March 2006 - Freeradius-Users - lists.freeradius.org

RE: Table radacct is empty
by Vincent MARGUERIE 24 Mar '06

24 Mar '06

Hi, There's some progression on this friday night !! After the connection was OK for my client, radacct table was always empty and it is always the same if I do not change the following : Rename "accounting_start_query" by "postauth_query" in my sql.conf. It means that "accounting_start_query" is not started. So, is there something to setup for this ? In other words....Why "postauth_query" starts and not "accounting_start_query" ? Be sure that sql is specified in the accounting section of my radiusd.conf....of course :-) Thanks a lot for your help..it will work ! Regards, Vincent

1 0

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

> > I read a post from a long time ago about putting the > > attribute (set to any value) in the response list, but that does not > > seem to work (unless I did it wrong): > > > > /etc/raddb/preproxy_users: > > > > DEFAULT > > Message-Authenticator = 1 > > You're adding it to the proxied packet. Read the docs. Right, because FreeRADIUS is acting as a proxy -- but it wasn't even a problem, so I didn't really need to put that in there. Correct me if I'm wrong, but EAP should be doing Message-Authenticator stuff without me needing to tell it to add the attribute, right? It seems to be doing just that. > > Anyway, I think I am running into a problem with not having this in the > > packets. I am proxying requests from my Windows XP SP2 supplicant to my > > Cisco 1310 AP > > That's not proxying. The supplicant doesn't do RADIUS. Yeah, I suppose I could have worded that a bit more technically accurate. The supplicant is sending the EAP requests to the Cisco, which is sending RADIUS stuff to the router running FreeRADIUS, which is proxying those RADIUS requests to the IAS machine. Sound right now? > > When the proxied reply (Access-Challenge) goes out of the router back > > towards the Cisco 1310 AP and the supplicant, the Cisco or the > > supplicant (can't tell which) is ignoring the reply and then sending a > > new request. > > That's most likely the "extended key" oid nonsense that Microsoft needs. Since you seem to know something about this, can you either: A) Explain what the "extended key oid nonsense" is? B) Point me to some place I can read about it? I appreciate your help. Thanks, Eliot Gable

2 1

RE: Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

It would seem that I have been able to answer my own question for this. After doing an Ethereal dump, I noticed that the Message-Authenticator is indeed set to a valid value. This means that is simply isn't displayed with a value (it gets printed before it is computed). I also figured out that the Cisco was dropping the authentication packets because it was sending to a .6.1 address (the virtual IP for that interface) and receiving the response from the .6.2 address (the primary IP for that interface). Doh! Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details. -----Original Message----- From: freeradius-users-bounces+support8=greatlakes.net(a)lists.freeradius.org [mailto:freeradius-users-bounces+support8=greatlakes.net@lists.freeradiu s.org] On Behalf Of Eliot, Wireless and Server Administrator, Great Lakes Internet Sent: Friday, March 24, 2006 3:54 PM To: freeradius-users(a)lists.freeradius.org Subject: Message-Authenticator Attribute Is the message authenticator attribute properly implemented in FreeRADIUS? I see this in the code: /* * EAP-Message is always associated with * Message-Authenticator but not vice-versa. * * Don't add a Message-Authenticator if it's already * there. */ vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR); if (!vp) { vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->strvalue, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); } This indicates that anytime it adds a Message-Authenticator attribute, it simply sets it to 0. This would explain why I get: Message-Authenticator = 0x00000000000000000000000000000000 In my proxied packets. However, it could just be that the attributes are getting displayed before the authenticator is actually computed and that the authenticator is getting computed and sent out correctly in the actual packet. I read a post from a long time ago about putting the attribute (set to any value) in the response list, but that does not seem to work (unless I did it wrong): /etc/raddb/preproxy_users: DEFAULT Message-Authenticator = 1 Anyway, I think I am running into a problem with not having this in the packets. I am proxying requests from my Windows XP SP2 supplicant to my Cisco 1310 AP, then my router running FreeRADIUS, then Microsoft IAS. When the proxied reply (Access-Challenge) goes out of the router back towards the Cisco 1310 AP and the supplicant, the Cisco or the supplicant (can't tell which) is ignoring the reply and then sending a new request. Can anyone verify whether the Message-Authenticator attribute is or is not working properly? If it is not working, is it really likely to be causing this problem? Thanks for any help on this. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Message-Authenticator Attribute
by Eliot, Wireless and Server Administrator, Great Lakes Internet 24 Mar '06

