October 2007 - Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 30, Issue 105
by Maribel Hernandez 30 Oct '07

30 Oct '07

Hola: freeradius-users-request(a)lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: web based admin (Peter Nixon) 2. RE: web based admin (Hawkins, Michael) 3. Class attribute in accounting record. (Mark J Elkins) 4. Re: Class attribute in accounting record. (Michael da Silva Pereira) 5. Re: Class attribute in accounting record. (tnt(a)kalik.co.yu) 6. Re: Class attribute in accounting record. (Mark Elkins) ---------------------------------------------------------------------- Message: 1 Date: Mon, 29 Oct 2007 15:58:13 +0200 From: Peter Nixon Subject: Re: web based admin To: freeradius-users(a)lists.freeradius.org Cc: "Hawkins, Michael" Message-ID: <200710291558.13895.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-1" On Mon 29 Oct 2007, Hawkins, Michael wrote: > Hi all, > > I am very familiar with Cisco Secure ACS for AAA of Cisco devices. I am > considering using FreeRadius at another customer site instead of Cisco > Secure ACS. > > Will I still be able to control command execution (authorization) etc > via FreeRadius? Or would I be restricted to authentication only? By using the word "still" it implies that SecureACS can do this also, but as far as I know, unless something has changed recently, cisco equipment only supports this feature with TACACS+ and not RADIUS.. Comparing a SecureACS TACACS+ server with FreeRADIUS is comparing apples and oranges... FreeRADIUS is generally MUCH more powerfull than SecureACS in its RADIUS functionality.. FreeRADIUS, doe not however support TACACS+ at present.. -- Peter Nixon http://peternixon.net/ ------------------------------ Message: 2 Date: Mon, 29 Oct 2007 10:21:32 -0400 From: "Hawkins, Michael" Subject: RE: web based admin To: Message-ID: <89FC1CD18AC0884B80C7B5E80A10DC0209FCDEB4(a)NYEXCHG1.na.ad.tullib.com> Content-Type: text/plain; charset="us-ascii" Peter, Yes, I was comparing TACACS+ to RADIUS - my mistake. Any recommendations on the most appropriate web front end for FreeRadius when managing a Cisco network that is pointing at a FreeRadius AAA server? Mike Hawkins Office: 212-208-3888 Mobile: 917-887-3614 -----Original Message----- From: Peter Nixon [mailto:listuser@peternixon.net] Sent: Monday, October 29, 2007 9:58 AM To: freeradius-users(a)lists.freeradius.org Cc: Hawkins, Michael Subject: Re: web based admin On Mon 29 Oct 2007, Hawkins, Michael wrote: > Hi all, > > I am very familiar with Cisco Secure ACS for AAA of Cisco devices. I am > considering using FreeRadius at another customer site instead of Cisco > Secure ACS. > > Will I still be able to control command execution (authorization) etc > via FreeRadius? Or would I be restricted to authentication only? By using the word "still" it implies that SecureACS can do this also, but as far as I know, unless something has changed recently, cisco equipment only supports this feature with TACACS+ and not RADIUS.. Comparing a SecureACS TACACS+ server with FreeRADIUS is comparing apples and oranges... FreeRADIUS is generally MUCH more powerfull than SecureACS in its RADIUS functionality.. FreeRADIUS, doe not however support TACACS+ at present.. -- Peter Nixon http://peternixon.net/ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- The information contained in this email is confidential and may also contain privileged information. Sender does not waive confidentiality or legal privilege. If you are not the intended recipient please notify the sender immediately; you should not retain this message or disclose its content to anyone. Internet communications are not secure or error free and the sender does not accept any liability for the content of the email. Although emails are routinely screened for viruses, the sender does not accept responsibility for any damage caused. Replies to this email may be monitored. --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________ ------------------------------ Message: 3 Date: Mon, 29 Oct 2007 16:45:14 +0200 From: Mark J Elkins Subject: Class attribute in accounting record. To: freeradius-users(a)lists.freeradius.org Message-ID: <4725F1FA.6010800(a)posix.co.za> Content-Type: text/plain; charset=ISO-8859-1 My access provider is setting and sending me the "Class" attribute in an accounting record... I use MySQL to store such info in... and I'm using freeradius 1.1.6 in order to Capture the value - I modified all accounting "Insert" statements to.... (as an example) accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Class}')" This captures the info fine.... (yes - also changed the MySQL table) | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | Class | +-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ | 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | 0 | RADIUS | DSL AutoShapedVC | | 0 | 0 | | | | Framed-User | PPP | 1.2.4.99 | 0 | 0 | 0x4e5331 | ... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" Reading the RFC's (with FreeRadius documentation) - this should be a Char Octets kindof field... Should the access provider sent the string in ASCII rather? Did something in FreeRadius convert the ASCII to Hex? What can I do to convert this on the fly into ASCII - save a bit of space in my Database - etc. Reading the mailing-lists archives - I see that it can contain binary data - thus the Hex. Which is "better" - to change the dictionary definition from octet to string or some sort of mysql function call? (better ==> less things to remember/patch between updates) The access provider states that the info provided will always be ascii (or translate to ascii - if decoded). -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496 ------------------------------ Message: 4 Date: Mon, 29 Oct 2007 16:52:41 +0200 From: Michael da Silva Pereira Subject: Re: Class attribute in accounting record. To: FreeRadius users mailing list Message-ID: 1ImVyq-00038W-15 Content-Type: text/plain Hi Mark, The provider is obviously SAIX (ZA based ISP), Looks like SAIX are sending it through as ASCII text, on my side? Tue Sep 18 14:25:53 2007 Acct-Session-Id = "7/0/2/20.557_30429449" Framed-Protocol = PPP Framed-IP-Address = 41.242.121.175 User-Name = "XXXXXXX(a)dsl512.tradepage.co.za" X-Ascend-Connect-Progress = 60 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Port-Type = Virtual NAS-Port = 1913913901 NAS-Port-Id = "7/0/2/20.557" Connect-Info = "AutoShapedVC" Class = "NS1" Service-Type = Framed-User NAS-IP-Address = 196.43.27.23 Check you /share/freeradius/dictionary file and check what you have for the Class Attribute. I have the following: dictionary:ATTRIBUTE Class 25 string Kind Regards, Michael da Silva Pereira Tradepage ;) -----Original Message----- From: Mark J Elkins Reply-To: FreeRadius users mailing list To: freeradius-users(a)lists.freeradius.org Subject: Class attribute in accounting record. Date: Mon, 29 Oct 2007 16:45:14 +0200 My access provider is setting and sending me the "Class" attribute in an accounting record... I use MySQL to store such info in... and I'm using freeradius 1.1.6 in order to Capture the value - I modified all accounting "Insert" statements to.... (as an example) accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Class}')" This captures the info fine.... (yes - also changed the MySQL table) | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | Class | +-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ | 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | 0 | RADIUS | DSL AutoShapedVC | | 0 | 0 | | | | Framed-User | PPP | 1.2.4.99 | 0 | 0 | 0x4e5331 | ... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" Reading the RFC's (with FreeRadius documentation) - this should be a Char Octets kindof field... Should the access provider sent the string in ASCII rather? Did something in FreeRadius convert the ASCII to Hex? What can I do to convert this on the fly into ASCII - save a bit of space in my Database - etc. Reading the mailing-lists archives - I see that it can contain binary data - thus the Hex. Which is "better" - to change the dictionary definition from octet to string or some sort of mysql function call? (better ==> less things to remember/patch between updates) The access provider states that the info provided will always be ascii (or translate to ascii - if decoded). This email and all its contents are subject to the following disclaimer: "http://www.tradepage.net/disclaimer.aspx" ------------------------------ Message: 5 Date: Mon, 29 Oct 2007 16:20:15 +0100 From: Subject: Re: Class attribute in accounting record. To: "FreeRadius users mailing list" Message-ID: Content-Type: text/plain; charset=ISO-8859-2 You can use CHAR() in the sql statement if you recieving Class attribute ASCII encoded. Ivan Kalik Kalik Informatika ISP Dana 29/10/2007, "Mark J Elkins" pi?e: >My access provider is setting and sending me the "Class" attribute in an >accounting record... > >I use MySQL to store such info in... and I'm using freeradius 1.1.6 > >in order to Capture the value - I modified all accounting "Insert" >statements to.... (as an example) > >accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, >AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, >AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, >ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, >CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, >FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) >values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', >'%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', >'%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', >'%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', >'%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', >'%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', >'%{Class}')" > >This captures the info fine.... (yes - also changed the MySQL table) > >| RadAcctId | AcctSessionId | AcctUniqueId | >UserName | Realm | NASIPAddress | >NASPortId | NASPortType | AcctStartTime | AcctStopTime | >AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | >AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId >| AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | >AcctStartDelay | AcctStopDelay | Class | >+-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ >| 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | >xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | >Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | >0 | RADIUS | DSL AutoShapedVC | | >0 | 0 | | >| | Framed-User | PPP | 1.2.4.99 >| 0 | 0 | 0x4e5331 | > > >.... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" > >Reading the RFC's (with FreeRadius documentation) - this should be a >Char Octets kindof field... > >Should the access provider sent the string in ASCII rather? >Did something in FreeRadius convert the ASCII to Hex? >What can I do to convert this on the fly into ASCII - save a bit of >space in my Database - etc. > >Reading the mailing-lists archives - I see that it can contain binary >data - thus the Hex. >Which is "better" - to change the dictionary definition from octet to >string or some sort of mysql function call? >(better ==> less things to remember/patch between updates) >The access provider states that the info provided will always be ascii >(or translate to ascii - if decoded). > >-- > . . ___. .__ Posix Systems - Sth Africa > /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE >/ |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496 > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ Message: 6 Date: Mon, 29 Oct 2007 18:22:04 +0200 From: Mark Elkins Subject: Re: Class attribute in accounting record. To: FreeRadius users mailing list Message-ID: <1193674924.11780.8.camel@localhost> Content-Type: text/plain On Mon, 2007-10-29 at 16:45 +0200, Mark J Elkins wrote: > My access provider is setting and sending me the "Class" attribute in an > accounting record... > > I use MySQL to store such info in... and I'm using freeradius 1.1.6 Wisdom prevails.. (touching the dictionaries is probably a bad* thing to do...) I'm using ... accounting_stop_query_alt = "INSERT.... , UNHEX(SUBSTR('%{Class}',3)))" .. which keeps personal changes to one place (sql.conf and files in /etc/raddb) and saves me from upsetting Alan DeKok's karma* - a bad thing to do. -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496 ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 30, Issue 105 ************************************************* CON CARIÑO MARIBEL HERNÁNDEZ LÓPEZ __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: Access-Reject in a php script
by manIP 30 Oct '07

