December 2005 - Freeradius-Users - lists.freeradius.org

rlm_ldap: ldap_search() failed: Bad search filter:
by Norbert Wegener 08 Dec '05

08 Dec '05

I am still trying to let freeradius query AD, but not yet too successfull. Using the following vars with ldapsearch, gives me the desired result, as shown below, but fails with rlm_ldap. ########################################## server="mchm967a.tww006.sitest.net " port=3268 identity="testrad(a)TDE002.SITEST.NET " mypass="mypass" basedn="dc=TDE002,dc=SITEST,dc=NET" filter="(&(sAMAccountName=28TEF003$)(objectclass=computer)) sAMAccountName userAccountControl" ######################################### ldapsearch -x -h $server -p $port -b $basedn $filter -D $identity -w $mypass -x # extended LDIF # # LDAPv3 # base <dc=TDE002,dc=SITEST,dc=NET> with scope sub # filter: (&(sAMAccountName=28TEF003$)(objectclass=computer)) # requesting: sAMAccountName userAccountControl # # 28TEF003, CAT-Computers, OU16, MchP, tde002.sitest.net dn: CN=28TEF003,OU=CAT-Computers,OU=OU16,OU=MchP,DC=tde002,DC=sitest,DC=net userAccountControl: 4096 sAMAccountName: 28TEF003$ # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 ################################################## So far, so good. When I take the same vars in radiusd.conf, I get: rlm_ldap: ldap_search() failed: Bad search filter radiusd.conf: ldap ldap1 { server="mchm967a.tww006.sitest.net " port=3268 identity="testrad(a)TDE002.SITEST.NET " mypass="mypass" basedn="dc=TDE002,dc=SITEST,dc=NET" filter="(&(sAMAccountName=28TEF003$)(objectclass=computer)) sAMAccountName userAccountControl" ldap_debug= 0xFFFF ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { } dictionary_mapping = ${raddbdir}/ldap.attrmap } rlm_ldap: Bind was successful^M rlm_ldap: performing search in dc=TDE002,dc=SITEST,dc=NET, with filter (&(sAMAccountName=28TEF003$)(objectclass=computer)) sAMAccountName userAccountControl^M ldap_search^M put_filter: "(&(sAMAccountName=28TEF003$)(objectclass=computer)) sAMAccountName userAccountControl"^M put_filter: AND^M put_filter_list "(sAMAccountName=28TEF003$)(objectclass=computer)"^M put_filter: "(sAMAccountName=28TEF003$)"^M put_filter: simple^M put_simple_filter: "sAMAccountName=28TEF003$"^M put_filter: "(objectclass=computer)"^M put_filter: simple^M put_simple_filter: "objectclass=computer"^M put_filter: default^M put_simple_filter: "sAMAccountName userAccountControl"^M rlm_ldap: ldap_search() failed: Bad search filter: (&(sAMAccountName=28TEF003$)(objectclass=computer)) sAMAccountName userAccountControl^M ldap_msgfree^M rlm_ldap: search failed^M What am I doing wrong? Thanks Norbert Wegener

