December 2006 - Freeradius-Users - lists.freeradius.org

Error: Failed to link EAP-Type/tls
by Nazeer Khan 16 Dec '06

16 Dec '06

Hi, I am trying to run freeRADIUS. Following is the version information. radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Dec 16 2006 at 15:37:14 --------------------------- I am getting the error messages as: rlm_exec: Wait=yes but no output defined. Did you mean output=none? . . . . rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. Also "radiusd start" gives the following errors: Sat Dec 16 18:03:46 2006 : Info: Starting - reading configuration files ... radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (rlm_exec: Wait=yes but no output defined. Did you mean output=none?) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (radiusd.conf[10]: eap: Module instantiation failed. ) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (radiusd.conf[1939] Unknown module "eap".) radiusd: Couldn't open /usr/local/var/log/radius/radius.log for logging: Permission denied (radiusd.conf[1886] Failed to parse authenticate section. ------------------------------ Can anyone help me please that what is the problem. I have successfully created the certificates. But i could not run the freeRADIUS... :( Thank you. Nazeer Khan -------------------------------------------------------------------------- This email and any attachments may be confidential. They may contain legally privileged information or copyright material. You should not read, copy, use or disclose them without authorisation. If you are not an intended recipient, please contact us at once by return email and then delete both messages. We do not accept liability in connection with computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment. This notice should not be removed.

1 0

NAS-Port translation
by Jack Daniels 16 Dec '06

16 Dec '06

Hi, is there a way to translate the NAS-Port integer value into a string representing the physical interface on the switch? I mean, is there a way to get something like 'Fa0/1" from something like "Nas-Port = 50001"?? If so, could somebody tell how to do it? Thanks _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

3 2

rlm_sql: Password in Accounting Packet
by Marco Stuhl 15 Dec '06

15 Dec '06

Hello, Is there a way to insert password in radacct table? Changing SQL query to insert %{User-Password} has no effect. I'm aware of the RFCs - is there any workaround for this? Thanks, Marco

3 8

Help with Simultaneous Login on Freeradius+Ldap
by listasmw＠netconsult.inf.br 15 Dec '06