30 Oct '07

Hi, Have you find out any solutions to that problem? I'm waiting for an answer before modifying the source code... May be, there is a bug and the official source code should be modified as Patric did. Cheers! Khalid :) Hi all, > > Thanks again! > I've tried to put return(2) and it does not work because my client > receives > an Access-Accept. > If I let exit(2), the server does not send anything so the client fall in > time out. The user will not have access but he will make many attempts as > long as he does not receive an Access-Reject packet. Furthermore, he needs > to know what is going on... > BTW, I'm using the "NTRadPing Test Utility" client. > > hereunder is the output debug: > Module: Instantiated realm (suffix) > exec: wait = yes > exec: program = "/home/authentication.php" > exec: input_pairs = "request" > exec: output_pairs = "reply" > exec: packet_type = "Access-Request" > Module: Instantiated exec (myauth) > Module: Instantiated files (files) > exec: wait = yes > exec: program = "/home/accounting.php" > exec: input_pairs = "request" > exec: output_pairs = "reply" > exec: packet_type = "Accounting-Request" > Module: Instantiated exec (myacct) > > > rad_recv: Access-Request packet from host x.x.x.x:2658, id=49, length=58 > User-Name = "xxx" > User-Password = "xxx" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: Looking up realm "xxx" for User-Name = "xxx" > rlm_realm: No such realm "xxxx" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > Exec-Program output: > Exec-Program: returned: 2 > rlm_exec (myauth): External script failed > modcall[authorize]: module "myauth" returns fail for request 0 > modcall: leaving group authorize (returns fail) for request 0 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host xxxxx, id=49, length=58 > Discarding duplicate request from client xxxx - ID: 49 > --- Walking the entire request list --- > Waking up in 2 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 49 with timestamp 4721d900 > Nothing to do. Sleeping until we see a request. > > Thank you very much anyway! > > Patric wrote: > > > Something just occurred to me that I dont think I tried before. > > > What happens if instead of doing an > > > > > > exit(2); > > > > > > you do a > > > > > > return(2); > > > > > > This way your script will still exit clean, so freeradius wont pick it > > > up as a script failure, but hopefully will still get the result? > > > > No. If the script succeeds, the output is either a text message, or > > RADIUS attributes that go into an Access-Accept. > > > > If the script fails, the server sends an Access-Reject. > > > > Stop playing games with PHP and post the output of "radiusd -X". I'll > > bet money that the solution is right there in the debug output. > > > > Alan DeKok. > > >