24 Mar '06

Is the message authenticator attribute properly implemented in FreeRADIUS? I see this in the code: /* * EAP-Message is always associated with * Message-Authenticator but not vice-versa. * * Don't add a Message-Authenticator if it's already * there. */ vp = pairfind(request->reply->vps, PW_MESSAGE_AUTHENTICATOR); if (!vp) { vp = paircreate(PW_MESSAGE_AUTHENTICATOR, PW_TYPE_OCTETS); memset(vp->strvalue, 0, AUTH_VECTOR_LEN); vp->length = AUTH_VECTOR_LEN; pairadd(&(request->reply->vps), vp); } This indicates that anytime it adds a Message-Authenticator attribute, it simply sets it to 0. This would explain why I get: Message-Authenticator = 0x00000000000000000000000000000000 In my proxied packets. However, it could just be that the attributes are getting displayed before the authenticator is actually computed and that the authenticator is getting computed and sent out correctly in the actual packet. I read a post from a long time ago about putting the attribute (set to any value) in the response list, but that does not seem to work (unless I did it wrong): /etc/raddb/preproxy_users: DEFAULT Message-Authenticator = 1 Anyway, I think I am running into a problem with not having this in the packets. I am proxying requests from my Windows XP SP2 supplicant to my Cisco 1310 AP, then my router running FreeRADIUS, then Microsoft IAS. When the proxied reply (Access-Challenge) goes out of the router back towards the Cisco 1310 AP and the supplicant, the Cisco or the supplicant (can't tell which) is ignoring the reply and then sending a new request. Can anyone verify whether the Message-Authenticator attribute is or is not working properly? If it is not working, is it really likely to be causing this problem? Thanks for any help on this. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1

