEAP: Setting User-Name to bob
Sending tunneled request
    EAP-Message = 0x0205000801626f62
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[mschap] returns noop
++[control] returns noop
[eap] EAP packet type response id 5 length 8
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] EAP Identity
[eap] processing type mschapv2
rlm_eap_mschapv2: Issuing Challenge
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x0106001d1a01060018108c07ae32db579d63fcf4472741c0140b626f62
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16050917e540aa23de005f625
[peap] Got tunneled reply RADIUS code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x0106001d1a01060018108c07ae32db579d63fcf4472741c0140b626f62
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16050917e540aa23de005f625
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 4 to 172.33.0.10 port 3072
    EAP-Message = 0x0106004b19001703010040f117a5f66f93682e9fb81c06cbddebab20cc4c03aca97cc08ec525070a23f1ae05c106b04569d3999384b9543a3784bf479536f7821e4c0a28141bfa3fdcb47f
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64caaf941b3a000f615dd9d30c
Finished request 5.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=5, length=295
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0206008019001703010020866b63154d48e8e35432898f581536246ea847823f4eb07c2ab37e5874050a891703010050d197f8068a88905b0099ee1e0cc631ae74838be6057d44f3af88c9c41d1dc6c44ccfe59ae3b3105574be5e6640a2c82a9836fc487827ef9d8631eef74d33959bc0c3daa71d7f3002017dd2791be84f6a
    State = 0xcfa98d64caaf941b3a000f615dd9d30c
    Message-Authenticator = 0x0191348f460c43c33ed55b533b1a90b7
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 6 length 128
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
    EAP-Message = 0x0206003e1a02060039318155759d417f23ac9271f69f7ccf95e300000000000000004f84ccbc385b42702fd76241996d292a240baaaf359d817100626f62
server  {
  PEAP: Setting User-Name to bob
Sending tunneled request
    EAP-Message = 0x0206003e1a02060039318155759d417f23ac9271f69f7ccf95e300000000000000004f84ccbc385b42702fd76241996d292a240baaaf359d817100626f62
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "bob"
    State = 0x60568bf16050917e540aa23de005f625
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[mschap] returns noop
++[control] returns noop
[eap] EAP packet type response id 6 length 62
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
[mschapv2] +- entering group MS-CHAP {...}
[mschap] Creating challenge hash with username: bob
[mschap] Told to do MS-CHAPv2 for bob with NT-Password
[mschap] adding MS-CHAPv2 MPPE keys
++[mschap] returns ok
MSCHAP Success 
++[eap] returns handled
} # server inner-tunnel
[peap] Got tunneled reply code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x010700331a0306002e533d46313144384145393441333241444538393938464630454146314437343435424332453335373443
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16151917e540aa23de005f625
[peap] Got tunneled reply RADIUS code 11
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    EAP-Message = 0x010700331a0306002e533d46313144384145393441333241444538393938464630454146314437343435424332453335373443
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0x60568bf16151917e540aa23de005f625
[peap] Got tunneled Access-Challenge
++[eap] returns handled
Sending Access-Challenge of id 5 to 172.33.0.10 port 3072
    EAP-Message = 0x0107005b190017030100507afeb639bf38be468307dcb5adf6527e591d05f53b4034eed399397e26d291b5ea945bbd3126bc774268c351e2ac81eb96d8e7e1a52b3f750a11607234acc2fed1d9499c841ebc89e2296b2d1fbb93b0
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64c9ae941b3a000f615dd9d30c
Finished request 6.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=6, length=247
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0207005019001703010020c0a6e754c365c558115e2c65e621bd655f7ef434f028e5bbfc1516ace3b4548e170301002082736822c120b58e8eec204bd8bbd7b7ea41d9392706e41f4f5a07a3dabe6f39
    State = 0xcfa98d64c9ae941b3a000f615dd9d30c
    Message-Authenticator = 0xcbe80472c4a7394313374ee26fde1319
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 7 length 80
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state phase2
[peap] EAP type mschapv2
[peap] Got tunneled request
    EAP-Message = 0x020700061a03
server  {
  PEAP: Setting User-Name to bob
Sending tunneled request
    EAP-Message = 0x020700061a03
    FreeRADIUS-Proxied-To = 127.0.0.1
    User-Name = "bob"
    State = 0x60568bf16151917e540aa23de005f625
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
server inner-tunnel {
# Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authorize {...}
++[mschap] returns noop
++[control] returns noop
[eap] EAP packet type response id 7 length 6
[eap] No EAP Start, assuming it's an on-going EAP conversation
++[eap] returns updated
[files] users: Matched entry bob at line 2
++[files] returns ok
++[expiration] returns noop
++[logintime] returns noop
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/inner-tunnel
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/mschapv2
[eap] processing type mschapv2
[eap] Freeing handler
++[eap] returns ok
  WARNING: Empty post-auth section.  Using default return values.
# Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel
} # server inner-tunnel
[peap] Got tunneled reply code 2
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    MS-MPPE-Encryption-Policy = 0x00000001
    MS-MPPE-Encryption-Types = 0x00000006
    MS-MPPE-Send-Key = 0xb977bd72d56cd5f93ac093254c30f1ff
    MS-MPPE-Recv-Key = 0x92e4a04b31522cfa6ccecd9a185cb6c8
    EAP-Message = 0x03070004
    Message-Authenticator = 0x00000000000000000000000000000000
    User-Name = "bob"
[peap] Got tunneled reply RADIUS code 2
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    MS-MPPE-Encryption-Policy = 0x00000001
    MS-MPPE-Encryption-Types = 0x00000006
    MS-MPPE-Send-Key = 0xb977bd72d56cd5f93ac093254c30f1ff
    MS-MPPE-Recv-Key = 0x92e4a04b31522cfa6ccecd9a185cb6c8
    EAP-Message = 0x03070004
    Message-Authenticator = 0x00000000000000000000000000000000
    User-Name = "bob"
[peap] Tunneled authentication was successful.
[peap] SUCCESS
[peap] Saving tunneled attributes for later
++[eap] returns handled
Sending Access-Challenge of id 6 to 172.33.0.10 port 3072
    EAP-Message = 0x0108003b1900170301003007ceca193ef1a187a79f79d1f8f7a63190408a631ec678e71bc4af071cd00ab7e28b7473d9b109ee30756eb88b7257a4
    Message-Authenticator = 0x00000000000000000000000000000000
    State = 0xcfa98d64c8a1941b3a000f615dd9d30c
Finished request 7.
Going to the next request
Waking up in 4.8 seconds.
rad_recv: Access-Request packet from host 172.33.0.10 port 3072, id=7, length=263
    User-Name = "bob"
    NAS-IP-Address = 172.33.0.10
    NAS-Port = 0
    Called-Station-Id = "000e2eaab977"
    Calling-Station-Id = "0016ead9f81e"
    NAS-Identifier = "Realtek Access Point. 8181"
    NAS-Port-Type = Wireless-802.11
    Service-Type = Framed-User
    Connect-Info = "CONNECT 11Mbps 802.11b"
    EAP-Message = 0x0208006019001703010020b28a4f39b5d7e99183468b06ae03505f866aaf7defe51bf86c9ba4982cf007d51703010030479d1054c468b9ea726b9422e3a66eed74d38b1eb63c3aa26fc969e36585a45e02d860217a6034ed757b04acc216b705
    State = 0xcfa98d64c8a1941b3a000f615dd9d30c
    Message-Authenticator = 0x4314a73187da3b0baf96f3a3fc903eb5
# Executing section authorize from file /etc/freeradius/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "bob", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] EAP packet type response id 8 length 96
[eap] Continuing tunnel setup.
++[eap] returns ok
Found Auth-Type = EAP
# Executing group from file /etc/freeradius/sites-enabled/default
+- entering group authenticate {...}
[eap] Request found, released from the list
[eap] EAP/peap
[eap] processing type peap
[peap] processing EAP-TLS
[peap] eaptls_verify returned 7 
[peap] Done initial handshake
[peap] eaptls_process returned 7 
[peap] EAPTLS_OK
[peap] Session established.  Decoding tunneled attributes.
[peap] Peap state send tlv success
[peap] Received EAP-TLV response.
[peap] Success
[peap] Using saved attributes from the original Access-Accept
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    User-Name = "bob"
[eap] Freeing handler
++[eap] returns ok
# Executing section post-auth from file /etc/freeradius/sites-enabled/default
+- entering group post-auth {...}
++[exec] returns noop
Sending Access-Accept of id 7 to 172.33.0.10 port 3072
    Framed-IP-Address = 172.172.0.123
    Framed-IP-Netmask = 255.255.255.0
    User-Name = "bob"
    MS-MPPE-Recv-Key = 0xa8b116188719ee417d1ca4a1ae0cd2b880bf97345abbec801bd882b709ee4f6a
    MS-MPPE-Send-Key = 0xeacf0351be2305fa7216cdf2562ea5a506c579a7587a83c5cfdeac79fc34fc11
    EAP-Message = 0x03080004
    Message-Authenticator = 0x00000000000000000000000000000000
Finished request 8.