15 Dec '06

Hi, we are using FreeRadius 1.1.3 on Fedora Core 6 and the RLM_LDAP module, we're needing control simultaneous logins, eg. the ldap user "John" can authenticate only one time. When are monitoring the ldap users logins, they can log successfully in ldap, but we can't see or monitoring the users login in radutmp log file is empty with 0kb, when we execute the radwho command, it is empty but is opening. could you help me please? Regards, Maicon Wendhausen Freeradius Files Logs File: [root@firedap3 radius]# ls -la total 24 drwx------ 3 radiusd radiusd 4096 Dec 14 18:21 . drwxr-xr-x 10 root root 4096 Dec 14 19:06 .. drwx------ 3 radiusd radiusd 4096 Dec 14 19:55 radacct -rw------- 1 radiusd root 5357 Dec 14 20:03 radius.log -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radutmp -rw-r--r-- 1 radiusd root 0 Dec 14 18:21 radwtmp [root@firedap3 radius]# Log do Radius in Debug mode rad_recv: Access-Request packet from host 10.69.70.210:32771, id=87, length=63 User-Name = "user6" User-Password = "user6" NAS-IP-Address = 10.69.70.210 Service-Type = Authenticate-Only NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "user6", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 modcall[authorize]: module "digest" returns noop for request 2 users: Matched entry DEFAULT at line 222 modcall[authorize]: module "files" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for user6 radius_xlat: '(uid=user6)' radius_xlat: 'dc=nct,dc=com,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=nct,dc=com,dc=br, with filter (uid=user6) rlm_ldap: Added password {SSHA}f21M8OjksIKSJ1zUEii6JWKu43tWPRFgsBeiQg== in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user user6 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 2 rlm_ldap: - authenticate rlm_ldap: login attempt by "user6" with password "user6" rlm_ldap: user DN: uid=user6,dc=nct,dc=com,dc=br rlm_ldap: (re)connect to 10.69.70.25:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=user6,dc=nct,dc=com,dc=br/user6 to 10.69.70.25:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user user6 authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 2 modcall: leaving group LDAP (returns ok) for request 2 Processing the session section of radiusd.conf modcall: entering group session for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: 'user6' modcall[session]: module "radutmp" returns ok for request 2 modcall: leaving group session (returns ok) for request 2 Login OK: [user6] (from client firepass port 0) Sending Access-Accept of id 87 to 10.69.70.210 port 32771 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... users file #...... DEFAULT Simultaneous-Use := 1 Fall-Through = 1 clients.conf file .... default configuration..... client 10.69.70.210 { secret = teste shortname = firepass } radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { radutmp { filename = ${logdir}/radutmp ## username = "(uid=%{Stripped-User-Name:-%{User-Name}})" username = %{User-Name} case_sensitive = "yes" check_with_nas = "yes" perm = "0644" callerid = "no" } pap { encryption_scheme = crypt } chap { authtype = CHAP } #$INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = no } ldap { server="10.69.70.25" identity="uid=gged,dc=nct,dc=com,dc=br" password=ged basedn="dc=nct,dc=com,dc=br" filter = (uid=%{Stripped-User-Name:-%{User-Name}}) ## filter= (uid=gged,dc=nct,dc=com,dc=br) password_attribute = userPassword dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_cache_timeout = 150 ldap_cache_size = 0 ldap_connections_number = 1 timeout = 3 timelimit = 5 net_timeout = 1 compare_check_items = no } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = yes } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { #key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" key = "User-Name, Acct-Session-Id, NAS-IP-Address" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr # daily } authorize { #preprocess # auth_log # attr_filter chap mschap suffix digest # ntdomain #eap # Read the 'users' file files ldap # daily # checkval } authenticate { Auth-Type PAP { pap ldap } Auth-Type CHAP { chap ldap } Auth-Type MS-CHAP { mschap ldap } Auth-Type LDAP { ldap } } preacct { preprocess acct_unique suffix # Read the 'acct_users' file #files } accounting { detail # daily # # For Simultaneous-Use tracking. # radutmp # sradutmp # main_pool } session { radutmp # sql } post-auth { } pre-proxy { } post-proxy { }