3 4

Radius Sending Rollback Message?
by Sharma Raj 08 Dec '05

08 Dec '05

Radius Sending Rollback Message A rather curious scenario of events: In our setup of Radius, we use an Oracle database. Ordinarily, when NAS sends Accounting Start messages to Radius, Radius sends Update messages to Oracle. Periodically, something odd happens - Radius sends a Rollback message to Oracle which undoes the Update. This Rollback message is really not wanted as the Oracle DB doesnt get updated, but I havent got a clue why this happens. Please let me know if you've seen this before or if you know why this would happen. Help greatly appreciated. Some more details are below. (Radius-Oracle communicate with: Data Manipulation Language (DML) consists of UPDATEs, INSERTs and MERGEs. Transaction Control consists of COMMIT, SAVEPOINT, ROLLBACK and SET TRANSCATION.) Here are the two failing sessions, (containing 4 UPDATE messages from the radius server) that did not successfully update the oracle DB. UPDATE radacct SET Status = 1, NASIPAddress = '10.10.32.4', AcctStartTime = to_d ate('2005-11-18 14:12:21','YYYY-MM-DD HH24:MI:SS'), CalledStationId = 'wx', XDI AL= '213.55.204.140', FramedIPAddress= '10.12.33.152' WHERE CallingStationId = '11118380323' UPDATE radacct SET Status = 0 , AcctStopTime = to_date('2005-11-18 14:28:20','Y YYY-MM-DD HH24:MI:SS') WHERE CallingStationId = decode('11118380323','', '11110 000000', '11118380323') UPDATE radacct SET Status = 1, NASIPAddress = '10.10.32.4', AcctStartTime = to_d ate('2005-11-18 14:29:10','YYYY-MM-DD HH24:MI:SS'), CalledStationId = 'wx', XDI AL= '213.55.204.140', FramedIPAddress= '10.12.23.199' WHERE CallingStationId = '11118380323' UPDATE radacct SET Status = 0 , AcctStopTime = to_date('2005-11-18 15:13:04','Y YYY-MM-DD HH24:MI:SS') WHERE CallingStationId = decode('11118380323','', '11110 000000', '11118380323') The Oracle DB listener trace for the first message shows the DML was received ok but the end of a trace shows a ROLLBACK (this undoes all the DMLs since the last COMMIT was sent). Details: UPDATE radacct SET Status = :"SYS_B_0", NASIPAddress = :"SYS_B_1", AcctStartTime = to_date(:"SYS_B_2",:"SYS_B_3"), CalledStationId = :"SYS_B_4", XDIAL= :"SYS_B_5", FramedIPAddress = :"SYS_B_6" WHERE CallingStationId =:"SYS_B_7" call count cpu elapsed disk query current rows ------- ------ -------- ---------- ---------- ---------- ---------- ---------- Parse 1 0.00 0.00 0 0 0 0 Execute 1 0.01 0.00 2 3 14 1 Fetch 0 0.00 0.00 0 0 0 0 ------- ------ -------- ---------- ---------- ---------- ---------- ---------- total 2 0.01 0.01 2 3 14 1 Misses in library cache during parse: 1 Optimizer goal: CHOOSE Parsing user id: 162 Rows Row Source Operation ------- --------------------------------------------------- 1 UPDATE 1 INDEX UNIQUE SCAN PK_RADACCT (object id 622971) ******************************************************************************** SELECT CallingStationId, FramedIpAddress from radius.radacct where rowid = :b1 and Status = 1 call count cpu elapsed disk query current rows ------- ------ -------- ---------- ---------- ---------- ---------- ---------- Parse 1 0.00 0.00 0 0 0 0 Execute 1 0.00 0.00 0 0 0 0 Fetch 1 0.00 0.00 0 1 0 1 ------- ------ -------- ---------- ---------- ---------- ---------- ---------- total 3 0.00 0.00 0 1 0 1 Misses in library cache during parse: 0 Optimizer goal: CHOOSE Parsing user id: 162 (recursive depth: 1) Rows Row Source Operation ------- --------------------------------------------------- 1 TABLE ACCESS BY USER ROWID RADACCT ******************************************************************************** UPDATE radius.radacct set Status = 0 where Status = 1 and FramedIpAddress = :b2 and CallingStationId != :b1 call count cpu elapsed disk query current rows ------- ------ -------- ---------- ---------- ---------- ---------- ---------- Parse 1 0.00 0.00 0 0 0 0 Execute 1 0.03 0.04 0 2066 0 0 Fetch 0 0.00 0.00 0 0 0 0 ------- ------ -------- ---------- ---------- ---------- ---------- ---------- total 2 0.03 0.04 0 2066 0 0 Misses in library cache during parse: 0 Optimizer goal: CHOOSE Parsing user id: 162 (recursive depth: 1) Rows Row Source Operation ------- --------------------------------------------------- 0 UPDATE 0 TABLE ACCESS BY INDEX ROWID RADACCT 2587 INDEX RANGE SCAN RADACCT_IX4 (object id 464104) ******************************************************************************** rollback