3 4

Re: Server instability
by Nicolai Tejlgaard Hansen 30 Oct '07

30 Oct '07

I'm having the exact same problem as described below, with Freeradius 1.7 hanging at 99 percent. Also using PEAP, MSCHAPV2, and eDir, and running 1.7 on a SLES 10 SP1. I have been using the same configuration since 1.3 without any problems problems, but since upgrading from 1.6 to 1.7 it's "crashed" 3 times within a month. This is the last line of my log files each time it hangs at 99 percent: usr/local/var/log/radius/radius.log-20070928.bz2:Thu Sep 27 16:32:23 2007 : Error: Discarding duplicate request from client 3WXM-2:20006 - ID: 247 due to unfinished request 23061 /usr/local/var/log/radius/radius.log-20071010.bz2:Sun Oct 7 21:19:47 2007 : Error: Discarding duplicate request from client 3WXM-1:20002 - ID: 188 due to unfinished request 60866 /usr/local/var/log/radius/radius.log-20071024.bz2:Wed Oct 24 08:10:05 2007 : Error: Discarding duplicate request from client 3WXM-2:20008 - ID: 211 due to unfinished request 94412 As per Phil Mayers request, I recompiled with the developer option (and --edir as I am using that). The following is the output: Attaching to program: /usr/local/sbin/radiusd, process 23141 Loaded symbols for /usr/local/sbin/radiusd Reading symbols from /lib/libnsl.so.1...done. Loaded symbols for /lib/libnsl.so.1 Reading symbols from /lib/libresolv.so.2...done. Loaded symbols for /lib/libresolv.so.2 Reading symbols from /lib/libpthread.so.0...done. [Thread debugging using libthread_db enabled] [New Thread -1212410192 (LWP 23141)] [New Thread -1272144992 (LWP 3414)] [New Thread -1263752288 (LWP 1784)] [New Thread -1255359584 (LWP 1757)] [New Thread -1246966880 (LWP 23146)] [New Thread -1238574176 (LWP 23145)] [New Thread -1230181472 (LWP 23144)] [New Thread -1221788768 (LWP 23143)] [New Thread -1213396064 (LWP 23142)] Loaded symbols for /lib/libpthread.so.0 Reading symbols from /usr/local/lib/libradius-1.1.7.so...done. Loaded symbols for /usr/local/lib/libradius-1.1.7.so Reading symbols from /lib/libcrypt.so.1...done. Loaded symbols for /lib/libcrypt.so.1 Reading symbols from /usr/lib/libltdl.so.3...done. Loaded symbols for /usr/lib/libltdl.so.3 Reading symbols from /lib/libdl.so.2...done. Loaded symbols for /lib/libdl.so.2 Reading symbols from /usr/lib/libssl.so.0.9.8...done. Loaded symbols for /usr/lib/libssl.so.0.9.8 Reading symbols from /usr/lib/libcrypto.so.0.9.8...done. Loaded symbols for /usr/lib/libcrypto.so.0.9.8 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 Reading symbols from /usr/local/lib/rlm_exec-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_exec-1.1.7.so Reading symbols from /usr/local/lib/rlm_expr-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_expr-1.1.7.so Reading symbols from /usr/local/lib/rlm_pap-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_pap-1.1.7.so Reading symbols from /usr/local/lib/rlm_mschap-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_mschap-1.1.7.so Reading symbols from /usr/local/lib/rlm_ldap-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_ldap-1.1.7.so Reading symbols from /usr/lib/libldap_r-2.3.so.0...done. Loaded symbols for /usr/lib/libldap_r-2.3.so.0 Reading symbols from /usr/lib/liblber-2.3.so.0...done. Loaded symbols for /usr/lib/liblber-2.3.so.0 Reading symbols from /usr/lib/libsasl2.so.2...done. Loaded symbols for /usr/lib/libsasl2.so.2 Reading symbols from /usr/local/lib/rlm_unix-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_unix-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap-1.1.7.so Reading symbols from /usr/local/lib/libeap-1.1.7.so...done. Loaded symbols for /usr/local/lib/libeap-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_md5-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_md5-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_leap-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_leap-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_gtc-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_gtc-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_tls-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_tls-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_ttls-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_ttls-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_peap-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_peap-1.1.7.so Reading symbols from /usr/local/lib/rlm_eap_mschapv2-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_eap_mschapv2-1.1.7.so Reading symbols from /usr/local/lib/rlm_realm-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_realm-1.1.7.so Reading symbols from /usr/local/lib/rlm_preprocess-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_preprocess-1.1.7.so Reading symbols from /usr/local/lib/rlm_files-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_files-1.1.7.so Reading symbols from /usr/local/lib/rlm_acct_unique-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_acct_unique-1.1.7.so Reading symbols from /usr/local/lib/rlm_detail-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_detail-1.1.7.so Reading symbols from /usr/local/lib/rlm_radutmp-1.1.7.so...done. Loaded symbols for /usr/local/lib/rlm_radutmp-1.1.7.so 0xffffe410 in __kernel_vsyscall () Thread 9 (Thread -1213396064 (LWP 23142)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x80118b30) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 8 (Thread -1221788768 (LWP 23143)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x8011d080) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 7 (Thread -1230181472 (LWP 23144)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x8011d138) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 6 (Thread -1238574176 (LWP 23145)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x8011d1f0) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 5 (Thread -1246966880 (LWP 23146)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x8011d2a8) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 4 (Thread -1255359584 (LWP 1757)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x801a4d20) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 3 (Thread -1263752288 (LWP 1784)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7ea9faf in sem_wait(a)GLIBC_2.0 () from /lib/libpthread.so.0 No symbol table info available. #2 0x800148ce in request_handler_thread (arg=0x80153e70) at threads.c:534 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #3 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #4 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 2 (Thread -1272144992 (LWP 3414)): #0 0xb7c28b0d in _int_malloc () from /lib/libc.so.6 No symbol table info available. #1 0xb7c2a085 in calloc () from /lib/libc.so.6 No symbol table info available. #2 0xb7c5dd75 in re_acquire_state_context () from /lib/libc.so.6 No symbol table info available. #3 0xb7c63c01 in re_compile_internal () from /lib/libc.so.6 No symbol table info available. #4 0xb7c64cc4 in regcomp () from /lib/libc.so.6 No symbol table info available. #5 0x800161df in paircmp (req=0x80242e50, request=0xb391bf68, check=0x80118008, reply=0x80175368) at valuepair.c:365 i = <value optimized out> rxmatch = {{rm_so = 0, rm_eo = -1272151048}, {rm_so = -2147422548, rm_eo = 0}, {rm_so = -2146357296, rm_eo = -2145114136}, {rm_so = -2147359520, rm_eo = -2146357296}, {rm_so = 0, rm_eo = -1272150952}, {rm_so = -2147423649, rm_eo = -1272150972}, {rm_so = -1272150968, rm_eo = -1272151000}, {rm_so = -1209472631, rm_eo = -1272150920}, {rm_so = -2146465632, rm_eo = 1036177532}} check_item = (VALUE_PAIR *) 0x80118008 auth_item = (VALUE_PAIR *) 0xb3912ef8 compare = <value optimized out> other = 1 reg = {buffer = 0xb39248f0 "\220ã\221³*", allocated = 140, used = 140, syntax = 242428, fastmap = 0xb3911510 "H\001\220³H\001\220³", translate = 0x0, re_nsub = 0, can_be_null = 0, regs_allocated = 0, fastmap_accurate = 0, no_sub = 0, not_bol = 0, not_eol = 0, newline_anchor = 0} #6 0xb7adb092 in file_authorize (instance=0x801067f0, request=0x80242e50) at rlm_files.c:321 namepair = <value optimized out> request_pairs = (VALUE_PAIR *) 0xb391bf68 check_tmp = (VALUE_PAIR *) 0xb7ade2ab reply_tmp = (VALUE_PAIR *) 0x802427e8 pl = (PAIR_LIST *) 0x80118d68 found = 0 check_pairs = (VALUE_PAIR **) 0x80242e60 reply_pairs = (VALUE_PAIR **) 0x80175368 check_save = (VALUE_PAIR *) 0x6 #7 0x8000e85f in modcall (component=1, c=0x80117980, request=0x80242e50) at modcall.c:238 myresult = 6 #8 0x8000eeac in call_one (component=676979, p=0x0, request=0xffffffc0, priority=0xb42c8574, result=0xb42c8578) at modcall.c:272 r = <value optimized out> #9 0x8000ea5f in modcall (component=1, c=0x801155d8, request=0x80242e50) at modcall.c:327 g = (modgroup *) 0x801155d8 myresult = 6 #10 0x8000cade in indexed_modcall (comp=1, idx=0, request=0x80242e50) at modules.c:469 this = (indexed_modcallable *) 0x80115680 #11 0x80005b10 in rad_authenticate (request=0x80242e50) at auth.c:602 namepair = <value optimized out> check_item = <value optimized out> reply_item = <value optimized out> auth_item = (VALUE_PAIR *) 0x0 module_msg = <value optimized out> tmp = (VALUE_PAIR *) 0x0 result = <value optimized out> r = <value optimized out> umsg = "\221,´Ý´è·Ø\234\002\200h\221,´x\221,´\211éè·È\221,´('\221³\027f\220ÝX\237\002\200H\001\000\000à\nÎ·\000\000\000\000£êè·ô\017Î·\020\000\220³\000\000\000\000¨\221,´P\000\000\000\020\000\220³D\001\000\000hÙé·\000\000\000\0000'\221³Ø\221,´m é· ©%\200\024\000\000\000D\001\000\000l\000\000\000\000\000\000\000\032\000\000\0000'\221³hÙé·\000\000\000\0000'\221³X\222,´ÊOé· ©%\200\024\000\000\000\020\000\000\000\\\221é·ô\017Î·l'\221³`X \200\200ª%\200\000\000\000\000\020\000\000\000\000\000\000\000\001\000\000\000\001"... user_msg = <value optimized out> exec_program = <value