2 1

Chap support
by Sinan Ulker 15 Dec '06

15 Dec '06

0 *H÷ 010 +0 *H÷ $Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit how can I add chap support to the free radius? ë00l¹/`Ì¡zF ž[pl¯0 *H÷ 0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network0 980518000000Z 280801235959Z0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network00 *H÷ 0§!t,çðá<!ñÛéüÂŸ_RÈÌ,V,ži,Ì°®yò9Á{º,èÂ,ªié ôÇ©€BÂ#OJØð¢û1lÉæo'õæôLxmëFú¹ÉTò²Ä¯ÔFZÉ0ÿ lõ-mÎw0 *H÷ r.ùÑñqûÄöÅ^Q@žhøØâœÿí¡æfê/ ôÊ×ê¥+ö$`MD.¥Ä- Ó®xiorÚl®ðc7æ»Ä0wÌI5ªÏØÑŸ·GsjT"4d-¶Y[ŽQY:³ôßg ô2d^±Fr'{ÅDŽ®0Ä0- y£òš"ihTÚÕšï_0 *H÷ 010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network10USBS Turkey Class 2 CA0 050126000000Z 140413235959Z010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network1$0"UE-Guven Sertifika Otoritesi00 *H÷ 0ñJ6DSñ`ž Æ¡á<{ÆçfV°4BªŽëÊïöeGT§õ&³_érÜÃUÌÔ3žG^óåÙé©6l2wÁÍGvâGky} _ßXŸ2åÐÍ#°ùsüÙ P}MYaá[zí54Å£#00Uÿ0ÿ0BU ;0907`HøE0(0&+https://www.sbs.com.tr/rpa0RUK0I0G E CAhttp://crl.trustcenter.sbs.com.tr/SBSTurkeyClass2CA/LatestCRL.crl0U0$U0€010UAffSCC2-1-180U¬ö]šnñLôì2Ø0U#0UkõP^dQ³xK×ŠS/W0 *H÷ ¹º(sµÃµp¡w%M¶¥ãö[a;þxc£:y=Ca® Ì(Í4§ã3£ej)\@ ¡D©âó0z:ÓÿÞ_Æ\ oDÅÈ ÌÊuÌójQü#«.ª²gñ{%ù$ øò§k^BŠSË0[0Ä Åž9zŸy?0 *H÷ 0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network0 040415000000Z 140414235959Z010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network10USBS Turkey Class 2 CA00 *H÷ 0ßÞÂ¿sÓòvÂ CfÊQnVÔÍüî®xal|2tñÇhbÑÎóïEBxQÍ(lÕ,Õ?Œ€Ò°1$í.uÛA5çe9Pâ5!U«}k|š7Y0Üšçøµå¡÷ XÌYz%í(ËýXã£00Uÿ0ÿ04U-0+0) ' %#http://crl.verisign.com/pca2-g2.crl0U0$U0€010UAffSCC2-1-150UUkõP^dQ³xK×ŠS/W0èU#à0Ý¡Ç€Ä0Á10 UUS10U VeriSign, Inc.1<0:U3Class 2 Public Primary Certification Authority - G21:08U1(c) 1998 VeriSign, Inc. - For authorized use only10UVeriSign Trust Network¹/`Ì¡zF ž[pl¯0 *H÷ DiÛâ[&=oõb»ú(f<p]m HuýÞ(ŒGÚ.ž0;±sÄ8µñA*6£Ášr[au)7ÉÒ§yMà& þöÌ V:¶¥.Ô³t^)\±Øòæç/1·PvêM^¡ûïæP ¿¢RÆ¬ðÕõ0æ0O Ç{õÛŠæ,U+¯0 *H÷ 010 UTR1907U 0Siemens Business Services Sistem Hizmetleri A.S.10UVeriSign Trust Network1$0"UE-Guven Sertifika Otoritesi0 050613000000Z 100612235959Z010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority0"0 *H÷ 0 žNQoÕò*ñ÷ý2¥ÉøÞA¿QaU ÅZ0tÑa3MxXbŠDíÐ|*fqojöHöðºÝüñðð€p<;ŠT?