2 1

(no subject)
by Bohannan, Chad W 08 Dec '05

08 Dec '05

I am still attempting to authenticate PAP from FR to LDAP/AD. I continue to receive an error regardless of my radiusd.conf configuration. Below is the relevant snip from my radius.conf as well as the error message I am receiving. It looks to me like LDAP is not able to complete the initial bind (not even getting to the user search). Thanks in advance for the assistance. ## radiusd.conf ## ldap { server = 172.21.1.1 identity = "cn=testadmin,ou=NetOps,dc=testdom,dc=com" password = "testing999" basedn = "cn=NetOps,dc=testdom,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ##radtest## rwsradius01# radtest mymayo password localhost:7794 10 testing123 Sending Access-Request of id 112 to 127.0.0.1:7794 User-Name = "mayojf" User-Password = "password" NAS-IP-Address = rwsradius01 NAS-Port = 10 Re-sending Access-Request of id 112 to 127.0.0.1:7794 User-Name = "mayojf" User-Password = "s\207\341\251\027\317*\342\020\230\343-mf\323" NAS-IP-Address = rwsradius01 NAS-Port = 10 Re-sending Access-Request of id 112 to 127.0.0.1:7794 User-Name = "mayojf" User-Password = "s\207\341\251\027\317*\342\020\230\343-mf\323" NAS-IP-Address = rwsradius01 NAS-Port = 10 ##radius log output/error## Thu Dec 8 13:08:05 2005 : Error: rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf Thu Dec 8 13:08:05 2005 : Error: rlm_ldap: (re)connection attempt failed Chad

1 0

RE: How many Request handle by Free Radius at same time form sameclient.
by Manojkumar Patel 08 Dec '05

08 Dec '05

Hi First thanks Supose I have latest confi. In my system(P-V, 135 gb HDD,512MB RAM Etc), then ? U forget about system configuration. Tell ME, how many request handele by free radius server from same client at the same time? Thanks & Regard Manoj Patel -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, December 08, 2005 12:22 PM To: FreeRadius users mailing list Subject: Re: How many Request handle by Free Radius at same time form sameclient. "Manojkumar Patel" <manojkp(a)mahindrabt.com> wrote: > How many Request handle by Free Radius at same time form same client. It depends on RAM, CPU, etc. > I want to implement a Radius system such as my radius server will be > able to handle 5000 request form client as same time. > Mean radius is able to listen 5000 request form client and then send > all request to other server and wait. After Getting replay from other > server , radius will send replay to client. =0D Receive 5000 requests before sending any reply to the client? I doubt that's the way it works. FreeRADIUS is deployed in sites with millions of users. 5000 users is a very small site. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

2 1

problems with real @
by aquino＠cotes.net.bo 07 Dec '05

07 Dec '05

hi these are my configuration files users radius Auth-Type:= Local, User-Password == "radius" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 172.16.3.33, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP proxy.conf realm local { type = radius authhost = LOCAL accthost = LOCAL secret = secret } clients.conf client x.x.x.x { secret = secret shortname = prueba } Ok. when i use tools NtRadPing with user radius@local and password radius, everything is OK. Login OK: [radius@local] (from client prueba port 0) But when i try with the same user and pass from a mode DSL that use a RedBack to authentication appear this mistake. rad_recv: Access-Request packet from host 200.58.72.31:1812, id=177, length=101 User-Name = "radius@local" User-Password = "radius" NAS-Identifier = "Redback" NAS-Real-Port = 268438312 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 3892320806 Connect-Info = "ubr-adsl" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: Looking up realm "local" for User-Name = "radius@local" rlm_realm: Found realm "local" rlm_realm: Adding Stripped-User-Name = "radius" rlm_realm: Proxying request from user radius to realm local rlm_realm: Adding Realm = "local" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 users: Matched DEFAULT at 99 users: Matched DEFAULT at 118 users: Matched DEFAULT at 130 modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns ok for request 5 rad_check_password: Found Auth-Type System auth: type "System" ## i think here is the mistake, but i don´t understand why, in my user file put Auth-Type == Local and in the log appear System. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_unix: [radius]: invalid password modcall[authenticate]: module "unix" returns reject for request 5 modcall: group authenticate returns reject for request 5 auth: Failed to validate the user. Login incorrect: [radius@local/radius] (from client iRedBack port 3892320806) Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 177 to 200.58.72.31:1812 i think that mistake is when try to authentication, but i don´t understand, why in my user file put Auth-Type == Local and in the log appear System. how can i change it. Tnanks Alvaro ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