Compilation errors with 1.0.5 (Solaris)
by Heiden, John 24 Mar '06

24 Mar '06

I am pretty sure I have seen this before, but after searching the archives, I can't find the solution. Anyway, under Solaris 9 (SPARC) I get the following during compilation: Making static dynamic in rlm_eap... make[6]: Entering directory `/home/jheiden/freeradius-1.0.5/src/modules/rlm_eap' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I../../include -I./libeap -c rlm_eap.c -o rlm_eap.o In file included from rlm_eap.c:26: rlm_eap.h:26:18: ltdl.h: No such file or directory In file included from rlm_eap.c:26: rlm_eap.h:36: error: parse error before "lt_dlhandle" rlm_eap.h:36: warning: no semicolon at end of struct or union rlm_eap.h:39: error: parse error before '}' token rlm_eap.h:39: warning: type defaults to `int' in declaration of `EAP_TYPES' rlm_eap.h:39: warning: data definition has no type or storage class rlm_eap.h:51: error: parse error before "EAP_TYPES" rlm_eap.h:51: warning: no semicolon at end of struct or union rlm_eap.h:66: error: parse error before '}' token rlm_eap.h:66: warning: type defaults to `int' in declaration of `rlm_eap_t' rlm_eap.h:66: warning: data definition has no type or storage class rlm_eap.h:70: error: parse error before '*' token rlm_eap.h:70: warning: function declaration isn't a prototype rlm_eap.h:71: error: parse error before '*' token rlm_eap.h:71: warning: function declaration isn't a prototype rlm_eap.h:72: error: parse error before '*' token rlm_eap.h:72: warning: function declaration isn't a prototype rlm_eap.h:75: error: parse error before '*' token rlm_eap.h:75: warning: function declaration isn't a prototype rlm_eap.h:79: error: parse error before '*' token rlm_eap.h:79: warning: function declaration isn't a prototype rlm_eap.h:89: error: parse error before '*' token rlm_eap.h:89: warning: function declaration isn't a prototype rlm_eap.h:90: error: parse error before '*' token rlm_eap.h:90: warning: function declaration isn't a prototype rlm_eap.h:91: error: parse error before '*' token rlm_eap.h:92: warning: function declaration isn't a prototype rlm_eap.c:33: error: parse error before ')' token rlm_eap.c:33: error: initializer element is not constant rlm_eap.c:33: error: (near initialization for `module_config[0].offset') rlm_eap.c:33: warning: missing initializer rlm_eap.c:33: warning: (near initialization for `module_config[0].offset') rlm_eap.c:33: error: initializer element is not constant rlm_eap.c:33: error: (near initialization for `module_config[0]') rlm_eap.c:35: error: parse error before ')' token rlm_eap.c:35: error: initializer element is not constant rlm_eap.c:35: error: (near initialization for `module_config[1].offset') rlm_eap.c:35: warning: missing initializer rlm_eap.c:35: warning: (near initialization for `module_config[1].offset') rlm_eap.c:35: error: initializer element is not constant rlm_eap.c:35: error: (near initialization for `module_config[1]') rlm_eap.c:37: error: parse error before ')' token rlm_eap.c:37: error: initializer element is not constant rlm_eap.c:37: error: (near initialization for `module_config[2].offset') rlm_eap.c:37: warning: missing initializer rlm_eap.c:37: warning: (near initialization for `module_config[2].offset') rlm_eap.c:37: error: initializer element is not constant rlm_eap.c:37: error: (near initialization for `module_config[2]') rlm_eap.c:39: error: parse error before ')' token rlm_eap.c:39: error: initializer element is not constant rlm_eap.c:39: error: (near initialization for `module_config[3].offset') rlm_eap.c:39: warning: missing initializer rlm_eap.c:39: warning: (near initialization for `module_config[3].offset') rlm_eap.c:39: error: initializer element is not constant rlm_eap.c:39: error: (near initialization for `module_config[3]') rlm_eap.c:41: error: initializer element is not constant rlm_eap.c:41: error: (near initialization for `module_config[4]') rlm_eap.c: In function `eap_detach': rlm_eap.c:55: error: `inst' undeclared (first use in this function) rlm_eap.c:55: error: (Each undeclared identifier is reported only once rlm_eap.c:55: error: for each function it appears in.) rlm_eap.c:58: error: parse error before ')' token rlm_eap.c:53: warning: unused parameter `instance' rlm_eap.c: At top level: rlm_eap.c:82: warning: declaration of `cs' shadows a global declaration rlm_eap.h:37: warning: shadowed declaration is here rlm_eap.c: In function `eap_instantiate': rlm_eap.c:87: error: `inst' undeclared (first use in this function) rlm_eap.c:89: error: parse error before ')' token rlm_eap.c: In function `eap_authenticate': rlm_eap.c:199: error: `inst' undeclared (first use in this function) rlm_eap.c:207: error: parse error before ')' token rlm_eap.c:197: warning: unused parameter `instance' rlm_eap.c: In function `eap_authorize': rlm_eap.c:428: error: `inst' undeclared (first use in this function) rlm_eap.c:432: error: parse error before ')' token rlm_eap.c:426: warning: unused parameter `instance' make[6]: *** [rlm_eap.o] Error 1 make[6]: Leaving directory `/home/jheiden/freeradius-1.0.5/src/modules/rlm_eap' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/jheiden/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/jheiden/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/jheiden/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/jheiden/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/jheiden/freeradius-1.0.5' make: *** [all] Error 2 Any suggestions/tips? Thanks much in advance! John