øËŠÑ>Ob¹bÃÂaPõc÷`Š1bdHŠKNÁ_g=Ô`tœïŠÕ,u£^ÞPYì#×RûóûðMó£ZQFÞg^ÐÛL:(Pšš?«Ž¡¡ÒÛ[40Þ®€ÅGÊ_Š=ñH÷%õNä0ÖœVnRUWœšÕ¿Ë¯+Š¹ª?¹·Éø3qÖV²8 5§±Ãc^8Úá³Ð"<£>0:0Uÿ0ÿ0BU ;0907`HøE0(0&+https://www.sbs.com.tr/rpa0YUR0P0N L JHhttp://crl.trustcenter.sbs.com.tr/EGuvenSertifikaOtoritesi/LatestCRL.crl0U0 `HøB0%U0€010U C1C2-1-2048-10U'aS~2åò^â{48û² ª0U#0¬ö]šnñLôì2Ø0 *H÷ ð_A°ÀÛ_·êâ[¶ìÿø¬M{yËÈkÍêN1Õ6/A}èàa!WoÝ^ÍÛ8j:öV±%ªBg«Ô[6MÈ€dPŠ{éü)bh{²Èm&òhYàÅ±®hŒY?[º8IzÀÐAms³)y`Èmô3Uö0Ï0· }Ð¯€¬Õ»Í¡-0 *H÷ 010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority0 060922000000Z 080921235959Z01D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10USECURITY AND MESSAGING1F0DU=www.verisign.com/repository/CPS Incorp. by Ref.,LIAB.LTD(c)9610UCompany - Ford Otosan10UJobTitle - 10USinan Ulker1!0 *H÷ sulker@ford.com.tr00 *H÷ 0è^1Ì]ÌùñüÚØìD(Õâ'SÏVö¢ÒRUµPCš?ºÊþOÅÓ^íú&ÔÍÔT ÿ$»Îg¶_ðÓ,ïÊM!zÅ¯êVp<bÑó§AëzšMB; é»ëÑàÁk(l!€-JÕÕ3£00Uð0 U00U00 ~|http://mpki-crl.trustcenter.sbs.com.tr/KOCNETHABERLESMETEKNOLOJILERIVEILETISIMHIZMETLERIASSECURITYANDMESSAGING/LatestCRL.crl0NU G0E0C`HøE0402+&https://www.trustcenter.sbs.com.tr/rpa0 `HøB0BU%;09++ +7 +7 +70-U&0$ " +7 sulker(a)ford.com.tr0 `HøE ÿ0 *H÷ 8.°ŒWª#ª¯ûØO{Ùgÿ+FE#ÙÁ[ÅD[§žT"³11]tf|8._XË² ÊÂe+VØs&¹=Àôûí°*Êa3ÚSU7¡|œ€Yk W?º=ñ+öóµï0ÌpÒ3cU5~VÆéK{ŠñÓíI ©`Õ©Fø*Þ{œ¡';cP TAø×ÖýÒ÷z$·òSxîª÷'+¶ÀLŠ¢€ŒÍ»ÿ<GôkC£¡ýîµIšÑ¯möÚqŽèêã®Jë&wl*Æ©100!010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority}Ð¯€¬Õ»Í¡-0 + 80 *H÷ 1 *H÷ 0 *H÷ 1 061215142345Z0# *H÷ 12ÔÏ}AãçÌ\¬jÊd\:&0g *H÷ 1Z0X0 *H÷ 0*H÷ 0 *H÷ @0+0 *H÷ (0+0 *H÷ 04 +71%0!010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority}Ð¯€¬Õ»Í¡-06*H÷ 1% !010 UTR1D0BU ;KOCNET HABERLESME TEKNOLOJILERI VE ILETISIM HIZMETLERI A.S.10UVeriSign Trust Network1907U0Terms of use at https://www.sbs.com.tr/rpa (c)05100.U'Class 2 OnSite Individual Subscriber CA1(0&UKoc.net Certification Authority}Ð¯€¬Õ»Í¡-0 *H÷ $ü\wtñ\º:-)ìð^öº/¬Mà`¹jçêd¬d§°!èúûs?'Üç%Y8ÎÏY#;ÇL$^KæEH+NŠÙnó å€UÕËÏÑÜŠáãUnŽµAÝ9»ED}JaÒ,Ÿ8W€'%ëíÅþ¬E