2 1

Re: XP auth + PEAP (debik)
by mat yuh 07 Dec '05

07 Dec '05

i'm also have a problem to make PEAP works with XP SP2.The PAP, EAP-tls, EAP-ttls work very well.i realise that freeradius gives me this error : rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for nurah with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 i do read the maillist and search on google but cant make XP SP2 Work with PEAP. i'm using several NAS such as SMC BARRICADE 2804WBR and Linksys WRT54G. i do configure default_eap_type = peap in eap.conf and have a plain text password in users file : nurah User-Password == "mypasswd" ** i make a new users file and put nurah user only in it here is my complete debug message : ----------------------- Initializing the thread pool... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Nothing to do. Sleeping until we see a request. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "unix" returns updated for request 0 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 7 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 0 modcall[authorize]: module "expiration" returns noop for request 0 modcall[authorize]: module "logintime" returns noop for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 5 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "unix" returns updated for request 1 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 8 length 65 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "expiration" returns noop for request 1 modcall[authorize]: module "logintime" returns noop for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0032], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 06cc], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Finished request 1 Going to the next request Waking up in 5 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "unix" returns updated for request 2 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 9 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "expiration" returns noop for request 2 modcall[authorize]: module "logintime" returns noop for request 2 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 rad_recv: Access-Request packet from host 192.168.2.1 port 1025, id=7, length=91 User-Name = "nurah" NAS-IP-Address = 192.168.2.1 NAS-Identifier = "AP" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207000a016e75726168 Message-Authenticator = 0x68f9afa71809cd05fb71ab8686f18320 Sending Access-Challenge of id 7 to 192.168.2.1 port 1025 EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x504617b0d4dd078d15c5d6ad12aff5f1 rad_recv: Access-Request packet from host 192.168.2.1 port 1026, id=8, length=164 User-Name = "nurah" NAS-IP-Address = 192.168.2.1 NAS-Identifier = "AP" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x504617b0d4dd078d15c5d6ad12aff5f1 EAP-Message = 0x0208004119800000003716030100320100002e0301ae311dd3edd1dea83725e444a8d98d1e6112c10ebfcddacd153cf88067247bfc01000006000a000500040100 Message-Authenticator = 0x8413f48fc7e59bb15e4f6ed10532a5d9 Sending Access-Challenge of id 8 to 192.168.2.1 port 1026 EAP-Message = 0x0109040a19c000000729160301004a02000046030143963da2133ae46a6fdcc84d872a6f77f8447a49f37e19e9ab11f900f2c11630207acd91607051139b88ec441c90932b9ca122526d8e65d3ed5229d33d9c5008ae000a0016030106cc0b0006c80006c50002c9308202c53082022e020900f2585747fdc421f1300d06092a864886f70d01010505003081ad310b3009060355040613024d593111300f060355040813084b656c616e74616e311330110603550407130a4b6f746120426861727531233021060355040a131a4e7572616820436f6d6d756e636174696f6e2053646e20426864310b3009060355040b13024954311e301c0603550403 EAP-Message = 0x13154e7572616820436f6d6d756e636174696f6e2043413124302206092a864886f70d01090116156e757261683132314073747265616d79782e636f6d301e170d3035313230343036323235325a170d3135313230323036323235325a30819f310b3009060355040613024d593111300f060355040813084b656c616e74616e311330110603550407130a4b6f746120426861727531233021060355040a131a4e7572616820436f6d6d756e636174696f6e2053646e20426864310b3009060355040b130249543110300e06035504031307636f6c696e75783124302206092a864886f70d01090116156e757261683132314073747265616d79782e63 EAP-Message = 0x6f6d30819f300d06092a864886f70d010101050003818d0030818902818100a9c3198f512e0c50674463c59ce454415fd1df0496491d5d8830044248d602fbf9112117e2f5fea88aa6433add26cfdbc17303650260e43b551990fe5f45e826147cacae5469311b55fde41305b972580db938c16dcd73cb44f47c978b8fb205c9489ff748fd7e87ff9555a004f44ed3eeb18e982aa1c7e8dcdd49af87f3d15f0203010001300d06092a864886f70d01010505000381810090ab8b57db0a519e89a3d18882f98dde739a0e21fa1c26bf754f9f7835dc34a146aec1327de98a1ec8cb03b930da518cac8e06ce7d39685697f3d226388cc2f2b8464672e272 EAP-Message = 