optimized out> exec_wait = <value optimized out> seen_callback_id = <value optimized out> buf = '\0' <repeats 100 times>, "3TÂ·\004rÁ·\000\000\000\000\000\000\000\0004\220,´ \233,´ô\017Î·z²é·t\221,´Ä\220,´üè¿·à\220,´z²é·", '\0' <repeats 20 times>, " \233,´\227÷¿·\000\000\000\000\000\000\000\000 \220,´\000\000\000\000\000\000\000\0004\220,´\000\000\000\000\000\000\000\0003TÂ·\004rÁ·\000\000\000\000\032\000\000\000¤\220,´t\221,´ô\017Î·\237\223\001\200ä\221,´4\221,´üè¿·P\221,´\000\000\000\000ÿÿÿÿ\v\000\000\000o²é·4\220,´\003\000\000\000\n", '\0' <repeats 15 times>, "\n\000\000\0002"... logstr = '\0' <repeats 1023 times> autz_retry = 0 '\0' autz_type = 676979 #12 0x80010087 in rad_respond (request=0x80242e50, fun=0x80005a30 <rad_authenticate>) at radiusd.c:1669 rcode = <value optimized out> packet = <value optimized out> original = <value optimized out> secret = 0x80242e70 "Troldhavelaage900#" finished = <value optimized out> reprocess = <value optimized out> #13 0x800149ec in request_handler_thread (arg=0x801bfb30) at threads.c:570 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> set = {__val = {16391, 0 <repeats 31 times>}} #14 0xb7ea42ab in start_thread () from /lib/libpthread.so.0 No symbol table info available. #15 0xb7c81a4e in clone () from /lib/libc.so.6 No symbol table info available. Thread 1 (Thread -1212410192 (LWP 23141)): #0 0xffffe410 in __kernel_vsyscall () No symbol table info available. #1 0xb7c8d57e in __lll_mutex_lock_wait () from /lib/libc.so.6 No symbol table info available. #2 0xb7c2b111 in _L_mutex_lock_4125 () from /lib/libc.so.6 No symbol table info available. #3 0xb7b5e598 in ?? () from /usr/lib/libldap_r-2.3.so.0 No symbol table info available. #4 0xb7ea735c in __pthread_mutex_unlock_usercnt () from /lib/libpthread.so.0 No symbol table info available. #5 0xb7b1e31a in ber_memfree_x () from /usr/lib/liblber-2.3.so.0 No symbol table info available. #6 0xb7b3b67a in ldap_ld_free () from /usr/lib/libldap_r-2.3.so.0 No symbol table info available. #7 0xb7b3b8a6 in ldap_unbind_ext () from /usr/lib/libldap_r-2.3.so.0 No symbol table info available. #8 0xb7b3b93d in ldap_unbind_s () from /usr/lib/libldap_r-2.3.so.0 No symbol table info available. #9 0xb7b75ecf in ldap_detach (instance=0x80104850) at rlm_ldap.c:2402 i = 0 pair = <value optimized out> nextpair = <value optimized out> #10 0x8000dc02 in detach_modules () at modules.c:130 ml = <value optimized out> next = <value optimized out> #11 0x80011d3a in main (argc=1, argv=0xbfd4c134) at radiusd.c:1191 fun = (RAD_REQUEST_FUNP) 0x80005a30 <rad_authenticate> request = (REQUEST *) 0x80242e50 packet = (RADIUS_PACKET *) 0x0 secret = (u_char *) 0x800fd6d0 "Troldhavelaage900#" buffer = "*", '\0' <repeats 831 times>, "¹ ï·²C½·ØÅî·ôoð· sð·\000\000\000\000ü´Ô¿°?ï·", '\0' <repeats 24 times>, "²C½·\000\000\000\000 pð·", '\0' <repeats 12 times>, "È|è·", '\0' <repeats 48 times>, "¹ ï· hÐ·\020\177è·ôoð·È|è· hÐ·\200µÔ¿°?ï· hÐ·ÎhÐ·", '\0' <repeats 16 times>, " hÐ·\000\000\000\000 pð·", '\0' <repeats 12 times>, "0zè·", '\0' <repeats 20 times>, "ÎhÐ·", '\0' <repeats 20 times>, "¹ ï·Ñ<á·\020\177è"... readfds = {fds_bits = {8, 0 <repeats 31 times>}} argval = <value optimized out> pid = <value optimized out> max_fd = 182868 status = <value optimized out> tv = (struct timeval *) 0x8001ece4 act = {__sigaction_handler = {sa_handler = 0x8000fe30 <sig_fatal>, sa_sigaction = 0x8000fe30 <sig_fatal>}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0} listener = (rad_listen_t *) 0x0 #0 0xffffe410 in __kernel_vsyscall () - Best regards - Nicolai On Mon, 2007-09-24 at 13:40 -0700, Phil Mayers wrote: >> I am a newbie, running 3 (for redundancy) FreeRadius servers (1.1.7) >> on SUSE 10 SP1 (32-bit) to authenticate our wireless clients (PEAP >> MSCHAPv2) to our eDirectory via LDAP. We average 800-900 simultaneous >> wireless clients (need to support a potential 4K in the future). >> >> The setup works well and authenticates users very quickly, but every >> couple days, the radiusd process will either blow up and start >> consuming 99% of the CPU or die altogether. More often it blows up. >> We had stability problems initially, even when the process was >> running, so I took everything out of the config that we didn't need >> and that seemed to help. >First question; are you HUPing the daemon? If so, don't - it won't work >well. > >Second question; if this happens reliably can you recompile from >scratch: > >./configure --enable-developer >make >make install > >...and when it happens do this: > >gdb /usr/local/sbin/radiusd >set pagination off >set logging file /root/radiusd-wireless.txt >set logging on >attach $PID >thread apply all bt full > >...that'll give some details as to what the server is doing when it >pegs the CPU. Other options are strace or (if your Linux system has it) >SystemTap. The aim being to determine what it's doing when it goes wrong.