2 1

FREERADIUS USING IP POOLS
by Tomas Eduardo Lotina Ramos 14 Dec '06

14 Dec '06

3 2

R: Session section misconfiguration?
by Francesco Cristofori 14 Dec '06

14 Dec '06

Alan, thanks for quick answering. > You should probably upgrade to 1.1.3. It's the next thing in the todo list, after I have understood configuration. :-) Are there any particular caveats on upgrading or best practices I should know? > If you're not using it, sure. Hmmm... I need to make a little investigation on this, but I think the only thing we use is Dialup Admin interface, and it should use sql session accounting, isn't it? > Alan DeKok. Thanks again, Francesco Cristofori.

2 1

Accounting data not being properly written to mySQL database.
by Dave Martin 14 Dec '06

14 Dec '06

GentlePersons, I'm in the process of converting from flat file to mySQL database for our RADIUS accounting. I've modified the accounting_start_query entry in sql.conf to: accounting_start_query = "INSERT into ${acct_table1} \ SET \ AcctSessionId = '%{Acct-Session-id}', \ AcctUniqueId = '%{Acct-Unique-Session-Id}', \ UserName = '%{SQL-User-Name}', \ Realm = '%{Realm}', \ NASIdentifier = '%{NAS-Identifier}', \ NASPortId = '%{NAS-Port}', \ NASPortType = '%{NAS-Port-Type}', \ AcctStartTime = '%S', \ AcctStopTime = '0', \ AcctSessionTime = '0', \ AcctAuthentic = '%{Acct-Authentic}', \ ConnectInfo_start = '%{Connect-Info}', \ ConnectInfo_stop = '0', \ AcctInputOctets = '0', \ AcctOutputOctets = '0', \ CalledStationId = '%{Called-Station-Id}', \ CallingStationId = '%{Calling-Station-Id}', \ AcctTerminateCause = '', \ ServiceType = '%{Service-Type}', \ FramedProtocol = '%{Framed-Protocol}', \ FramedIPAddress = '%{Framed-IP-Address}', \ AcctStartDelay = '%{Acct-Delay-Time}', \ AcctStopDelay = '0', \ XAscendDataRate = '%{X-Ascend-Data-Rate}', \ XAscendDisconnectCause = '%{X-Ascend-Disconnect-Cause}', \ XAscendModemPortNo = '%{X-Ascend-Modem-Port-No}', \ XAscendModemShelfNo = '%{X-Ascend-Modem-Shelf-No}', \ XAscendModemSlotNo = '%{X-Ascend-Modem-Slot-No}', \ XAscendXmitRate = '%{X-Ascend-Xmit-Rate}'" I'm seeing all the fields written to the database as expected, but several of them (all the 'XAscend' parameters) are being written to the database as '0'. I still have flat file logging enabled and the values are being written properly there in the Start records. e.g.: Wed Dec 13 06:47:37 2006 Event-Timestamp = "Dec 13 2006 06:47:25 PST" *User-Name = "*******" *NAS-IP-Address = 1.2.3.4 *NAS-Identifier = "nasid" Ascend-Owner-IP-Addr = 0.0.0.0 NAS-Port = 101072015 Ascend-NAS-Port-Format = 5 NAS-Port-Type = Async Service-Type = Framed-User Acct-Status-Type = Start Acct-Delay-Time = 0 Acct-Session-Id = "521456215" Acct-Authentic = RADIUS Ascend-Auth-Delay = 240 X-Ascend-Data-Rate = 24000 X-Ascend-Xmit-Rate = 49333 X-Ascend-Modem-PortNo = 192 X-Ascend-Modem-SlotNo = 34 X-Ascend-Modem-ShelfNo = 1 *Calling-Station-Id = "1234567890" Ascend-Calling-Id-Type-Of-Num = National-Number Ascend-Calling-Id-Number-Plan = ISDN-Telephony Ascend-Calling-Id-Presentatn = Allowed Ascend-Calling-Id-Screening = Network-Provided *Called-Station-Id = "1234567890" X-Ascend-Data-Svc = 0 Framed-Protocol = PPP *Framed-IP-Address = 1.2.3.4 *Client-IP-Address = 1.2.3.4 Acct-Unique-Session-Id = "90bb5c1dcbf6939d" *Stripped-User-Name = "user" Realm = "NULL" Timestamp = 1166021257 (fields beginning with '*' have been sanitized). Any ideas? Thanks! Dave Martin -- ------------------------------------------------------------------------ Dave Martin Netcetera, Inc. dpm(a)netcetera.com ------------------------------------------------------------------------

1 0

Chap authentication
by fjlagos＠vtr.net 14 Dec '06

14 Dec '06

Hello: How can i set a basic CHAP authentication? What parameters and files i must set? Can you send me an example? Saludos y Gracias Francisco

3 2

Proxy-State problem
by Cory Robson 14 Dec '06

14 Dec '06

freeradius <https://10.0.2.61:10000/software/edit_pack.cgi?search=freeradius&package=fr eeradius&version=1%2E1%2E3%2D1%2E1> 1.1.3-1.1 build from latest rpm for for fedora 6. Commindico/Soul NAS List Authentication packets are received and the radius daemon passes an auth ok but doesn't return the proxy-state packet correctly, as a result the user is not authorized. All that is passed seems to be a hex dump and not the same as what is received. I obviously must have missed something in the config files so I'm hoping someone here might be able to point me in the right direction. Cory

2 1