2 1

1.1.1 (and earlier): PREFIX/share is rwx------
by Stefan Winter 24 Mar '06

24 Mar '06

Hi, been trying to prepare my installation to use HUP. After getting the permissions in /etc/raddb right, I saw that $INSTALL_PREFIX/share is created with rwx------ root:root permissions (at least when using a non-default PREFIX during configure), and by default makes HUPing radiusd impossible when it runs as a different user. It is kinda against the idea of a "share" directory to be so restrictive. The docs won't be readable by everyone, and (worse) the dictionaries can't be re-read on a HUP. Of course I can change this after installing, but maybe the Makefiles should be more liberal in the first place to make that unnecessary. A rwxr-xr-x sounds better suited. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Clear text passwords
by Corey Burks 24 Mar '06

24 Mar '06

I have recently built up a freeradius server V1.1.0, I am new to freeradius, since we were using and old version of Navisradius. In Navisradius it would compare the crypt password strings and log the crypt sting verses the clear text password. Is it possible to have freeradius not log the clear text passwords, while still logging the auth request? Or have it log the crypt password strings instead? My radius server is binding to a Netscape LDAP server which is storing the passwords using UNIX crypt. Yet the radius server is logging the clear test password. Thank you for your help. Corey Detail log shows: Packet-Type = Access-Request Thu Mar 23 11:23:30 2006 User-Name = "cburks" User-Password = "abc123" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 172.16.15.251 NAS-Port-Type = Virtual Client-IP-Address = 172.16.15.251 Debug output shows rad_recv: Access-Request packet from host 172.16.15.251:2264, id=1, length=70 User-Name = "cburks" User-Password = "abc123" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 172.16.15.251 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/172.16.15.251/detail ' rlm_detail: %A/%{Client-IP-Address}/detail expands to /usr/local/freeradius/var/ log/radius/radacct/172.16.15.251/detail modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "cburks", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 234 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for cburks radius_xlat: '(uid=cburks)' radius_xlat: 'ou=people,o=zhone.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap-master.oak.zhone.com:389, authentication 0 rlm_ldap: bind as cn=Directory Manager/secret to ldap-master.oak.zhone.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=zhone.com, with filter (uid=cburks) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user cburks authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "cburks" with password "abc123" rlm_ldap: user DN: uid=CBurks,ou=People, o=zhone.com rlm_ldap: (re)connect to ldap-master.oak.zhone.com:389, authentication 1 rlm_ldap: bind as uid=CBurks,ou=People, o=zhone.com/abc123 to ldap-master.oak.zh one.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user cburks authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/172.16.15.251/reply- detail-20060323' rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/re ply-detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/172.16 .15.251/reply-detail-20060323 modcall[post-auth]: module "reply_log" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 1 to 172.16.15.251 port 2264 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds...

6 8

Movaz Dictionary
by David Mitchell 24 Mar '06

24 Mar '06

Greetings, does anybody know of a dictionary for Movaz equipment? Specifically, their docs refer the to attributes Movaz-Initial-CLI-Access-Level and Movaz-Max-CLI-Access-Level but don't provide the information needed to encode them as far as I can tell. I'll try working with their support staff more, but so far we haven't had any luck getting the needed information. If anybody here knows how I'd appreciate the help. Thanks. -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