0x0ca42ab3184e5e0669b1dc545b928b3341c4beb5ef574f51a9192f5fd153c91d698d7b957befe425ef45fd1eb81631c44229f9c6405a4a3ec3000003f6308203f23082035ba003020102020900d4a1f9d8d7737d14300d06092a864886f70d01010505003081ad310b3009060355040613024d593111300f060355040813084b656c616e74616e311330110603550407130a4b6f746120426861727531233021060355040a131a4e7572616820436f6d6d756e636174696f6e2053646e20426864310b3009060355040b13024954311e301c060355040313154e7572616820436f6d6d756e636174696f6e2043413124302206092a864886f70d010901 EAP-Message = 0x16156e757261683132314073747265616d79782e636f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf4c74c157d0597a1dce1a727f6888730 rad_recv: Access-Request packet from host 192.168.2.1 port 1027, id=9, length=105 User-Name = "nurah" NAS-IP-Address = 192.168.2.1 NAS-Identifier = "AP" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0xf4c74c157d0597a1dce1a727f6888730 EAP-Message = 0x020900061900 Message-Authenticator = 0xe882c439bd4c462b3d3d457e586fa9a3 Sending Access-Challenge of id 9 to 192.168.2.1 port 1027 EAP-Message = 0x010a032f19006d301e170d3035313230343036323234315a170d3135313230323036323234315a3081ad310b3009060355040613024d593111300f060355040813084b656c616e74616e311330110603550407130a4b6f746120426861727531233021060355040a131a4e7572616820436f6d6d756e636174696f6e2053646e20426864310b30090Finished request 2 Going to the next request Waking up in 5 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "unix" returns updated for request 3 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 10 length 200 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 3 modcall[authorize]: module "expiration" returns noop for request 3 modcall[authorize]: module "logintime" returns noop for request 3 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Finished request 3 Going to the next request Waking up in 5 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "unix" returns updated for request 4 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 4 modcall[authorize]: module "expiration" returns noop for request 4 modcall[authorize]: module "logintime" returns noop for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 4 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "unix" returns updated for request 5 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 12 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "expiration" returns noop for request 5 modcall[authorize]: module "logintime" returns noop for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - nurah rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of nurah PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to nurah Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "unix" returns updated for request 5 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 12 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "expiration" returns noop for request 5 modcall[authorize]: module "logintime" returns noop for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 60355040b13024954311e301c060355040313154e7572616820436f6d6d756e636174696f6e2043413124302206092a864886f70d01090116156e757261683132314073747265616d79782e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100c06c98b52f07e40b7a EAP-Message = 0x2bbc8195354322a1add2669b6490fa1e283485c0199c6c19b98d39f46d7a7794b2fcb00d603527c59937017b94ec55cb13fff98f955756e542a51615102155fb2b5488df44df901c8a3c4ff33cfeef393201adedaea261e0f09ba0b761b75ea936fefa309dcf4123e6181d6195933dc8d6bac8059cfb5d0203010001a382011630820112301d0603551d0e041604142ce51d8df33c708efad4c61573507ce4ab53dca23081e20603551d230481da3081d780142ce51d8df33c708efad4c61573507ce4ab53dca2a181b3a481b03081ad310b3009060355040613024d593111300f060355040813084b656c616e74616e311330110603550407130a4b6f EAP-Message = 0x746120426861727531233021060355040a131a4e7572616820436f6d6d756e636174696f6e2053646e20426864310b3009060355040b13024954311e301c060355040313154e7572616820436f6d6d756e636174696f6e2043413124302206092a864886f70d01090116156e757261683132314073747265616d79782e636f6d820900d4a1f9d8d7737d14300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002e723b0585ba7578446d0e31b3ca76f6a1cf7687cec687370f7cc19705f9f65fd9de89f88dd29289067f36429c986aa5b2acb0385db81ae478977e3c8afe5cac922f868c287102958f6480d804137a857b EAP-Message = 0x8cfd7b67dc75baae0473ebef570bc0818109395d7719dfc91c433512fdd6024ed7b95be263199c0a8b0b2b91e53ebf16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf555032e67d9a39b1882d1f8fcf09959 rad_recv: Access-Request packet from host 192.168.2.1 port 1028, id=10, length=299 User-Name = "nurah" NAS-IP-Address = 192.168.2.1 NAS-Identifier = "AP" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0xf555032e67d9a39b1882d1f8fcf09959 EAP-Message = 