IEEE 802.1X mit Captive Portal

(1) Received Access-Request Id 255 from 192.168.20.1:39568 to 192.168.20.100:1812 length 228
(1)   Service-Type = Login-User
(1)   User-Name = "testuser2"  
(1)   MS-CHAP2-Response = 0x01012bb191df0690ee183925b8783daf722a0000000000000000fde064cde8f2b91805d6821bde0ff3662d700ee6b983fbba
(1)   MS-CHAP-Challenge = 0x3e843289da8c25dd8d0fb873e3d5718b
(1)   NAS-IP-Address = 192.168.20.1
(1)   NAS-Identifier = "CaptivePortal-test_internet"  
(1)   Calling-Station-Id = "74:d4:dd:59:35:c4"  
(1)   Called-Station-Id = "00:15:5d:38:01:0d:pfSense.home.arpa"  
(1)   NAS-Port-Type = Ethernet
(1)   NAS-Port = 2000
(1)   Framed-IP-Address = 192.168.11.100
(1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if (&User-Name =~ /\.\./ ) {
(1)         if (&User-Name =~ /\.\./ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> FALSE
(1)         if (&User-Name =~ /@\./)  {
(1)         if (&User-Name =~ /@\./)   -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1) mschap: Found MS-CHAP attributes.  Setting 'Auth-Type  = mschap'  
(1)     [mschap] = ok
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"  
(1) suffix: No '@' in User-Name = "testuser2", looking up realm NULL  
(1) suffix: No such realm "NULL"  
(1)     [suffix] = noop
(1) eap: No EAP-Message, not doing EAP
(1)     [eap] = noop
(1)     [files] = noop
(1) sql: EXPAND %{User-Name}
(1) sql:    --> testuser2
(1) sql: SQL-User-Name set to 'testuser2'  
rlm_sql (sql): Reserved connection (3)
(1) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id  
(1) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser2' ORDER BY id  
(1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser2' ORDER BY id  
(1) sql: User found in radcheck table
(1) sql: Conditional check items matched, merging assignment check items
(1) sql:   Cleartext-Password := "12345678"  
(1) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id  
(1) sql:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser2' ORDER BY id  
(1) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser2' ORDER BY id  
(1) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority  
(1) sql:    --> SELECT groupname FROM radusergroup WHERE username = 'testuser2' ORDER BY priority  
(1) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'testuser2' ORDER BY priority  
(1) sql: User found in the group table
(1) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id  
(1) sql:    --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VLAN-200' ORDER BY id  
(1) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VLAN-200' ORDER BY id  
(1) sql: Group "VLAN-200": Conditional check items matched  
(1) sql: Group "VLAN-200": Merging assignment check items  
(1) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id  
(1) sql:    --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'VLAN-200' ORDER BY id  
(1) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'VLAN-200' ORDER BY id  
(1) sql: Group "VLAN-200": Merging reply items  
(1) sql:   Tunnel-Type := VLAN
(1) sql:   Tunnel-Medium-Type := IEEE-802
(1) sql:   Tunnel-Private-Group-Id := "200"  
rlm_sql (sql): Released connection (3)
Need more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 10.11.11-MariaDB-0+deb12u1, protocol version 10  
rlm_sql (sql): Closing expired connection (6) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (1) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): You probably need to lower "min"  
rlm_sql (sql): Closing expired connection (0) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
(1)     [sql] = ok
(1)     [expiration] = noop
(1)     [logintime] = noop
(1) pap: WARNING: Auth-Type already set.  Not setting to PAP
(1)     [pap] = noop
(1)   } # authorize = ok
(1) Found Auth-Type = mschap
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1)   authenticate {
(1) mschap: Found Cleartext-Password, hashing to create NT-Password
(1) mschap: Creating challenge hash with username: testuser2
(1) mschap: Client is using MS-CHAPv2
(1) mschap: Adding MS-CHAPv2 MPPE keys
(1)     [mschap] = ok
(1)   } # authenticate = ok
(1) # Executing section post-auth from file /etc/freeradius/3.0/sites-enabled/default
(1)   post-auth {
(1)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(1)     if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name))  -> FALSE
(1)     update {
(1)       No attributes updated for RHS &session-state:
(1)     } # update = noop
(1) sql: EXPAND .query
(1) sql:    --> .query
(1) sql: Using query template 'query'  
rlm_sql (sql): Reserved connection (3)
(1) sql: EXPAND %{User-Name}
(1) sql:    --> testuser2
(1) sql: SQL-User-Name set to 'testuser2'  
(1) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )  
(1) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'testuser2', '', 'Access-Accept', '2025-05-27 19:09:12.333376' )  
(1) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'testuser2', '', 'Access-Accept', '2025-05-27 19:09:12.333376' )  
(1) sql: SQL query returned: success
(1) sql: 1 record(s) updated
rlm_sql (sql): Released connection (3)
(1)     [sql] = ok
(1)     [exec] = noop
(1)     policy remove_reply_message_if_eap {
(1)       if (&reply:EAP-Message && &reply:Reply-Message) {
(1)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(1)       else {
(1)         [noop] = noop
(1)       } # else = noop
(1)     } # policy remove_reply_message_if_eap = noop
(1)     if (EAP-Key-Name && &reply:EAP-Session-Id) {
(1)     if (EAP-Key-Name && &reply:EAP-Session-Id)  -> FALSE
(1)   } # post-auth = ok
(1) Login OK: [testuser2/<via Auth-Type = mschap>] (from client network-1 port 2000 cli 74:d4:dd:59:35:c4)
(1) Sent Access-Accept Id 255 from 192.168.20.100:1812 to 192.168.20.1:39568 length 196
(1)   Tunnel-Type = VLAN
(1)   Tunnel-Medium-Type = IEEE-802
(1)   Tunnel-Private-Group-Id = "200"  
(1)   MS-CHAP2-Success = 0x01533d38354430454339363230324542324343353636313331373543393544363344373439313634363632
(1)   MS-MPPE-Recv-Key = 0x71ffca242d678e4af1557381ab6c2764
(1)   MS-MPPE-Send-Key = 0x67dd1dd75bac35fa953887dfef18df07
(1)   MS-MPPE-Encryption-Policy = Encryption-Allowed
(1)   MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(1) Finished request
Waking up in 4.9 seconds.
(1) Cleaning up request packet ID 255 with timestamp +221 due to cleanup_delay was reached
Ready to process requests