1 0

users file: =~ and User-Password
by Stefan Winter 24 Mar '06

24 Mar '06

Hi, I'm trying to understand what exactly happens in the users file when processing User-Password. The situation I'm seeing here is in a rather complex scenario, and the results are not quite what I would expect. In short, when a MS-CHAP'ed request comes in and users contains a check User-Password =~ (foo|bar), then even though there is no User-Password attribute in the request itself, it matches. The long story, for those still reading, is: * mySQL database with our "nice" users. Nice means, they have a single password for all of our services (ASMTP, IMAP, VPN, Dial-Up, Groupware). * some users have for ancient reasons two different passwords, one for VPN&Dial-Up, one for the rest. * these users are handled in the users file, with uname User-Password =~ (foo|bar), Auth-Type := Accept * The processing order in authorize and authenticate is: authorize { preprocess nas_auth_log suffix mschap files eap sql } authenticate { Auth-Type MS-CHAP { mschap } eap } Now, -X shows that first authorize->mschap comes into action and sets the Auth-Type to MS-CHAP (fine). It does *NOT* set a User-Password attribute because this can only be retrieved later during authorize->sql. The next module to come is authorize->files. There, in my opinion, the above-mentioned line that contains User-Password =~ (foo|bar) SHOULD NOT match, because there is no User-Password attribute in the request. But: users DOES match (when one of the passwords matches the CHAP challenge) and sets Auth-Type to Accept. This can only mean that files does some auto-validating against the CHAP challenge, where it should only make a simple string comparison (not even that, since the attribute isn't even there, it should just do nothing). Now you could say, so what, the user gets accepted after all, so why do you care? The reason is that as soon as Auth-Type is set to Accept, authenticate->mschap isn't called any more, and so the encryption seeds and and attributes are not set. That way, people end up being accepted by RADIUS, but the VPN concentrator denies access anyways. I'm aware I can get around this by using Auth-Type = Accept, to not override the previously-set MS-CHAP. But the real cause is in that a "users" line matches that, according to the documentation of the =~ operator, shouldn't. If you explain me now that the magic MS-CHAP validation is intentional, no problem: I would even submit a documentation patch explaining things. But just leaving the hand-waiving undocumented is not good IMHO. For complete reference, here's the -X run-through of the case in question (hints line 4 sets a VSA RESTENA-Service-Type to VPN): rad_recv: Access-Request packet from host 158.64.X.Y:1026, id=116, length=152 User-Name = "foobar" NAS-Port = 1801 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "158.64.A.B" MS-CHAP-Challenge = 0xbla44babcdefb327e8c48eobfuscated MS-CHAP2-Response = 0xwhatever NAS-IP-Address = 158.64.X.Y NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 30048 hints: Matched DEFAULT at 4 modcall[authorize]: module "preprocess" returns ok for request 30048 radius_xlat: '/var/log/radius/radacct/20060323/VPN-service/auth-detail' rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/auth-detail expands to /var/log/radius/radacct/20060323/VPN-service/auth-detail modcall[authorize]: module "nas_auth_log" returns ok for request 30048 rlm_realm: No '@' in User-Name = "foobar", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 30048 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 30048 users: Matched entry foobar at line 115 modcall[authorize]: module "files" returns ok for request 30048 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 30048 radius_xlat: 'foobar' rlm_sql (sql-normal-vpn): sql_set_user escaped user --> 'foobar' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'foobar' ORDER BY id' rlm_sql (sql-normal-vpn): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'foobar' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'foobar' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'foobar' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql-normal-vpn): Released sql socket id: 4 modcall[authorize]: module "sql-normal-vpn" returns ok for request 30048 modcall: leaving group authorize (returns ok) for request 30048 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [foobar] (from client moria port 1801) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 30048 radius_xlat: '/var/log/radius/radacct/20060323/VPN-service/reply-detail' rlm_detail: /var/log/radius/radacct/%Y%m%d/%{RESTENA-Service-Type}-service/reply-detail expands to /var/log/radius/radacct/20060323/VPN-service/reply-detail modcall[post-auth]: module "nas_reply_log" returns ok for request 30048 rlm_sql (sql-normal-vpn): Processing sql_postauth radius_xlat: 'foobar' rlm_sql (sql-normal-vpn): sql_set_user escaped user --> 'foobar' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'foobar', 'VPN', 'Access-Accept', NOW())' rlm_sql (sql-normal-vpn) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'foobar', 'VPN', 'Access-Accept', NOW()) rlm_sql (sql-normal-vpn): Reserving sql socket id: 3 rlm_sql (sql-normal-vpn): Released sql socket id: 3 modcall[post-auth]: module "sql-normal-vpn" returns ok for request 30048 modcall: leaving group post-auth (returns ok) for request 30048 Sending Access-Accept of id 116 to 158.64.1.53 port 1026 Finished request 30048 Going to the next request --- Walking the entire request list --- Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 3

relams max domains
by Vasco Santos 24 Mar '06

24 Mar '06

Hi again, what is the maximum of domains that I cant put in the realms file of radius clistron version 1.6.4? Tanks

1 0