0x020a00c81980000000be16030100861000008200807b7478a2410e8462f3f7d10c0e9d50d19af9a741141bc370f1a8f6c75bf709f3acf214824e4cfc94f0dbe7fca16f0dc4e2cd2e2f07ee3fed801a4927f4cebbc81d3412d562849a1cc97326393602377db60bda2d700cbbcc7dc22e7a4fc2cb46f3a39d2ac03757b6c18c90ee28092771f720d783860385fa53a3b91c4ba1349614030100010116030100287b7da10c2e9631775cb253b814a2e0b7c2ae490e1315919d7ccdbcdffc15f7ead55393c895763aa0 Message-Authenticator = 0x797234f69da5e2f9b286b496e7f012de Sending Access-Challenge of id 10 to 192.168.2.1 port 1028 EAP-Message = 0x010b00391900140301000101160301002859982aa195439003edaefa0a02d39657f462c138c0a491cb9e3a2e8f53e454d78cf70c2593081536 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e87fe669ff8f70b4f366ff026238bf3 rad_recv: Access-Request packet from host 192.168.2.1 port 1029, id=11, length=105 User-Name = "nurah" NAS-IP-Address = 192.168.2.1 NAS-Identifier = "AP" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x2e87fe669ff8f70b4f366ff026238bf3 EAP-Message = 0x020b00061900 Message-Authenticator = 0x076cfe5e1e00f1331f6ab47739023c5b Sending Access-Challenge of id 11 to 192.168.2.1 port 1029 EAP-Message = 0x010c004819001703010018f1089fc93f10c7b3aff1fbd2de8e9f777555699758858a8817030100207d2beb720e59cd6554e8de7952b4bf30ba3209e191279c2413e014da3b750b3a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1f0cea76398ad5e6af48a1bfe5667d65 rad_recv: Access-Request packet from host 192.168.2.1 port 1030, id=12, length=142 User-Name = "nurah" NAS-IP-Address = 192.168.2.1 NAS-Identifier = "AP" NAS-Port = 29 Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 State = 0x1f0cea76398ad5e6af48a1bfe5667d65 EAP-Message = 0x020c002b19001703010020869dc6c24a3ce923587a617c19c1da7a14c44a17929e213eab2023743f1be8c3 Message-Authenticator = 0x3642782edda868940e8fed95b40490cb PEAP: Got tunneled EAP-Message EAP-Message = 0x020c000a016e75726168 PEAP: Sending tunneled request EAP-Message = 0x020c000a016e75726168 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "nurah" PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010d001f1a010d001a10650acba154cea10853bd3a630dd8b4316e75726168 Message-Authenticat PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Finished request 5 Going to the next request Waking up in 4 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "unix" returns updated for request 6 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 13 length 99 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 6 modcall[authorize]: module "expiration" returns noop for request 6 modcall[authorize]: module "logintime" returns noop for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to nurah PEAP: Adding old state with 79 06 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "unix" returns updated for request 6 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 13 length 64 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 6 modcall[authorize]: module "expiration" returns noop for request 6 modcall[authorize]: module "logintime" returns noop for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for nurah with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Finished request 6 Going to the next request Waking up in 4 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "unix" returns updated for request 7 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 14 length 43 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 7 modcall[authorize]: module "expiration" returns noop for request 7 modcall[authorize]: module "logintime" returns noop for request 7 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 4 seconds... Delaying request 7 for 1 seconds --- Walking the entire request list --- Waking up in 1 seconds... Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "unix" returns updated for request 8 rlm_realm: No '@' in User-Name = "nurah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry nurah at line 9 modcall[authorize]: module "files" returns ok for request 8 modcall[authorize]: module "expiration" returns noop for request 8 modcall[authorize]: module "logintime" returns noop for request 8 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 8 modcall: leaving group authenticate (returns invalid) for request 8 auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 7 with timestamp 43963da2 Cleaning up request 3 ID 10 with timestamp 43963da2 Cleaning up request 1 ID 8 with timestamp 43963da2 Cleaning up request 2 ID 9 with timestamp 43963da2 Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 12 with timestamp 43963da3 Cleaning up request 4 ID 11 with timestamp 43963da3 Cleaning up request 6 ID 13 with timestamp 43963da3 Cleaning up request 7 ID 14 with timestamp 43963da3 Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 3 with timestamp 43963da6 Nothing to do. Sleeping until we see a request. __________________________________________ Yahoo! DSL Something to write home about. Just $16.99/mo. or less. dsl.yahoo.com