3 3

Class attribute in accounting record.
by Mark J Elkins 30 Oct '07

30 Oct '07

My access provider is setting and sending me the "Class" attribute in an accounting record... I use MySQL to store such info in... and I'm using freeradius 1.1.6 in order to Capture the value - I modified all accounting "Insert" statements to.... (as an example) accounting_start_query = "INSERT into ${acct_table1} (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, Class) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Telkom-Access-Type:-!SAIX} %{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0', '%{Class}')" This captures the info fine.... (yes - also changed the MySQL table) | RadAcctId | AcctSessionId | AcctUniqueId | UserName | Realm | NASIPAddress | NASPortId | NASPortType | AcctStartTime | AcctStopTime | AcctSessionTime | AcctAuthentic | ConnectInfo_start | ConnectInfo_stop | AcctInputOctets | AcctOutputOctets | CalledStationId | CallingStationId | AcctTerminateCause | ServiceType | FramedProtocol | FramedIPAddress | AcctStartDelay | AcctStopDelay | Class | +-----------+----------------------+------------------+---------------------------------+--------------+--------------+------------+-------------+---------------------+---------------------+-----------------+---------------+-------------------+------------------+-----------------+------------------+-----------------+------------------+--------------------+-------------+----------------+-----------------+----------------+---------------+----------+ | 21488415 | 7/0/0/2.157_13B0EB0F | 32161edf2c7a5dec | xxxxxxxxxxxxxxx@xxxxxxxxxxx | realmname | 1.2.3.4 | 1879179421 | Virtual | 2007-10-29 16:15:07 | 0000-00-00 00:00:00 | 0 | RADIUS | DSL AutoShapedVC | | 0 | 0 | | | | Framed-User | PPP | 1.2.4.99 | 0 | 0 | 0x4e5331 | ... However - I get a Hex String ... 0x4e5331 - where I was expecting "NS1" Reading the RFC's (with FreeRadius documentation) - this should be a Char Octets kindof field... Should the access provider sent the string in ASCII rather? Did something in FreeRadius convert the ASCII to Hex? What can I do to convert this on the fly into ASCII - save a bit of space in my Database - etc. Reading the mailing-lists archives - I see that it can contain binary data - thus the Hex. Which is "better" - to change the dictionary definition from octet to string or some sort of mysql function call? (better ==> less things to remember/patch between updates) The access provider states that the info provided will always be ascii (or translate to ascii - if decoded). -- . . ___. .__ Posix Systems - Sth Africa /| /| / /__ mje(a)posix.co.za - Mark J Elkins, SCO ACE, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