Going to the next request
Waking up in 4.8 seconds.
Cleaning up request 0 ID 255 with timestamp +7
Cleaning up request 1 ID 0 with timestamp +7
Cleaning up request 2 ID 1 with timestamp +7
Cleaning up request 3 ID 2 with timestamp +7
Cleaning up request 4 ID 3 with timestamp +7
Cleaning up request 5 ID 4 with timestamp +7
Cleaning up request 6 ID 5 with timestamp +7
Cleaning up request 7 ID 6 with timestamp +7
Cleaning up request 8 ID 7 with timestamp +7
Ready to process requests.

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = ${exec_prefix}/sbin
logdir = /var/log/freeradius
raddbdir = /etc/freeradius
radacctdir = ${logdir}/radacct
name = freeradius
confdir = ${raddbdir}
run_dir = ${localstatedir}/run/${name}
db_dir = ${raddbdir}
libdir = /usr/lib/freeradius
pidfile = ${run_dir}/${name}.pid
user = freerad
group = freerad
max_request_time = 30
cleanup_delay = 5
max_requests = 1024
listen {
    type = auth
    ipaddr = *
    port = 0
}
listen {
    ipaddr = *
    port = 0
    type = acct
}
hostname_lookups = no
allow_core_dumps = no
regular_expressions    = yes
extended_expressions    = yes
log {
    destination = files
    file = ${logdir}/radius.log
    syslog_facility = daemon
    stripped_names = no
    auth = no
    auth_badpass = no
    auth_goodpass = no
}
checkrad = ${sbindir}/checkrad
security {
    max_attributes = 200
    reject_delay = 1
    status_server = yes
}
proxy_requests  = yes
$INCLUDE proxy.conf
$INCLUDE clients.conf
thread pool {
    start_servers = 5
    max_servers = 32
    min_spare_servers = 3
    max_spare_servers = 10
    max_requests_per_server = 0
}
modules {
    $INCLUDE ${confdir}/modules/
    $INCLUDE eap.conf
}
instantiate {
    exec
    expr
    expiration
    logintime
}
$INCLUDE policy.conf
$INCLUDE sites-enabled/

    eap {
        default_eap_type = peap
        timer_expire     = 60
        ignore_unknown_eap_types = no
        cisco_accounting_username_bug = no
        max_sessions = 4096
        md5 {
        }
        leap {
        }
        gtc {
            auth_type = PAP
        }
        tls {
            certdir = ${confdir}/certs
            cadir = ${confdir}/certs
            private_key_password = whatever
            private_key_file = ${certdir}/server.key
            certificate_file = ${certdir}/server.pem
            CA_file = ${cadir}/ca.pem
            dh_file = ${certdir}/dh
            random_file = /dev/urandom
            CA_path = ${cadir}
            cipher_list = "DEFAULT"
            make_cert_command = "${certdir}/bootstrap"
            cache {
                  enable = no
                  max_entries = 255
            }
            verify {
            }
        }
        ttls {
            default_eap_type = md5
            copy_request_to_tunnel = no
            use_tunneled_reply = no
            virtual_server = "inner-tunnel"
        }
        peap {
            default_eap_type = mschapv2
            copy_request_to_tunnel = yes
            use_tunneled_reply = yes
            virtual_server = "inner-tunnel"
        }
        mschapv2 {
        }
    }

authorize {
    preprocess
    chap
    mschap
    digest
    suffix
    eap {
        ok = return
    }
    files
    expiration
    logintime
    pap
}
authenticate {
    Auth-Type PAP {
        pap
    }
    Auth-Type CHAP {
        chap
    }
    Auth-Type MS-CHAP {
        mschap
    }
    digest
    unix
    eap
}
preacct {
    preprocess
    acct_unique
    suffix
    files
}
accounting {
    detail
    unix
    radutmp
    exec
    attr_filter.accounting_response
}
session {
    radutmp
}
post-auth {
    exec
    Post-Auth-Type REJECT {
        attr_filter.access_reject
    }
}
pre-proxy {
}
post-proxy {
    eap
}

server inner-tunnel {
listen {
       ipaddr = 127.0.0.1
       port = 18120
       type = auth
}
authorize {
    mschap
    update control {
           Proxy-To-Realm := LOCAL
    }
    eap {
        ok = return
    }
    files
    expiration
    logintime
}
authenticate {
    Auth-Type MS-CHAP {
        mschap
    }
    eap
}
session {
    radutmp
}
post-auth {
    Post-Auth-Type REJECT {
        attr_filter.access_reject
    }
}
pre-proxy {
}
post-proxy {
    eap
}