9 22

MySQL accounting stop query
by Dennis Skinner 07 Dec '05

07 Dec '05

I noticed that the stop query changed at some point between 0.9.3 and 1.0.1. Here are the queries: ## 0.9.3 ## accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime = 0" ## 1.0.1 (same as 1.0.5) ## accounting_stop_query = "UPDATE ${acct_table2} SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Octets}', AcctOutputOctets = '%{Acct-Output-Octets}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" Notice the last item in the WHERE clause is missing in the later version. After looking at the data in my own radacct table, it looks like the change would cut down on duplicates, but at the cost of modifying rows that are potentially days or weeks old with new stoptime data. If the NAS reuses SessionID for the same user 2 weeks after the initial use, then the user will end up with a 2 week long session and if sqlcounter is in use, will likely be shutoff. It seems the 0.9.3 version is safer. I don't see specific mention of the change in the ChangeLog. Was there a reason for the change? I am working out the details of a modification of my own. At this point the WHERE clause looks like this (untested): WHERE AcctUniqueId = '%{Acct-Unique-Session-Id}' AND ABS((UNIXTIMESTAMP(AcctStartTime) - UNIXTIMESTAMP(DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND))) < 3600)" Basically, it uses AcctUniqueId which is a hash of AcctSessionId (from the NAS), the NAS-IP, UserName, and Nas-Port and then makes sure the AcctStarttime already in the table is within an hour of the derrived time based on the stoptime and the session length. NOTE: Those using MySQL 5.0+ can use TIMESTAMPDIFF instead of converting and subtracting. I think this change should help reduce duplicate accounting entries. It will incurr some added load for the date calc, but I'm hoping not too much given the AcctUniqueId should be indexed and have a low number of duplicates. Any thoughts? -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 0

RE: rlm_ldap: ldap_search() failed: Bad search filter:
by Alhagie Puye 07 Dec '05

07 Dec '05

Look like your syntax is wrong Why don't you have parenthesis around "sAMAccountName userAccountControl"? You are also missing an "=" between the two words. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Norbert Wegener > >Sent: December 7, 2005 12:30 PM > >To: FreeRadius users mailing list > >Subject: rlm_ldap: ldap_search() failed: Bad search filter: > > > >I am still trying to let freeradius query AD, but not yet > >too successfull. > > > >Using the following vars with ldapsearch, gives me the > >desired result, as shown below, but fails with rlm_ldap. > >########################################## > >server="mchm967a.tww006.sitest.net " > >port=3268 > >identity="testrad(a)TDE002.SITEST.NET " > >mypass="mypass" > >basedn="dc=TDE002,dc=SITEST,dc=NET" > >filter="(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl" > >######################################### > >ldapsearch -x -h $server -p $port -b $basedn $filter -D > >$identity -w $mypass -x > > > ># extended LDIF > ># > ># LDAPv3 > ># base <dc=TDE002,dc=SITEST,dc=NET> with scope sub # filter: > >(&(sAMAccountName=28TEF003$)(objectclass=computer)) > ># requesting: sAMAccountName userAccountControl # > > > ># 28TEF003, CAT-Computers, OU16, MchP, tde002.sitest.net > >dn: > >CN=28TEF003,OU=CAT-Computers,OU=OU16,OU=MchP,DC=tde002,DC=sit > >est,DC=net > >userAccountControl: 4096 > >sAMAccountName: 28TEF003$ > > > ># search result > >search: 2 > >result: 0 Success > > > ># numResponses: 2 > ># numEntries: 1 > >################################################## > >So far, so good. > >When I take the same vars in radiusd.conf, I get: > >rlm_ldap: ldap_search() failed: Bad search filter > >radiusd.conf: > > > > > > ldap ldap1 { > >server="mchm967a.tww006.sitest.net " > >port=3268 > >identity="testrad(a)TDE002.SITEST.NET " > >mypass="mypass" > >basedn="dc=TDE002,dc=SITEST,dc=NET" > >filter="(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl" > > ldap_debug= 0xFFFF > > ldap_connections_number = 5 > > timeout = 40 > > timelimit = 30 > > net_timeout = 10 > > tls { > > } > > dictionary_mapping = ${raddbdir}/ldap.attrmap > > } > > > >rlm_ldap: Bind was successful^M > >rlm_ldap: performing search in dc=TDE002,dc=SITEST,dc=NET, > >with filter > >(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl^M ldap_search^M > >put_filter: "(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl"^M > >put_filter: AND^M > >put_filter_list "(sAMAccountName=28TEF003$)(objectclass=computer)"^M > >put_filter: "(sAMAccountName=28TEF003$)"^M > >put_filter: simple^M > >put_simple_filter: "sAMAccountName=28TEF003$"^M > >put_filter: "(objectclass=computer)"^M > >put_filter: simple^M > >put_simple_filter: "objectclass=computer"^M > >put_filter: default^M > >put_simple_filter: "sAMAccountName userAccountControl"^M > >rlm_ldap: ldap_search() failed: Bad search filter: > >(&(sAMAccountName=28TEF003$)(objectclass=computer)) > >sAMAccountName userAccountControl^M ldap_msgfree^M > >rlm_ldap: search failed^M > > > >What am I doing wrong? > >Thanks > >Norbert Wegener > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