5 4

freeRADIUS with Active-derectory
by Hangjun He 30 Oct '07

30 Oct '07

Hi, I have configured ntlm_auth in freeRADIUS talk to AD(user store). And It works well. Now I want to use ldap to get attribute from AD, It failed. It seems ldapsearch will search user's display name. And ntlm_auth will search user's user logon name. If I set display name same with user logon name, It can work. Is there a way let ldapsearch to search user logon name too?? relate configure in radiusd.conf: authorize { mschap   suffix eap files ldap }     authenticate { Auth-Type MS-CHAP { mschap } eap ldap } --------------------------------- 雅虎邮箱，终生伙伴！

2 1

Cisco sslvpn authentication with freeradius
by satish patel 30 Oct '07

30 Oct '07

Dear all I have cisco SSLVPN gateway and i want to authenticate user freeradius authentication server but i need more input from community what type of control i can done with it ?? Is it possible to control some user session or number of time to control is there anybody have done it ??/ $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- 5, 50, 500, 5000 - Store N number of mails in your inbox. Click here.

1 0

NAS-Port and IP pool
by Dánial Olsen 29 Oct '07

29 Oct '07

Hi, I'm hoping someone can assist me with my problem with assigning ip addresses with freeradius 1.1.6 on OpenBSD 4.1. I'm using freeradius to with an Ericsson CGSN and now I'm trying to assign ip addresses to my Mobile Stations. The problem is that the CGSN makes requests to freeradius always using the same IP and always port 1, which means only one IP is assigned. After a lot of searching I've come to the conclusion that freeradius uses NAS-port and NAS-ip to uniquely identify the clients. Is my conclusion correct? How can I assign IP addresses to my MS using another unique id, e.g. IMSI or MSISDN - which I can include in the request? /Danial

3 3

CAR cisco radius replace freeradius
by satish patel 29 Oct '07

29 Oct '07

Dear all I have CAR cisco radius server with MPLS attribites but there is no Accouting option for users so is it possible to replace CAS radius with freeradius server ?? $ cat ~/satish/url.txt http://www.linuxbug.org _____________________________________________________________________________________________________ --------------------------------- Did you know? You can CHAT without downloading messenger. Click here

2 1

NAS-IP-Address = 0.0.0.0
by Walter Gould 29 Oct '07

29 Oct '07

Please excuse me if this has already been covered in the docs or the FAQ (I looked - but nothing jumped out at me). In accounting packets coming from Cisco Catalyst 6513 switches, the NAS-IP-Address = 0.0.0.0. Does anybody know why and if this can be changed? I have tried modifying the aaa accounting commands on the switch, but has not seemed to fix it. On our 3750 series switches, this doesn't happen and the correct switch/NAS ip address is listed in the NAS-IP-Address attribute field. Thanks in advance, Walter

5 5

Accounting on request from GGSN after 5sec.
by Mal 29 Oct '07

29 Oct '07

Dear all, I'm using the freeradius(freeradius-1.1.0-19 ) on mobile network. GGSN contacts the radius server like below. 1.GGSN---Accounting Off request--->Radius 2.GGSN<--Accounting Off response---Radius 3.GGSN---Accounting On request--->Radius After 5 sec, 4.GGSN---Accounting On request--->Radius 5.GGSN<--Accounting On response---Radius I don't know why GGSN tries to send the Accounting On request "twice".It is always after 5sec. I checked the ethereal log on Radius,Radius is responding correctly to GGSN.But,GGSN is not receiving the response on the first try. Excuse me but,please give me the advice asap. G------------S G w---------Radius S------------i N c h I tried to use the one link between GGSN and Switch,but it looks same.

2 1