Question about AcctUniqueID
by Dennis Skinner 07 Dec '05

07 Dec '05

Hello all, I read the docs and hunted down some messages from this list about it. Here is what is in my radiusd.conf on both servers: acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port-Id" } (forgive the line wrap) I noticed this in my radacct table: *************************** 1. row *************************** RadAcctId: 13988509 AcctSessionId: 00000B80 AcctUniqueId: 00eff1fb2a906db0 UserName: user(a)bluefrognet.net Realm: bluefrognet.net NASIPAddress: 192.168.1.210 NASPortId: 127 NASPortType: Async AcctStartTime: 2005-08-30 08:52:54 AcctStopTime: 2005-08-30 08:55:14 AcctSessionTime: 135 AcctAuthentic: RADIUS ConnectInfo_start: ConnectInfo_stop: 26400/24000 V34=2B/V44/LAPM AcctInputOctets: 31080 AcctOutputOctets: 118434 CalledStationId: ########## CallingStationId: ########## AcctTerminateCause: User-Request ServiceType: Framed-User FramedProtocol: PPP FramedIPAddress: 192.168.100.101 AcctStartDelay: 0 AcctStopDelay: 5 *************************** 2. row *************************** RadAcctId: 16960699 AcctSessionId: 00000B80 AcctUniqueId: 00eff1fb2a906db0 UserName: user(a)bluefrognet.net Realm: bluefrognet.net NASIPAddress: 192.168.1.210 NASPortId: 144 NASPortType: Async AcctStartTime: 2005-12-05 08:54:43 AcctStopTime: 2005-12-05 09:11:08 AcctSessionTime: 986 AcctAuthentic: RADIUS ConnectInfo_start: 46666/26400 V90/V42bis/LAPM =285 ConnectInfo_stop: 26400 V34=2B/V44/LAPM =2826400/2 AcctInputOctets: 184798 AcctOutputOctets: 1271017 CalledStationId: ########## CallingStationId: ########## AcctTerminateCause: User-Request ServiceType: Framed-User FramedProtocol: PPP FramedIPAddress: 192.168.100.66 AcctStartDelay: 0 AcctStopDelay: 0 2 rows in set (0.03 sec) I have obviously obfuscated some of the data, but I kept it sane to the original. The part that has me puzzled is the NASPortId (I didn't change that in the data above). I assume that is the same as NAS-Port-ID in the key above, but FreeRADIUS has created identical AcctUniqueId's with diff ports. I am using 0.9.3 at the moment. I am working on uprading, but was wondering if this is a bug, or something that I may have missed in the ChangeLog, or am I missing something else? Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

1 1

Compatibility Question: Will FreeRADIUS work with Quintum NAS for VoIP?
by Henk Crafford 07 Dec '05

07 Dec '05

Hi All! I am quite new to RADIUS, both protocol and FreeRadius. I am developing a billing application for VoIP, and need to use Quintum Nas as well as JRadius! The things I am wondering is as follows: I need to know if FreeRADIUS, the great program it is, supports VSA's from a Quintum NAS? I need a tutorial or something to integrate JRADIUS into FreeRadius. These might seem like dumb questions - for that I am sorry - but I've been troubleshooting my FreeRadius for 3 days, finally got it to simulate and I'm running out of time( By the way Thanks to the guys for the comments! As well as such a great debug mode. I'm still new to all this but if I was more experienced it wouldn't have taken 4 hours). So please forgive me if it seems I am taking an easy way out. All the theory is worked out, algorithms the works just the programs need to be installed and physical coding. Thanks. _______________________________________________________________ Get the FREE email that has everyone talking at <a href=http://www.mail2world.com target=new>http://www.mail2world.com</a> Unlimited Email Storage POP3 Calendar SMS Translator Much More!

2 1